The Terms and Conditions of use of the Electronic Healthcare Logging Platform (ePLOZ)

This document defines the rules of using the Electronic Healthcare Logging Platform.

The Terms and Conditions of use of the Electronic Healthcare Logging Platform (ePLOZ)

• Data controller - the controller referred to in Article 4 point 7 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);
• ePLOZ - Electronic Platform for Healthcare Logging is a system used for authentication of users meeting the requirements referred to in §3 of the Regulation of the Minister of Digitalisation of 10 March 2020 on detailed organisational and technical conditions which should be met by an ICT system used for authentication of users issued pursuant to Article 20a(3)(1) of the Act of 17 February 2005 on computerisation of the activity of entities performing public tasks (Journal of Laws of 2020, item 346);
• Personal data - information about an identified or identifiable natural person ("data subject"); an identifiable natural person is a person who can be directly or indirectly identified, in particular by an identifier such as name, identification number, location data, internet identifier or one or more specific factors determining the physical, physiological, genetic, mental, economic, cultural or social identity of the natural person, which are collected as part of the Users use of the ePLOZ are also saved in cookies;
• GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);
• CeZ - Centrum e-Zdrowia - eHealth Centre with its registered office in Warsaw at 5A Stanis³awa Dubois Street;
• Authentication - a process of confirming the declared identity of an entity participating in the communication process;
• User - natural person who uses the ePLOZ;

• ePLOZ is an element of the Platform for Providing On-Line Services and Digital Resources of Medical Registers, to the extent compliant with the Act of 28 April 2011 on the Healthcare Information System (Journal of Laws of 2019, item 408, as amended).
• By using the ePLOZ, the User agrees to save in cookies the data on his use of the website. The data stored in cookies are used only for the purpose of administering the website.

• The User is obliged to use the ePLOZ in a manner compliant with applicable law, social standards and provisions of these Terms and Conditions.
• The use of ePLOZ is free of charge.
• Subject to limitations resulting from mandatory legal provisions, the CeZ shall not be responsible for damages arising in connection with the ePLOZ, its use or in connection with improper operation, errors, deficiencies, interferences, defects, delays in data transmission, computer viruses, failure of a line or IT system or failure to respect the Terms by Users.
• CeZ is not responsible for the lack of access to the ePLOZ for reasons beyond the control of CeZ.

• The ePLOZ is available at https://eploz.ezdrowie.gov.pl/ .
• Detailed information on the use and functions of the platform is available on the website referred to in point 1.
• Only the User may use ePLOZ.
• The User is obliged to acquaint himself with the provisions specified in these Terms and Conditions and to comply with them.
• An account in ePLOZ shall be created using the form available on the website referred to in point 1 after accepting the Terms of Use of ePLOZ.
• The User has the right to use the services available in ePLOZ upon account activation.
• Each User may create only one account in the ePLOZ system.
• It is forbidden to use the accounts of other Users and to share your account with others.

• The administrator of personal data processed in the ePLOZ system is the relevant minister for health issues.
• Contact details of the Data Controller: Ministry of Health, Miodowa Street 15, 00-952 Warsaw, email: kancelaria@mz.gov.pl
• The contact details of the Data Protection Inspector at the Ministry of Health: iod@mz.gov.pl, electronic inbox /8tk37sxx6h/SkrytkaESP
• The data in the ePLOZ are processed for the purpose of authentication of the user accessing the resources of the platform specified in §3 section 1.
• The data in the ePLOZ will be stored for the period necessary to achieve the purpose, in particular until the expiration of claims.
• Each person whose data is processed has the right to demand from the controller the access to personal data pursuant to Article 15 of the GPDR, in particular, the right to a free of charge first copy of the data pursuant to Article 15 paragraph 3 of the GPDR.
• Every person whose data are processed has the right to immediately rectify the personal data concerning him/her which are processed by the ePLOZ.
• Each person whose data is processed has the right to delete the data, taking into account the provisions of paragraph 5. In case of a request to delete the data, the User shall lose the possibility to log in to the systems for which the ePLOZ constitutes an authentication system.
• Each person whose data is processed has the right to limit the processing in the scope compliant with Article 18 of the GDPR.
• Every person whose data is processed has the right to transfer data in the scope compliant with Article 20 of the GPDR.
• Any person whose data are processed has the right to object to the processing in accordance with Article 21 of the GPDR.
• Everyone whose data are processed has the right to lodge a complaint with the supervisory authority.

• These Terms and Conditions apply from the date of publication.
• The Terms and Conditions are available free of charge for downloading, recording and printing.
• In matters not covered by these Terms and Conditions, the provisions of applicable law shall apply, including in particular the provisions of the Civil Code and the provisions on copyright and related rights.
• These Terms and Conditions may be amended at any time and to any extent. Changes are effective from the moment of their publication.
• In the event of a change in the content of these Terms and Conditions, the User will be informed of this fact during authentication.

Security recommendations for the ePLOZ system:

The National Centre for Healthcare Information Systems uses advanced technical and organisational solutions to ensure a high level of ePLOZ security.

However, each user of the system is obliged to take care of the safety of the device, through which he or she uses the ePLOZ.

