Privacy policy

The controller of your personal data within the meaning of the GDPR (Regulation (EU) 2016/679, in Poland known as RODO) is:

Instap sp. z o.o.
ul. Eugeniusza Kwiatkowskiego 9, 37-450 Stalowa Wola, Poland
KRS 0000839006 · NIP 8652573565 · REGON 385978256

We have not appointed a Data Protection Officer. For any matter concerning personal data, write to hello@instap.app or to the postal address above.

This policy explains how we handle personal data on the instap.appwebsite. Systems we build and deploy for our clients — including Instap Patient Viewer running inside a client’s own infrastructure — are outside its scope; in those deployments the client is the controller and we act only as a processor under a separate data processing agreement.

When you use the contact form we process the data you enter: full name, e-mail address and the content of your message (all required), plus company / organisation and phone number if you choose to provide them. The same applies to data contained in e-mails you send us directly.

Purpose: answering your enquiry and any follow-up correspondence, including steps taken at your request before entering into a contract.

Legal basis:Article 6(1)(b) GDPR where your message concerns a possible contract with us, and Article 6(1)(f) GDPR — our legitimate interest in handling correspondence and defending against potential claims — in other cases.

Is it required? Providing the data is voluntary, but without a name, e-mail address and message we cannot process or answer your enquiry.

Messages are delivered to our mailbox by e-mail. We do not store form submissions in a database on this website.

Our hosting provider automatically records technical data for every request to the Website: IP address, date and time, requested URL, HTTP status, referrer, user-agent string and approximate region.

Purpose: delivering the Website, diagnosing faults, and protecting it against abuse, overload and attacks.

Legal basis:Article 6(1)(f) GDPR — our legitimate interest in the secure and reliable operation of the Website.

The Website does not use cookies for advertising, profiling or cross-site tracking, and it has no social media tracking pixels.

On the production site we use Google Analytics 4, provided by Google Ireland Limited, to understand how the Website is used in aggregate — which pages are visited, from which approximate region, and on what type of device. Google Analytics sets cookies in your browser (typically _ga and _ga_<id>) containing a randomly generated identifier, and it does not store your full IP address. We do not use it to identify individual visitors and we do not combine it with the data you send through the contact form.

Legal basis:Article 6(1)(f) GDPR — our legitimate interest in measuring and improving the Website. Analytics is not loaded on our development and preview environments.

How to opt out:you can block or delete cookies in your browser settings, use your browser’s “do not track” or tracking-protection features, or install the Google Analytics opt-out browser add-on. Blocking these cookies does not affect how the Website works. You may also object to this processing at any time — see your rights.

Beyond analytics, the Website only uses technical storage that is necessary for it to function.

We do not sell personal data and we do not share it for anyone else’s marketing. We do rely on service providers who process data on our behalf, under data processing agreements:

• Vercel Inc.— hosting and delivery of the Website (server logs);
• Resend (Plus Five Five, Inc.)— delivery of messages sent through the contact form;
• Google Ireland Limited— website analytics;
• our e-mail provider, and — where relevant — our legal, accounting and IT advisers.

We may also disclose data to public authorities where we are required to do so by law.

Some of these providers are established outside the European Economic Area or process data there. Such transfers take place on the basis of the safeguards required by Chapter V GDPR — the European Commission’s Standard Contractual Clauses and, where applicable, an adequacy decision such as the EU–US Data Privacy Framework. You can ask us for details of these safeguards.

• Correspondence and contact form submissions— for as long as needed to handle the matter, and afterwards for up to 3 years, matching the limitation period for business-related claims under Polish law.
• Server logs— for the retention period applied by our hosting provider, typically no longer than 12 months.
• Analytics data— for the retention period set in Google Analytics, no longer than 14 months; analytics cookies expire within 2 years of your last visit at the latest.
• Where processing is based on our legitimate interest, we stop it if you object and we have no overriding grounds to continue.

Under the GDPR you have the right to:

• access your data and obtain a copy of it;
• have inaccurate data rectified and incomplete data completed;
• have your data erased (“right to be forgotten”), where the conditions for it are met;
• restrict processing;
• data portability, for data processed by automated means on the basis of a contract or consent;
• objectat any time, on grounds relating to your particular situation, to processing based on our legitimate interest (Article 6(1)(f) GDPR) — this includes analytics;
• withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out beforehand.

To exercise any of these rights, write to hello@instap.app. We respond within one month of receiving the request; where a request is complex we may extend that period and will tell you if we do.

You also have the right to lodge a complaint with the supervisory authority — in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw.

We do not make decisions about you based solely on automated processing, and we do not profile you within the meaning of Article 22 GDPR, in connection with your use of this Website.

The Website is aimed at businesses and institutions and is not directed at children. We do not knowingly collect personal data of persons under 16. If you believe a child has sent us such data, please contact us and we will delete it.

We may update this policy when our processing, the tools we use, or the applicable law change. The current version is always published on this page together with the date it was last updated. If a change materially affects your rights, we will make the update clearly visible on the Website.