Privacy Policy
Version 2, published November 3, 2026
This Privacy Policy explains how Lessora sp. z o.o., ul. Stanisławowska 47, 54-611 Wrocław, Poland ("we", "us"), handles personal data when you visit https://lessoramed.com, contact us, or use Lessora Med as a clinic owner, manager, member of reception staff or practitioner.
1. Two roles: controller and processor
- We are the controller for data about visitors to our website, people who contact us, every person's Lessora Med account (sign-in data and professional profile, which the person keeps across the clinics they work for), and the owners and staff of Clinics as our customers (billing, support).
- Clinics are the controllers for the data they keep in Lessora Med about their patients (including data concerning health, such as which services and practitioners they visit), visits, waiting lists, payments, packages, invoices, consents and messages, about their practitioners' shifts and settlements, and about the memberships of their staff. This includes data patients enter on the pages a clinic sends them, data a clinic receives from an online booking platform it connects, and files a Clinic sends us to import its data. We process that data on their behalf under our Data Processing Agreement. If you are a clinic's patient, for example you received a reminder or a payment link from a clinic, please contact that clinic about your data. We will pass on requests we receive to the Clinic.
2. Contact for data protection
Email [email protected], or write to Lessora sp. z o.o., ul. Stanisławowska 47, 54-611 Wrocław, Poland.
3. What we collect and why
| Data | Why | Legal basis (GDPR) | How long |
|---|---|---|---|
| Server and security logs: IP address, browser, pages requested, time | Run the website securely, find errors, stop abuse | Legitimate interest, Art. 6(1)(f) | A few weeks, longer only if needed for a security incident |
| Analytics through Google Analytics, only after you accept in the cookie banner | Understand how the website and the app are used | Consent, Art. 6(1)(a) | See the Cookie Policy |
| Bot protection on the sign-up form (Cloudflare Turnstile): technical data about your browser and the request | Stop automated sign-ups and spam | Legitimate interest, Art. 6(1)(f) | Not stored by us; processed by Cloudflare for the check |
| Error reports from the website and the app (Sentry, EU): technical data about the error; no names, email addresses or patient data, only internal user and Clinic IDs | Find and fix errors | Legitimate interest, Art. 6(1)(f) | Deleted automatically after the period set at Sentry |
| Contact form: name, clinic name, email, phone (optional), message, language, IP address | Answer your message | Steps before a contract / legitimate interest, Art. 6(1)(b), (f) | 24 months, then deleted |
| Sign-up: name, email, password (stored only as a hash), clinic name, tax ID (NIP), number of cabinets, accepted legal documents with time and IP | Create the Clinic and its owner's account | Contract, Art. 6(1)(b) | While the account exists, then as in section 6 |
| Your Lessora Med account: name, email, phone, photo, language, profession, licence number (PWZ) and whether we checked it against the public register, specialities, languages spoken, the clinics you belong to | Let you sign in to every clinic you work for with one account and keep your professional profile | Contract and legitimate interest, Art. 6(1)(b), (f) | While the account exists; you can delete it once you have no active memberships |
| Security of your account: two-factor and passkey settings, sign-in times, one-time links for switching clinics | Protect the account | Contract and legitimate interest, Art. 6(1)(b), (f) | While the account exists; switching links expire within minutes |
| Your week across clinics on your personal page and in your calendar feed: times when you are busy at each clinic, the clinic's name and cabinet, the number of booked visits, without patient data | Show you your own schedule and stop clashes between clinics | Contract, Art. 6(1)(b) | While the shifts and visits exist in the clinics |
| Billing: billing name and address, VAT ID, plan, text message usage, invoices (sent to KSeF where the law requires); card details are handled by Stripe, not by us | Charge for the subscription and keep accounting records | Contract and legal obligation, Art. 6(1)(b), (c) | As long as tax and accounting law requires |
| Emails about the service: welcome and tips mails, trial and payment reminders, text message allowance warnings, notices about changes to the legal documents; product news and the newsletter only if you turn them on | Run the service and tell you what you need to know | Contract and legitimate interest, Art. 6(1)(b), (f); consent for the newsletter, Art. 6(1)(a) | While the account exists, or until you unsubscribe |
| Support requests, feedback sent from the app, and our replies | Help you and improve the service | Contract and legitimate interest, Art. 6(1)(b), (f) | While the account exists, or as long as needed to resolve the request |
| Audit log of actions in the Clinic, including support access | Security and traceability for the Clinic | Legitimate interest, Art. 6(1)(f) | 730 days |
We don't sell personal data, we don't use it for advertising profiles, and we don't make decisions about you based solely on automated processing. We never use patient data for our own purposes.
4. Who receives the data
We use service providers who process data for us under contracts that meet the GDPR. The current sub-processors, what they do and where:
| Company | What for | Where |
|---|---|---|
| Webdock | Servers, database and backups | European Union |
| Hetzner Online GmbH | Encrypted off-site copy of the backups | European Union |
| Cloudflare | DNS, encryption in transit and protection from attacks | Worldwide network |
| Stripe | Subscriptions and online payments | European Union and United States |
| ImprovMX | Sending email | European Union and United States |
| LINK Mobility Poland (SMSAPI) | Sending text messages to clinics' patients | European Union |
| Sentry | Error reports from the web app | European Union |
Google receives analytics data about the website and the app only if you consent; from the app it gets only which kind of page was opened, never names, clinic addresses, record numbers or patient data. Stripe processes payment data as described in its own privacy policy for payments it handles as a controller. A clinic you work for sees your name, contact details and professional profile while you are its member. We disclose data to authorities only where the law requires it. Our invoices to Clinics, and invoices a Clinic sends to KSeF, go to the Polish tax administration.
5. Transfers outside the EU
We host Lessora Med in the European Union. Some providers (for example Stripe, Google and Cloudflare) may process data outside the EEA. Where they do, the transfer is covered by an adequacy decision (such as the EU-US Data Privacy Framework) or by the European Commission's Standard Contractual Clauses.
6. How long we keep data
Besides the periods in section 3: when a Clinic is deleted, it can be restored for 30 days and is then permanently deleted. Your Lessora Med account stays until you delete it, because you may work for other clinics. Copies may stay in encrypted backups for up to 30 days. We keep billing records for as long as tax law requires.
7. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict or object to processing, and to data portability. Where processing is based on consent, you can withdraw it at any time (for analytics: "Cookie settings" at the bottom of every page of the website, or in the user menu of the app; for emails: the link in each email or your notification settings). You can correct your profile and download your own data in the app yourself.
To use your rights, email [email protected]. We answer within one month.
You also have the right to complain to a data protection authority, in particular in the EU country where you live or work. Our lead authority is Prezes Urzędu Ochrony Danych Osobowych (UODO) (https://uodo.gov.pl).
8. Security
We protect data with encryption in transit (HTTPS with HSTS), encrypted backups, extra encryption of the most sensitive patient fields, strict separation between Clinics, two-factor authentication (required for each Clinic's owner and managers, available to everyone else), sign-out after inactivity, access only for our staff who need it (with every support access recorded), and regular updates. See GDPR and data protection for more.
9. Changes
We update this policy when our processing changes. The date and version are shown at the top. For material changes, we tell owners by email or in the app.