The following recommendations should be followed for this purpose:

• Please check before logging in to your account:
  • whether the address on the login page starts with the prefix https, which stands for protocol, responsible for connection security,
  • whether there is information in your browser that indicates that the connection is encrypted or whether there is a padlock symbol within the browser window to ensure that the session is SSL encrypted for secure communication; depending on the browser, the padlock may appear in the address bar or in the status bar at the bottom of the screen,
  • always check the validity and correctness of the login page certificate.
• Working in the ePLOZ system:
  • It is not allowed to log in to the ePLOZ from the address of a website sent by another user via electronic means (e.g. in e-mail, instant messenger or social networking sites),
  • do not log in to ePLOZ from a computer where another user is already logged in,
  • after logging in to the ePLOZ, do not leave the computer unattended, especially block access to it,
  • pay attention to the messages appearing in the browser window and do not underestimate the threats sent by computer security systems,
  • after finishing the work, log out of the ePLOZ,
  • the ePLOZ should not be used in public places, e.g. by using internet cafés or logging in via publicly accessible unsecured internet networks.
• User computer security:
  • the computer used to log in to ePLOZ should be equipped with an antivirus program with the current virus database and the firewall on.
  • updates and corrections to the operating system, the web browser, Flash plug-in, PDF browser, etc. of the software should be installed as soon as they are available from the producers.

Attention:

All events, including attempts to log into ePLOZ, both successful and unsuccessful, are recorded.

All actions performed after logging into ePLOZ are registered.

The National Centre of Healthcare Information Systems does not take responsibility for the users environment from which the connection to the ePLOZ takes place, in particular for unauthorised access and actions resulting from malicious computer software or failure to secure it by the ePLOZ user.

Legal basis:

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

the Act of 28 April 2011 on the Healthcare Information System (Journal of Laws of 2019, item 408, as amended).

Act of 17 February 2005 on computerisation of the activities of entities performing public tasks (Journal of Laws of 2019, item 700, as amended).

Dear user!

Since 25 May 2018, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (referred to as GDPR) has been in force.

At https://eploz.ezdrowie.gov.pl/ Electronic Healthcare Logging Platform hereinafter referred to as EPLOZ has been made available.

ePLOZ is an element of the Platform for Providing On-Line Services and Digital Resources of Medical Registers, to the extent consistent with the Act of 28 April 2011 on the Healthcare Information System (Journal of Laws of 2019, item 408, as amended) and is used to authenticate the users of the aforementioned platform.

The controller of personal data in the system is the Minister of Health, with the registered office in Warsaw, ul. Miodowa 15, 00-952 Warsaw. Contact details of the Data Administrator: iod@mz.gov.pl.

The system administrator, i.e. the entity responsible for technical and organisational maintenance of the system, is the Centre of Health Information Systems with its registered office in Warsaw, ul. Stanis³awa Dubois 5A, 00-184 Warszawa (hereinafter referred to as the "Centre"), an ePUAP box: /csiozgovpl/SkrytkaESP.

In case of technical problems, call: 19 457 or e-mail: logowanie@cez.gov.pl.

Assistance is provided on working days, from 9:00 to 15:00.

Collection and processing of data

In ePLOZ we process your personal data necessary to provide the service provided by means of ePLOZ.

In the ePLOZ we collect the following data: first name, surname, login, PESEL and in case of lack of it the number of the document confirming its identity, e-mail address, in order to create an account in the ePLOZ according to your applications.

The legal basis for the processing of the above mentioned data is Article 6(1)(c) and (e) of the GDPR, i.e. the processing is necessary to fulfil the legal obligation imposed on the controller and the processing is necessary to perform a task carried out in the public interest or in the exercise of public authority entrusted to the controller.

The data shall be processed and archived for the period necessary for the purpose of processing, provision of ePLOZ services and until the expiration of claims.

Your rights

Every person whose data are processed has the right to demand from the controller the access to personal data pursuant to Article 15 of the GPDR, and in particular the right to a free of charge first copy of data pursuant to Article 15 paragraph 3 of the GPDR.

Every person whose data are processed has the right to immediately rectify the personal data concerning him/her which are processed by the ePLOZ.

Every person whose data is processed has the right to delete the data. In the case of a request to delete the data, the User will lose the possibility to log in to the systems for which the ePLOZ constitutes an authentication system.

Each person whose data is processed has the right to limit the processing in the scope compliant with Article 18 of the GPDR.

Every person whose data is processed has the right to transfer data in the scope compliant with Article 20 of the GPDR.

Everyone whose data are processed has the right to object to the processing in accordance with Article 21 of the GPDR.

Any person whose data are processed has the right to submit a complaint to the supervisory authority.

In order to exercise the rights indicated above, please contact us by electronic or traditional means.

Legal basis

The legal basis for the processing of the above mentioned data is Article 6 paragraph 1 point c and e of the GPDR , i.e. the processing is necessary for the fulfilment of the legal obligation imposed on the controller and the processing is necessary for the performance of a task carried out in the public interest or in the exercise of public authority entrusted to the controller.

The Act of 28 April 2011 on the Healthcare Information System (Journal of Laws of 2019, item 408 as amended )