§ 1. General provisions

1. Pursuant to Article 13(1−2) and Article 14(1-2) of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: “GDPR”), we wish to inform you about the method and objective of processing your personal data, as well as about your rights under GDPR.

§ 2. Data Administrator and Data Processor

1. Regenmed Spółka z ograniczoną odpowiedzialnością Sp. k. with its seat at the address: ul. Grzegórzecka 67C/U13, 31-559 Krakow (hereinafter: “Regenmed”) shall act as your personal data Administrator, as provided for the purpose of conducting the experimental treatment. Regenmed spółka z ograniczoną odpowiedzialnością Sp. k. has appointed Information Security Administrator, as well as (starting from 25 May 2018) Data protection Inspector, Ms. Jagoda Półtorak, who, according to the provisions of GDPR, shall be in charge of supervising that the principles of data protection are followed in the entity in charge. For the purpose of contacting the Inspector, Regenmed provides the following e-mail address: inspektor@regenmed.pl

§ 3. The need to provide personal data

1. Data is provided on voluntary basis, yet this might be necessary for the performance of the agreement.

§ 4. Scope of personal data, including special category data

1. Pursuant to Article 25(1) of the act of 6 November 2008 on patient rights and Patient Rights Ombudsman to maintain medical documentation, it is necessary to provide at least such data as: a. surname and first name(s), b. date of birth, c. sex, d. residential address, e. PESEL number, is allocated; in the case of newborns – mother’s PESEL number, in the case of persons without allocated PESEL number – type and number of identification document, f. in the event where the patient is under age, completely incapacitated, or incapable of providing informed consent: full name of the legal representative and his/her residential address. g. specification of the patient’s health or healthcare services provided. Failure or refusal to provide personal data shall prevent qualification for treatment and conduction of a treatment by Regenmed Spółka z ograniczoną odpowiedzialnością Sp. k.

§ 5. Objective behind processing your personal data and legal grounds for data processing

1. We process your personal data according to the provisions of GDPR and the Polish act on personal data protection. Personal data processing shall occur:

a) in order to fulfil contractual commitments (Article 6(1)(b) of GDPR) and provision of medical services (Article 9(2)(h) of GDPR). The data are processed for the purpose of conducting Regenmed’s business under agreements concluded with Patients or for the purpose of taking measures before conclusion of agreements, according to the Patient’s wish. Data processing is necessary for qualification for Treatment, for conducting Treatment with possible hospitalization, and for performing the service according to the agreement.

b) in order to meet legal requirements (Article 6(1)(c) of GDPR) or to take measures in the public interest (Article 6(1)(e) of GDPR). As a medical entity, Regenmed is subject to a number of legal requirements, namely requirements under the act on patient rights and Patient Rights Ombudsman. • for purposes resulting from legally justified interests pursued by Regenmed or a third party (Article 6(1)(f) of GDPR). If necessary, Regenmed processes data for the purpose of legally justified interests of its own or third parties. Examples here include:

c) assuring IT security,

d) pursuing claims and defence against claims,

§ 6. Recipients of Personal Data

1. Your personal data shall not be made available to unauthorised persons. Personal data can be made available to other recipients for the purpose of performing the agreement with you, for the purpose of executing Regenmed’s legal requirements, pursuant to your consent, or for purposes related to legally justified interests of the administrator or a third party. Recipients can include in particular: authorised employees, business information offices, companies rendering accountancy and IT services, translation agencies, payment institutions, legal office rendering services for Regenmed. Furthermore, the data can be provided exclusively to entities processing personal data on request of Regenmed and its authorised employees, whereas such entities process data pursuant to an agreement and exclusively according to Regenmed’s instructions, and on condition of assuring data confidentiality. Pursuant to Article 26 of the act of 6 November 2008 on patient rights and Patient Rights Ombudsman, the entity providing healthcare services shall make medical documentation available to the patient or his/her legal representative, or a person authorised by the patient. Medical documentation can also be made available to entities providing healthcare services if such documentation is necessary to assure continuity of healthcare services, as well as in cases explicitly envisaged in currently applicable legislation.

§ 7. Period of personal data storage

1. Personal data shall be processed for the period necessary to achieve data processing objectives stipulated in section 2, namely:

a) as regards the agreement concluded with Regenmed – until the end of its term, and afterwards for the period required under the law or to pursue claims, if any;

b) as regards meeting legal commitments of Regenmed related to its business, performance of concluded agreements, and provision of medical services – until Regenmed has fulfilled such duties;

c) until the achievement of justified interests of Regenmed forming grounds for such processing, or until your objection against such processing, provided there are no legally justified grounds for further data processing.

§ 8. Your rights related to personal data processing

1. You have the right to:

a) demand access to your personal data and to correct them, to limit personal data processing, or to their removal,

b) object at any time against personal data processing for reasons related to your special situation if Regenmed processes data for purposes resulting from legally justified interests (Article 21(1)of GDPR),

c) Request transfer of personal data; the transfer shall involve reception of your personal data from Regenmed in a structured, generally used format fit for machine reading, and transfer of such data to another data administrator. The right to transfer data shall not refer to the data constituting company secrets,

d) appeal to the supervisory authority, namely to the President of the Personal Data Protection Office, if you decide that the processing of your personal data is in breach of GDPR.

§ 9. Source of your personal data

1. Personal data collected by Regenmed are principally provided directly by the Patients.