Information on the Collection of Personal Data provided in accordance with Article 13 of the GDPR (RODO), before completing the PATIENT PERSONAL DATA FORM

Data Controller: NOWA Sp. z o.o. ul. Puławska 111A/5/3, 02-707 Warsaw KRS: 0001048792, NIP: 7011157594 hereinafter referred to as “NOWA”

1. Contact for Personal Data Protection Matters For all matters related to the protection of personal data, please contact us:

by e-mail: nowaclinica@gmail.com

by post at the address of NOWA’s registered office,

or by phone: +48 570 320 997.

2. Purpose and Legal Basis for Data Processing Your personal data are processed for the purpose of providing medical services, based on the provisions of the GDPR: • Article 6(1)(a) – in connection with the consent you have given; • Article 6(1)(b) – for the performance of a contract for the provision of medical services; • Article 6(1)(c) – for compliance with a legal obligation related to maintaining medical documentation; • Article 9(2)(h) – for purposes of preventive medicine, medical diagnosis, treatment, or the management of healthcare systems.

3. Recipients of Personal Data Your personal data may be shared only with entities that are necessary to ensure the safety and quality of services provided or to perform medical services, in particular: • entities managing the website, hosting, and booking system (e.g. Altegio, JivoChat); • providers of IT systems and e-mail servers; • public authorities authorized by law (e.g. NFZ, regulatory bodies); • laboratories, dental prosthetics studios, or other medical partners — based on a data processing agreement.

4. Data Retention Period Your personal data as a patient will be stored for the period specified by law for medical documentation (currently at least 20 years). Other personal data will be stored for the duration of the medical service or until the expiration of any claims arising from it.

5. Rights of the Data Subject You have the right to: • access your personal data; • rectify, delete, or restrict the processing of your data; • data portability; • withdraw consent to data processing (if the processing is based on consent); • object to data processing for reasons related to your particular situation, in accordance with Article 21 of the GDPR. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) address: ul. Stawki 2, 00-193 Warsaw, if you believe that the processing of your personal data violates the provisions of the GDPR.

6. Obligation to Provide Data Providing your personal data is a statutory requirement with respect to maintaining medical documentation (mandatory data — pursuant to Article 25 of the Act on Patient Rights and the Patient Ombudsman). Providing additional data is necessary for the conclusion of a contract for the provision of medical services. Failure to provide mandatory data makes it impossible to maintain medical documentation and, consequently, to provide medical services.

7. Transfer of Data Outside the European Economic Area (EEA) Your personal data will not be transferred outside the European Economic Area (EEA) and will not be shared with international organizations.

8. Automated Decision-Making Your personal data are not processed in an automated manner (including profiling) that could result in decisions producing legal effects concerning you.

9. Video Monitoring (CCTV) To ensure the safety of employees and associates, protect property, and safeguard confidential information whose disclosure could cause harm to the Controller — which constitutes a legitimate interest of the Controller (Article 6(1)(f) of the GDPR) — a video surveillance system operates on the premises of NOWA. Video recordings are stored for no longer than 1 month, after which they are automatically overwritten.