Klauzula informacyjna dla Ubezpieczonych

Privacy notice for Insured Persons

Information duty of Towarzystwo Ubezpieczeń ZDROWIE S.A. in accordance with the Regulation of the European Parliament and of the Council (EU) 2016/679 of April 27, 201s6 on the protection of individuals with regard to the processing of personal data and on the free flow of such data and repealing Directive 95/46/EC (referred to as the GDPR).

Data controller	The data controller is Towarzystwo Ubezpieczeń ZDROWIE S.A. with its registered office in Gdynia, ul. Śląska 17 (hereinafter: TU ZDROWIE S.A.).
Contact information	You can contact TU Zdrowie S.A.: • at email address: biuro@tuzdrowie.pl, • by contact form at www.tuzdrowie.pl, • by phone at 58 888 2 999 or in writing to TU Zdrowie SA’s registered office address.
Data Protection Officer:	TU Zdrowie S.A. has appointed a Data Protection Officer (DPO). You can contact the DPO: • at the email address iod@tuzdrowie.pl, • in writing to the address of the administrator’s headquarters. You can contact the DPO on all matters concerning the processing of personal data and the exercise of rights related to data processing.
Purposes of processing and legal basis for processing/strong>	Your data may be processed for: 1) actions aimed at the conclusion, conclusion and performance of an insurance contract, if the Insured is a party to an insurance contract, the Insured’s personal data are processed for the purpose of concluding the insurance contract and for the purpose of its performance; the legal basis for data processing is taking actions aimed at concluding and executing the insurance contract and legal obligations which are imposed on TU Zdrowie by the provisions of the Insurance and Reinsurance Business Act and the provisions of the Civil Code, in relation to data on health – the consent expressed by the Insured, if the contract is concluded in favor of the Insured by the employer, the Insured’s personal data are processed for the purpose of realization of insurance benefits under the group insurance contract; the legal basis for the processing of the Insured’s data is the data processing necessary for the performance of legal obligations arising from the provisions of the Insurance and Reinsurance Business Act, and the provisions of the Civil Code, and the legitimate interest of the controller, where the legitimate interest is the performance of the contract between the Parties and the delivery of benefits covered by the contract in favor of third parties, and with regard to health data – the consent expressed by the Insured; 2) direct marketing of TU Zdrowie’s own products and services, including for analytical and profiling purposes – the legal basis is the Insured’s voluntary consent to the processing of the Insured’s data for the above purposes, 3) direct marketing of products and services of entities cooperating with TU Zdrowie within Neuca Group, i.e. Neuca Med. Sp. z o.o., Neuca S.A., Pratia S.A. – the legal basis is the Insured’s voluntary consent to the processing of the Insured’s data for said purpose; 4) issuing decisions based solely on automated processing of the Insured’s personal data – if the Insured voluntarily consents to this purpose of processing; 5) TU Zdrowie’s fulfillment of its obligations related to anti-money laundering and financing of terrorism – the legal basis for data processing is the necessity to fulfill the controller’s legal obligation arising from anti-money laundering and financing of terrorism regulations; 6) handling of a reported complaint or claim – on the basis of the provisions on the handling of complaints by financial market entities, the Financial Ombudsman and the Financial Education Fund, as well as on the basis of legitimate interests pursued by TU Zdrowie in order to handle reported complaints or claims; 7) possibly for the purpose of pursuing claims related to the concluded insurance contract – the legal basis for data processing is the processing necessary for the meeting of TU Zdrowie’s legitimate interest; TU Zdrowie’s legitimate interest is the possibility of pursuing its claims; 8) possibly for the purpose of taking actions in connection with the prevention of crimes – the legal basis of data processing is the processing necessary for the meeting of TU Zdrowie’s legitimate interest; TU Zdrowie’s legitimate interest is the possibility of preventing and prosecuting crimes committed to TU Zdrowie’s detriment; 9) reinsurance of risks – the legal basis of data processing is the processing necessary for the meeting of TU Zdrowie’s legitimate interest; TU Zdrowie’s legitimate interest is to reduce the insurance risk associated with the insurance contract concluded; 10) TU Zdrowie’s fulfillment of its FATCA reporting duties – the legal basis for data processing is the necessity to fulfill TU Zdrowie’s legal obligation under the provisions on the fulfillment of international tax duties and the implementation of FATCA legislation, and the provisions on the automatic exchange of tax information with other countries; 11) settlement of services performed for the Insured under the insurance coverage offered by TU Zdrowie and for the purpose of verifying entitlement to an insurance benefit or its amount – the legal basis for data processing is a legal obligation under applicable laws, including the provisions of the Accounting Act and the legitimate interest of the Controller.
