Last updated: 26.10.2026.

1. Who is the data controller

The controller of personal data collected through the oxy.hr website is:

Poliklinika za baromedicinu i medicinu rada OXY (Polyclinic for Baromedicine and Occupational Medicine OXY)
Santoriova ulica 24a, 52100 Pula, Croatia
OIB (personal identification number): 23649735403
E-mail: poliklinika@oxy.hr
Phone: +385 52 215 663

For any questions about the protection of personal data, please contact us at poliklinika@oxy.hr or by post at the Polyclinic’s address, marked “Personal data protection”.

2. What this Statement covers

This Statement describes how we process the personal data you leave with us through the website: via the contact form, the “Send a question to the doctor” form and by browsing the website. Data we process as a healthcare institution during examination and treatment (medical records) is processed in accordance with the regulations on healthcare and patients’ rights, and special rules apply to it, which we provide to you at the Polyclinic.

3. What data we collect and why

Contact form (Contact page and the “Book an appointment”, “Request a consultation” and “Contact us” buttons): name and surname, e-mail address and the content of your message. We use this data only to reply to your enquiry and, if you ask us to, to arrange an appointment.

“Send a question to the doctor” form: name, e-mail address, year of birth and your question. The question often contains health data, which is a special category of personal data. We process it solely so that a Polyclinic doctor can answer your question. Please do not include more information in your question than is needed for an answer.

We may publish the question and answer on the website as general advice, always without your name, year of birth or any information by which you could be identified.

Browsing the website: the server hosting the website records technical data about each visit (IP address, time, requested page, browser type). These records are used for the security and proper functioning of the website.

4. Legal basis for processing

• Enquiries sent through the forms: your consent, given by ticking the box before sending (Article 6(1)(a) of the General Data Protection Regulation, GDPR), and taking steps at your request prior to possible treatment (Article 6(1)(b)).
• Health data in a question to the doctor: your explicit consent (Article 9(2)(a) GDPR).
• Technical server records: our legitimate interest in the security and proper functioning of the website (Article 6(1)(f)).
• Non-essential cookies and Google Maps: your consent given in the cookie banner.

You may withdraw your consent at any time by sending a message to the address in section 1. Withdrawal does not affect the lawfulness of processing before the withdrawal.

5. Who has access to the data

Messages sent through the forms arrive at the Polyclinic’s official e-mail and are seen only by the staff who answer enquiries: the staff who book appointments and, for questions to the doctor, the Polyclinic’s doctors. All of them are bound by medical and professional confidentiality.

We do not sell your data or share it with third parties for their own purposes. We use the following processors, with whom we have a data processing agreement:

• WMD d.o.o., Croatia: development, maintenance and hosting of the website and the e-mail server. The data is stored on servers in the European Union.
• Google Ireland Ltd.: display of Google Maps with the locations of our branches, only if you have consented to it (see section 7).

We may disclose data to competent authorities only when required by law.

6. How long we keep the data

• Enquiries sent through the forms: up to 6 months after our reply, unless you become our patient; in that case the data needed for treatment is kept in the medical records for the periods prescribed by law.
• Technical server records: 90 days.
• The cookie storing your cookie choice: 6 months.

7. Cookies and Google Maps

The website uses an essential cookie that remembers your choice in the cookie banner. We set other cookies only with your consent.

Maps with the locations of our branches are loaded from Google’s servers only after you accept them. When a map loads, Google receives your IP address and may set its own cookies under its own rules (policies.google.com/privacy). Google may transfer the data to the USA, with the safeguards of the EU–US Data Privacy Framework. Until you accept the maps, you will see a box with a “Show map” button instead.

The website currently does not use any visitor measurement or advertising tools (Google Analytics, Facebook pixel and similar). If we introduce them, we will update this Statement and ask for your consent.

You can change your cookie choice at any time using the “Cookie settings” link at the bottom of the page.

8. Data security

The website is available only over an encrypted connection (HTTPS), so data from the forms is transmitted encrypted. Only authorised persons with personal login credentials have access to the server, the website editing system and e-mail. The system is regularly updated and backed up. Despite these measures, no transmission over the internet is completely secure, so please do not send medical records through the forms; bring them to your examination or send them in a way we agree with you.

9. Your rights

With regard to your data, you have the right:

• to access your data and receive a copy,
• to have inaccurate data corrected,
• to have your data erased, except where we are required by law to keep it,
• to restrict processing and to object to processing,
• to data portability,
• to withdraw your consent at any time.

Send your request to poliklinika@oxy.hr or by post to the Polyclinic’s address, marked “Personal data protection”. We will reply within one month at the latest.

If you believe that we process your data in breach of the regulations, you may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr.

10. Changes to this Statement

We may amend this Statement when the regulations or the way the website works change. The current version is always published on this page, together with the date of the last update.