Skip to contentLast updated: 16 September 2026
This policy explains how we process personal data when you visit pobozy.org or contact us about the website. It does not replace the patient privacy information provided by the healthcare facility where you receive a consultation or treatment.
1. Data controller and contact details
The controller is Tomasz Poboży, at ul. Wyspiańskiego 17, 06-400 Ciechanów, Poland. For personal data enquiries and requests to exercise your rights, contact pobozytomasz@gmail.com or write to the address above.
The address above is the registered business and correspondence address; patients are not seen at this address. Current consultation locations are listed on the contact and consultation locations page (in Polish).
2. What we process and why
| Activity | Data and purpose | Legal basis |
|---|---|---|
| Opening pages and playing materials | Data needed to deliver the page or file you request, including your IP address, the time of the request, the resource address and technical browser information. This enables delivery of the website and its functions. | Article 6(1)(b) GDPR — providing the electronic service you request. |
| Security and troubleshooting | Technical log information, including IP address, request time and type, errors and attempts at unauthorised access. This helps protect the website, detect misuse and resolve faults. | Article 6(1)(f) GDPR — our legitimate interest in a secure and functioning website. |
| Language and privacy settings | Your language selection and consent preferences. These enable the requested settings, respect your refusal and demonstrate how your consent choice was handled. | Article 6(1)(b) GDPR — providing the selected functions; Article 6(1)(c) GDPR for legal obligations concerning consent, including Article 7(1) GDPR. |
| Visitor statistics — with consent | Online identifiers and information about your device and website use, as described in the cookie policy. Google Analytics helps us assess interest in content and improve the website. These data are not used to give medical advice or make decisions about your treatment. | Article 6(1)(a) GDPR — your freely given consent. |
| Website enquiries | Information you provide in a message or conversation, particularly contact details and the subject of your enquiry. This is used to respond and handle your request. | Article 6(1)(f) GDPR — our legitimate interest in correspondence and handling enquiries; Article 6(1)(b) GDPR where you request steps before entering into a contract. |
| Complaints, legal duties and claims | Information needed to handle complaints, comply with applicable legal duties, or establish, exercise or defend legal claims. | Article 6(1)(c) GDPR — the applicable legal obligation; Article 6(1)(f) GDPR — our legitimate interest in handling complaints and protecting the controller’s rights. |
You do not need an account or have to provide your name to read articles or use the search function. However, technical data are transmitted when you connect to the server. We do not describe those data as anonymous merely because you have not provided your name.
3. Health information and healthcare providers
The public website is not a channel for submitting medical records or obtaining an individual consultation. We do not accept new public comments. Do not enter information that identifies a patient in the search box. To arrange an appointment, use the contact details of the relevant healthcare facility.
An appointment with an orthopaedic surgeon is separate from using this educational website. When you contact a facility directly or visit its booking system, you are using a separate service. The relevant provider supplies information about the controller of patient data, booking arrangements and the processing of health information.
4. Cookies, analytics, media and consent
The cookie policy lists the cookies and similar technologies we use, their providers, purposes and lifetimes. Technologies requiring consent are enabled after you make the corresponding choice in the privacy panel. Refusing optional analytics does not prevent access to articles.
Google Signals is disabled in the Google Analytics property used by pobozy.org. The use of newly collected data from this property for ads personalization is also disabled in all regions.
You can withdraw or change your consent using “Cookie settings” on the website. Withdrawal does not affect the lawfulness of processing carried out before you withdrew consent.
If a page provides an embedded YouTube player, connecting to that content provider requires enabling the relevant consent category first. The panel labels this category “External content”. Enabling the player may send device, IP address and playback information to Google. Refusing it leaves the rest of the website content available.
MP3 recordings available on this website are delivered from pobozy.org. Links to external platforms open separate services governed by their providers’ policies.
5. Who may receive data
To the extent needed for the purposes above, data may be received by hosting and infrastructure providers, email providers, technical support providers and authorised website staff. Where required by law or necessary to protect the controller’s rights, recipients may also include competent public authorities and legal advisers.
If you agree to analytics, information about your use of the website is sent to Google in connection with Google Analytics. The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Information about Google’s processing is available in Google’s privacy policy.
An external link to a booking platform, map or social network leads to a service governed by that provider’s rules. Including a link is not the same as embedding the external service on our website.
