INEM · LEGAL INFORMATION
Privacy policy (GDPR).
This policy explains the handling of personal data on the INEM website operated by David Dörmann (sole proprietor) in Bochum. Case-specific information is also provided during the enquiry process.
1. Data controller
David Dörmann, Amtmann-Ibing-Str. 10, 44805 Bochum, Germany. Contact: ddoermann@ekspertyzymedyczne.pl. INEM is the brand used for the Polish market.
2. Privacy contact
For data protection matters, contact ddoermann@ekspertyzymedyczne.pl with the subject ‘Data protection / Datenschutz’. Data protection officer (GDPR Article 37): David Dörmann, Institut für Datenschutz im Gesundheitswesen, Amtmann-Ibing-Str. 10, 44805 Bochum, Germany; daviddoermann@datenschutz-gesund.de; datenschutz-gesund.de.
3. Purposes and legal bases
Enquiry handling and steps towards a contract, and service performance: GDPR Article 6(1)(b). Legal and accounting duties: Article 6(1)(c). Establishing or defending claims: Article 6(1)(f). Where the form requests consent to handle the enquiry or application, Article 6(1)(a) applies at that stage. Necessary contractual processing is separately based on Article 6(1)(b). Health data: Article 9(2)(a) GDPR (explicit consent), Article 9(2)(h) (medical assessment by persons bound by professional secrecy) and, in court and compensation matters, Article 9(2)(f) (establishing, exercising or defending legal claims). Public forms do not collect medical records.
4. Providing information
Providing data is voluntary. Without information marked as required, we cannot assess the enquiry or application. The service requires the information necessary for its agreed scope.
5. Recipients
Data may be shared with physicians involved in the opinion, subject to confidentiality and, where necessary, processing agreements, and relevant IT, hosting, email, document-transfer and accounting providers. We do not sell personal data or use submitted information for marketing.
6. Security and document transfer
Website forms are not for medical records or health information. Do not send medical records as ordinary email attachments. Documents must be transferred exclusively through the separate protected INEM Cloud channel, not by email. We provide access instructions after scope and fee agreement. Website transmission uses TLS; access is restricted to those who need it for the case. Professional secrecy and confidentiality obligations apply.
7. Email
Ordinary email is used for organisational correspondence. It is not the channel for sending medical records. We explain the next steps and document-transfer arrangements separately.
8. Automated decisions
We do not use profiling or solely automated decision-making that produces legal or similarly significant effects on individuals.
9. Retention
Enquiry data is kept while the enquiry and related contact are being handled. If no contract is concluded, further retention requires a separate basis, such as necessary defence of claims. Contract and accounting records follow the applicable statutory retention periods, measured from the event specified by law. Medical records are retained according to the purpose, the responsible party’s applicable duties and any necessary claims period; medical-provider retention duties do not automatically apply to the coordinator. When the relevant purpose and duties end, data is deleted or anonymised.
10. Your rights
Subject to the applicable conditions, you may request access and a copy, correction, deletion, restriction and portability, and object to processing. You may withdraw consent without affecting earlier lawful processing. You may complain to a supervisory authority, including LDI NRW in Germany or the authority in your country of habitual residence, such as UODO in Poland.
11. Cookies and analytics
The site does not use tracking cookies or third-party analytics tools. Technical mechanisms necessary for site operation are used.
12. Transfers outside the EEA
The operator confirms that the website and INEM Cloud are hosted in Europe. Europe is not identical to the EU or EEA; hosting location alone does not exclude access or processing from other countries. The actual hosting countries, providers and any remote access must be assessed separately. Where a transfer outside the EEA takes place, the recipient country, transfer basis and applicable safeguards must be explained before that transfer.
13. Physician applications
The form collects contact details, specialty, country and authority of registration, licence number, experience, languages, availability, fee preferences and optional video experience. It is used to assess cooperation and contact you, based on voluntary consent under Article 6(1)(a). Applications are available to recruitment staff and relevant IT providers, do not create a public profile and are not decided automatically. Do not include patient information, health data or identity scans. Application data is kept for assessment and related contact until the process ends or consent is withdrawn, unless a separate legal basis requires retention. Further cooperation requires separate arrangements. Exercise your rights or withdraw consent via ddoermann@ekspertyzymedyczne.pl.
14. Data collected in enquiry and contact forms
Name or organisation name, email address, optional phone number, role, type of service and case, organisational details (such as language and volume of records, preferred report language) and your notes. Please do not enter detailed health information in the notes — a general description is sufficient. We store the consent text, its date and the form language version to demonstrate consent (Article 7(1) GDPR).
15. Data about third parties (Article 14 GDPR)
Where a representative, law firm, insurer or other organisation submits a case, we receive the data of the person concerned from that organisation, which is responsible for having a legal basis to share it. We inform the person concerned under Article 14 GDPR unless an exemption under Article 14(5) applies (for example professional secrecy).
16. Technical data and browser storage
When pages are displayed, the hosting provider processes technical data needed to deliver and secure the site (such as IP address, date and time, page address, browser type), based on our legitimate interest in secure operation (Article 6(1)(f)). Closing the privacy notice stores only a marker in browser storage (localStorage) that the notice was shown — no personal data, no tracking. This is necessary for the site to work and does not require consent.
17. Updates
This policy may be updated. The current version is available at this address.