GDPR and data protection

Clinics keep data about their patients and their visits in Lessora Med. This page sums up how Lessora Med helps Clinics meet the General Data Protection Regulation (GDPR). The binding documents are our Data Processing Agreement and Privacy Policy.

Who is responsible for what

• Your Clinic is the controller of the data it keeps in Lessora Med: patients, visits, the waiting list, payments, packages, invoices, consents, messages, and its practitioners' shifts and settlements. It decides what to record and why, and informs its patients with its own information clause.
• Lessora Med is the processor. We process that data only to run the service for the Clinic, under a Data Processing Agreement (Art. 28 GDPR) that every owner accepts when creating a Clinic.
• For each person's Lessora Med account and professional profile, and for our own website, sign-up, billing and support, we are the controller, as described in the Privacy Policy.

Health data

Lessora Med doesn't keep medical records, but an appointment alone ("this person, 14:00, gynaecology") is data concerning health, a special category under Art. 9 GDPR. Lessora Med treats all patient data that way. Notes in Lessora Med are administrative only: diagnoses, test results and treatment belong in the Clinic's medical records system, not here. Medical confidentiality, patients' rights and medical records remain the Clinic's duties.

Where the data is

Lessora Med runs on servers in the European Union. The companies that help us run it are listed in the Data Processing Agreement, with what they do and where. We tell Clinics at least 30 days before adding a new one.

How the data is protected

• Encrypted connections (HTTPS with HSTS) and encrypted daily backups, kept for 30 days.
• The most sensitive fields (PESEL, identity document number, date of birth, notes, invoice details) are encrypted again in the database with a separate key.
• Each Clinic's data is separated; one Clinic can never see another's, even when a practitioner works for both.
• Roles and permissions inside each Clinic: owner, manager, reception and practitioner each see what their work needs.
• Two-factor authentication or a passkey, required for the Clinic's owner and managers and available to everyone else, and automatic sign-out after inactivity, for shared reception computers.
• Links sent to patients (visit, payment, freed time) are long and random and open only that visit, payment or offer. Messages don't name the service unless the Clinic chooses to.
• A patient access log: every opening of a patient's record and every export, with who, when and from where, kept for 5 years.
• An audit log of changes to roles, settings, money, invoices and settlements, kept for 730 days.
• Our support staff can sign in to a Clinic only with a stated reason. Every such access shows in the Clinic's audit log.
• No patient data in our logs, error reports or analytics.

Consents and messages

For each patient, the Clinic records that the information clause was given and the consents for text message reminders, email reminders and marketing, with where each came from, when and who recorded it. Reminders and marketing go only to patients who have consented. Booking confirmations and notices that a visit was moved or cancelled are part of the service the patient asked for.

Tools for data subject rights

Clinics can answer requests from their patients directly in Lessora Med:

• Access and portability: export everything about one patient (their details, visits, payments, consents and who opened their record), or the whole Clinic, as a ZIP file. Download links are valid for 7 days.
• Rectification: edit patient details at any time.
• Erasure: erase a patient. Upcoming visits are moved or cancelled first; then who they are and how to reach them is removed at once, including notes; their visits and payments stay as anonymous history, and issued invoices stay with a company buyer's details but without a private buyer's. The Clinic keeps the accounting copies of its invoices that tax law requires.
• Staff can download their own data from their profile.

How long data is kept

• While the Clinic uses Lessora Med, data stays until the Clinic changes or erases it. The Clinic decides how long it keeps patient data, within its own legal duties (for example keeping invoices as tax law requires).
• The patient access log is kept for 5 years. Messages from an online booking platform are deleted after 30 days.
• Uploaded import files are deleted after 30 days. Files sent to our support for a data migration are deleted once the import is done, at the latest 30 days after they were sent.
• When a Clinic is deleted, it can be restored for 30 days, then everything is permanently deleted, including from backups within 30 days.
• If a Clinic stops paying, it becomes read-only, and its data is deleted 90 days later. The owner is reminded by email beforehand and can export the data until then.

Data breaches

If a personal data breach affects a Clinic's data, we tell the Clinic without undue delay, and where possible within 48 hours, so it can meet its own 72-hour duty to notify the authority.

Questions

Email [email protected]. Lessora sp. z o.o., ul. Stanisławowska 47, 54-611 Wrocław, Poland.