The website hosting provider is home.pl sp. z o.o., ul. Zbożowa 4, 70-653 Szczecin, Poland. We use its infrastructure to deliver the website. The provider’s data protection information is available at home.pl — GDPR information (in Polish).
We use Gmail for correspondence at pobozytomasz@gmail.com. The provider in the European Economic Area is Google Ireland Limited. Messages and sender information are processed as part of that service under Google’s privacy policy. Do not send medical records or unnecessary health information to the website enquiries address.
6. Transfers outside the European Economic Area
Using Gmail, Google Analytics and consented YouTube embeds may involve processing outside the European Economic Area, particularly in the United States. Google states that transfers within the scope of Google LLC’s certification rely on the EU–US Data Privacy Framework and the European Commission’s adequacy decision; standard contractual clauses are used for other relevant transfers. Information about these mechanisms and safeguards is available in Google’s data transfer frameworks and Google’s measurement services transfer information. You can contact the controller for information about safeguards applicable to your data. Consent to optional cookies does not replace the legal basis required for an international data transfer.
7. How long we keep data
- Information required for an individual request is processed for the time needed to fulfil it. If it is included in logs, the rules for logs also apply.
- Technical logs: in our home.pl hosting service, extended logs, including SMTP logs, are retained for up to 1 year, and mail and administrative logs for up to 6 months. These retention periods are counted backwards from the current day. After the applicable period, the provider permanently deletes the logs, with no further copies or archives retained.
- Incident records retained separately by the controller: records separated out for a particular incident are kept until the investigation is completed; if they are evidence concerning a claim, they are kept until the applicable limitation period ends or proceedings are finally concluded, where this is later.
- File and database backups: the total standard backup retention period for our home.pl service is 3 days. If the service expires because of non-payment, a separate process applies: approximately 14 days of suspension, followed by another 7 days during which data remain only in backups. This totals approximately 21 days from service expiry; once this process ends, files, databases and their backups are deleted. This process concerns files and databases and their backups; logs and Google Analytics data follow the separate retention periods described in this policy.
- Correspondence is kept until the matter is resolved, and afterwards only as long as justified by legal obligations or the establishment, exercise or defence of legal claims. The limitation period relevant to the particular matter applies.
- Google Analytics data: detailed event data retention is set to 2 months, and user data retention to 14 months. Under Google’s rules, the user data period also covers key event data. Resetting the user identifier’s retention period on new activity is enabled: each new activity moves its expiry to 14 months after that activity. Regular return visits can therefore extend identifier retention; this does not reset the retention of individual events. After the applicable period expires, Google deletes the covered data in a monthly cycle. These settings do not cover standard aggregated reports. See Google Analytics retention documentation. Browser cookie lifetimes are separate and described in the cookie policy.
- Privacy settings in your browser: consent-management cookies have a configured lifetime of 365 days from being set. Changing your choice may set them again; you can delete them earlier in your browser. Correspondence about exercising rights or a dispute concerning consent follows the rules for correspondence and claims.
8. Your rights
Subject to the conditions in the GDPR, you can request access to and a copy of your data, correction, erasure and restriction of processing. Data portability applies where processing is automated and based on consent or a contract.
You may object to processing based on legitimate interests on grounds relating to your particular situation. You may withdraw consent at any time. Not every right applies in every situation: for example, a legal obligation may require us to retain particular records.
Send requests to pobozytomasz@gmail.com. If we have reasonable doubts about your identity, we may request the information necessary to confirm it. We normally respond within one month. Any extension follows the GDPR rules and will be explained.
You may also lodge a complaint with the President of the Polish Personal Data Protection Office. Information about submitting a complaint is available on the UODO website. The GDPR also allows you to complain to the competent supervisory authority, particularly in the member state of your habitual residence, workplace or the alleged infringement.
9. Whether you have to provide data and automated decisions
Providing information in correspondence is voluntary, but without the details needed to respond we may be unable to resolve the matter. Basic technical information must be transmitted to connect and deliver the website. Consent to optional analytics is voluntary.
In connection with your use of this website, we do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you.
10. Policy updates
We update this policy when the website or our processing changes. The version date appears at the top. Where a change requires new consent, publishing an updated policy does not replace obtaining that consent.
Website: Tomasz Poboży - orthopaedic surgeon.