Privacy policy

Effective from 10 November 2026 · KOYI MED websites

1. Data controller

The controller is KOYI MED sp. z o.o., ul. Wspólna 70, 00-687 Warsaw, Poland. For questions or requests concerning your personal data, contact info@koyimed.pl or our registered office. We have not appointed a data protection officer.

2. Contact and cooperation

We process information you provide: your email address, enquiry subject and message, company or organisation name, signature and any other information voluntarily included in correspondence. We use this information to respond, send an automatic acknowledgement and manage professional or business correspondence. The form is not for medical consultations. Please do not send patient data or health information.

The basis is Article 6(1)(f) GDPR — our legitimate interest in responding to enquiries and maintaining business contacts. If you are an individual enquiring on your own behalf about entering into a contract, pre-contractual activities are based on Article 6(1)(b). Processing necessary for legal obligations is based on Article 6(1)(c), and establishing, exercising or defending legal claims on Article 6(1)(f).

Providing data is voluntary. Your email address, subject and message are needed to handle an enquiry. The company or organisation name is optional. Submitting an enquiry does not subscribe you to a newsletter or advertising list.

3. Retention

Enquiries that do not lead to cooperation are kept for 12 months after correspondence ends. If we enter into a contract, information needed for its performance is kept for the contract term; records subject to statutory retention obligations are kept for the relevant periods. In a dispute, we retain the necessary data until the matter is resolved and the applicable limitation period expires.

4. Website operation and security

Our infrastructure processes connection data, including IP address, request time, requested URL and browser information, to deliver the website, diagnose errors and prevent abuse, based on Article 6(1)(f) GDPR. Zenbox access and error logs are retained for up to 30 days; hosting backups for up to 7 days. Data related to an incident may be retained until it is resolved and any related claims are concluded.

The contact form uses a technical session and submission limits. For abuse prevention, it records a pseudonymous IP identifier and submission attempt times. Attempts are counted within a 15-minute window; older entries are deleted on the next submission. We do not create a website database of messages: enquiries are passed to email. Content may remain in mail queues until delivery or the end of delivery attempts. The professional-area declaration applies only to the current page view and does not create an account or a persistent browser record.

5. Recipients

Data is available to authorised KOYI MED personnel and service providers to the extent necessary: Zenbox (cyber_Folks S.A.) for hosting and technical handling of the form, and Google Workspace for business email, including automatic acknowledgements. Legal advisers may receive data in connection with a specific matter, and public authorities where required by law. We do not sell personal data.

6. Transfers outside the EEA

Google email services may involve processing outside the European Economic Area, including in the United States, by Google and its subprocessors. Safeguards under Google's processing terms include adequacy decisions where applicable or European Commission standard contractual clauses. Contact us for information about safeguards and how to obtain a copy. Google data processing terms.

7. Cookies, analytics and external services

We do not currently use Google Analytics, advertising or remarketing tools and do not operate a newsletter. Before introducing analytics, we will update this information and obtain the required separate consent before activation. See our cookie policy.

The Google Maps link opens an external service only when selected. No map is embedded. Google's privacy terms apply after you follow the link. Google Search Console domain verification supports search visibility management and does not require visitor tracking code on the website.

8. Your rights

Subject to the conditions in the GDPR, you may request access and a copy, rectification, erasure or restriction of processing. You may object to processing based on legitimate interests on grounds relating to your particular situation. Portability applies to automated processing based on consent or contract where the GDPR provides for it. Where processing relies on consent, it may be withdrawn at any time without affecting earlier lawful processing.

Send requests to info@koyimed.pl. We may ask for information necessary to verify your identity. You may also lodge a complaint with the President of the Polish Personal Data Protection Office: uodo.gov.pl. We do not make decisions producing legal or similarly significant effects solely by automated means, including profiling, in connection with the website or enquiries.