Categories of Insured’s personal data	1) person ID data (i.e., including but not limited to first and last name, PESEL/passport number, gender/sex, date of birth, affinity, if any, with the Principal Insured, name of the entity, Tax ID [NIP], Business Registry Number [REGON]); 2) contact information (i.e., including but not limited to telephone number, email address, position), address information for institutional clients – registered office address, mailing address); 3) personal data (i.e., including but not limited to occupation, height, weight, lifestyle, and other); 4) financial data and bank account number data; 5) data on the medical services performed and the circumstances of their delivery, the health status of the Policyholder, of the Insured, persons seeking insurance coverage, other persons entitled under the insurance contract, persons contacting TU ZDROWIE.
Data source	TTU ZDROWIE receives personal data from the following entities: medical operators, medical facilities as well as from the Policyholder, the Insured, other persons entitled under the insurance contract as well as from persons contacting TU ZDROWIE. Other data controllers, cooperating entities, publicly available sources, i.e. the CEIDG and KRS registry, may be data sources, too.
OData retention period	Your personal data will be stored until the statute of limitations for claims under the health insurance contract or until the expiration of the obligation to store data under the law, in particular, the obligation to store data under the Insurance and Reinsurance Business Act, accounting documents relating to the insurance contract, the obligation to store under anti-money laundering and terrorist financing regulations, regulations on the fulfillment of international tax duties and on the implementation of FATCA legislation, and regulations on the automatic exchange of tax information with other countries. TU Zdrowie will stop processing data used for direct marketing purposes, including profiling, if the Insured withdraws the consent expressed for such data processing. TU Zdrowie will stop processing the Insured’s personal data for the purpose of making decisions based solely on automated processing if the Insured withdraws the Insured’s consent expressed for such data processing.
Data recipients	• Your personal data may be shared with medical service providers, entities providing insurance benefits to TU Zdrowie policyholders, medical hotline service providers and reinsurance companies. • Your personal data may be transferred to entities processing personal data on behalf of TU Zdrowie, including, but not limited to, IT service providers, entities processing data for debt collection purposes, marketing agencies, or insurance agents, and Neuca S.A.; whereby such entities process data on the basis of an agreement with TU ZDROWIE and only in accordance with TU ZDROWIE’s instructions. • Your personal data are made available to the Policyholders in order to ensure due insurance coverage/settlement of premium due, as well as to entities providing advisory services, entities conducting payment, postal or courier services, and other entities entitled to receive them on the basis of a provision of law (i.e., e.g., Social Security Institution (ZUS), Tax Office, court, Police, PFSA (KNF), OCCP (UOKiK), Financial Ombudsman), to the extent necessary, with the exception of data on your health condition and delivered medical services performed. • Your personal data will not be transferred to recipients located in countries outside the European Economic Area.
Rights of data subjects	• You have the right to access your personal data and the right to request rectification, erasure or restriction of their processing. • To the extent that the basis for the processing of the Insured’s personal data is consent, you have the right to withdraw your consent. Withdrawal of consent does not affect the legality of the processing performed on the basis of consent before its withdrawal. • To the extent that the Insured’s personal data is processed for the purpose of entering into and executing an insurance contract or processed on the basis of consent, you also have the right to portability of personal data, that is, to receive personal data from TU Zdrowie in a structured, commonly used machine-readable format. The Insured may send this data to another data controller. • You also have the right to lodge a complaint with the data protection supervisory authority. In order to exercise the above rights, please contact TU Zdrowie SA or the Data Protection Officer. Contact details are indicated above.
InInformation on automated decision-making, including profiling	Automated processing of personal data for profiling purposes may be applied in connection with the processing of your personal data; it may involve the automated analysis of the information provided in order to determine the relevant elements of the insurance contract, such as the insurance premium. The algorithms carrying out the analysis referred to above may not lead to any form of discrimination and are intended solely to adapt the insurance contract to the information analyzed, in order to provide analogous terms and conditions of the insurance contract, for persons in analogous situations. In order to ensure the most efficient operation, TU ZDROWIE may use decision-making based solely on automated processing of personal data to arrange insurance benefits. In such situations, TU Zdrowie provides the opportunity to obtain human intervention, to express one’s own position, as well as the opportunity to challenge the position in a complaint procedure, the same as in the case of non-automated decision-making.
Information on data requirement:	The provision of personal data due to the conclusion of an insurance contract is necessary for the conclusion and performance of the contract, for the delivery of insurance benefits under the contract and for the assessment of insurance risks. If personal data are not provided, it is not possible to conclude and execute an insurance contract. Providing data for marketing purposes is voluntary.

PRIVACY NOTICE FOR INSURED PERSONS

Privacy Notice for Insured Persons