DentalX Back to home

Poland Annex

ANX-PL · Draft of October 6, 2026 · revision 1 · version 1.0

Final draft for counsel's review. It is not in effect, and no clinic has accepted it. Items still to be confirmed are highlighted in the text.

This is the controlling text.

SHA-256 of this text: 6e52de117fe2d4e29905b30e4caecc6046a41774a6a73d1bcec5697f45463458

Poland — ANX-PL: Poland Annex

Document ID: ANX-PL · Version: 1.0 · Effective date: [[TO CONFIRM: publication date]] Language: English, with a Polish courtesy copy [[TO CONFIRM: Polish translation]]. English controls. Applies to: Clinics established in Poland, together with the MDPA and the EEA Transfer Module (TM-EEA). Terms defined in the MDPA have the same meaning here.

1. Retention of medical documentation

1.1 The Clinic's duty. Under Article 29 of the Act on Patient Rights and the Patient Ombudsman, the Clinic keeps medical documentation for 20 years from the end of the calendar year of the last entry. The main exceptions are:

  • X-ray images kept outside the documentation: 10 years; and
  • documentation of children under 2: 22 years.

1.2 DentalX's defaults. DentalX applies these periods as retention defaults for Polish Clinics, and does not auto-delete clinical records.

1.3 At the end of the service. At the end of the service, the export allows the Clinic to keep the records (MDPA clause 14).

2. Electronic medical documentation

  • The Clinic's duty. The Clinic is responsible for keeping its medical documentation in the form required by the Minister of Health's regulation on medical documentation, including electronic medical documentation (EDM) where that applies.
  • DentalX's status. DentalX does not report EDM events to the P1 platform. It is not presented as the Clinic's EDM system for the purposes of that regulation.

3. Prescriptions

Prescriptions are switched off. Prescriptions in Poland are issued as e-prescriptions through the P1 platform. DentalX does not connect to P1, so its prescription feature is switched off for Polish Clinics. Where the Clinic records a medicine in the chart, it is a clinical note, not a prescription.

4. Security breaches

VstreamX's notice within 24 hours (MDPA clause 9) allows the Clinic to notify the President of the Personal Data Protection Office (UODO) within 72 hours.

5. Medical secrecy

VstreamX and its personnel are bound by an obligation of secrecy equivalent to the medical secrecy that binds the Clinic's professionals (MDPA clause 5.3). VstreamX's Sub-processors are bound by the confidentiality obligations in their data processing terms, as MDPA Schedule 3 records, and the Clinic Data is protected in their hands by the encryption in MDPA Schedule 2. VstreamX does not represent that they are bound by medical secrecy. [[TO CONFIRM: Polish counsel's view that this suffices]]

Items to confirm before publication (Poland)

  1. Publication date.
  2. The Polish courtesy translation.
  3. Polish counsel's view on the Sub-processors' confidentiality (§5).