OVARIANA®Privacy policy
Last updated: 16 September 2026.
This policy covers the ovariana.pl information website and its language versions. It explains data processing when you browse or contact us. It is not the privacy policy for a user account or the OVARIANA application. Information reflecting those services will be provided before they launch.
1. Controller and contact
The controller is MEDAI sp. z o.o., ul. Prof. dr Mieczysława Michałowicza 12, 43-300 Bielsko-Biała, Poland; KRS 0000827308, NIP 5472217169, REGON 385526755. For privacy matters and rights requests, contact [email protected] or write to the postal address above. You may use the subject “Privacy — ovariana.pl”.
2. What this website does
You do not need an account to read articles. This website has no waitlist form, payments or symptom journal, and does not keep a history of articles you read. Topic search works on your device; queries are not sent to MEDAI. This version includes no Google Analytics, Meta Pixel, advertising tools or session recording. Images, fonts and website scripts are served from this website’s domain.
3. Technical data during visits
Delivering the website involves technical data such as your IP address, request time, requested page, browser and operating-system information, and server response status. Depending on browser settings, a referring page may also be communicated. Hosting and traffic-protection systems may record this information in logs.
The purposes are delivering the website, maintaining security, detecting abuse and diagnosing faults. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in running a secure, functioning website. We do not use logs to create health or advertising profiles.
4. Email correspondence
If you contact us, we process your email address, message and information you choose to provide, such as your name or organisation. Handling correspondence and replying is based on Article 6(1)(f) GDPR, our legitimate interest in communicating with interested people. Article 6(1)(b) may apply to steps you request before entering a contract. Legal obligations, including handling data-rights requests, are fulfilled under Article 6(1)(c).
Providing data is voluntary, but without a reply address we cannot respond. Ordinary email is not a medical-consultation channel. Do not send test results, medical records, descriptions of symptoms or other people’s health data. We do not need these to provide this website. We minimise or delete unnecessary information received in correspondence.
5. Browser storage and cookies
When you choose a display setting, the website stores two localStorage preferences: ovariana-display-theme (light or dark) and ovariana-high-contrast (standard or high contrast). Their sole purpose is remembering the display you requested. They contain no name, email address or advertising identifier and are not sent to a server by website scripts. They remain until you clear website data in your browser or change the preference.
Website code does not set analytics or advertising cookies. Infrastructure and security systems may use technical mechanisms necessary to deliver and protect the connection. You can control cookies and site data in your browser; blocking storage may prevent preferences from being remembered. If we introduce tools requiring consent, they will not run before consent is obtained, and this policy will be updated.
6. Recipients
Recipients may include hosting, traffic-protection/CDN, email and IT-support providers and, when justified, legal advisers and legally authorised authorities. Access should be limited to what is needed for the relevant service or obligation. Providers acting as processors are subject to appropriate processing agreements. We do not sell visitor data or provide it to partners for their own marketing.
7. Transfers outside the EEA
Infrastructure, traffic-protection or email services may involve processing outside the European Economic Area. Such transfers require a mechanism under Chapter V GDPR: an applicable European Commission adequacy decision or appropriate safeguards, for example standard contractual clauses and any necessary supplementary measures. To obtain information about providers involved in processing your data, processing countries and safeguards, including how to obtain a copy, contact [email protected].
8. Retention
Correspondence is kept while handling the matter and for necessary reference to the arrangements made. If evidence must be retained for a particular matter, this may extend to the applicable limitation period for claims; statutory records are kept for the legally required period. Criteria include the purpose and progress of the matter, any dispute and applicable legal duties.
Technical records follow the provider’s log-retention and rotation cycle, taking account of the time needed to detect and investigate failures or security incidents. Logs preserved for a specific incident may be retained until it and related claims are resolved. Display preferences remain in your browser as described in section 5. You can ask the controller about retention for a specific matter.
9. Your rights
Subject to GDPR conditions, you may request access and a copy, correction, erasure and restriction of processing. You may object to legitimate-interest processing on grounds relating to your particular situation. Portability applies to automated processing based on consent or contract; it does not automatically cover all logs or correspondence. Where processing is based on consent, you can withdraw it without affecting earlier lawful processing.
Send requests to [email protected]. We normally respond within one month; if an extension permitted by GDPR is needed, we will explain why. You may complain to the President of Poland’s Personal Data Protection Office, uodo.gov.pl, or another competent EU supervisory authority.
10. External links, profiling and security
Links to ovariana.app, medical sources and social profiles lead to separate services. Following a link establishes a connection with that operator. We do not embed social widgets or video players. Each external service has its own privacy information.
We do not make solely automated decisions with legal or similarly significant effects using this website’s data, and do not carry out health profiling. We apply risk-appropriate protection, including restricted access; use HTTPS when visiting. No internet communication method can guarantee absolute security.
11. Changes
The current policy and update date are published here. Before introducing accounts, launch notifications, payments, analytics or health features, we will provide information reflecting their actual purposes, data and legal bases. Browsing the website does not itself constitute consent to additional processing.