DOCUMENTS
RheumaNext presents four tools using fictional cases. This policy explains what data is involved in visiting the website and contacting me, how long it is kept and how to exercise your rights.
The personal-data controller, operator and creator of RheumaNext is Bartosz Fiałek, acting in his personal capacity. RheumaNext is a project, not a company.
Correspondence address: ul. Żołnierzy I Armii Wojska Polskiego 10 lok. B6, 81-383 Gdynia.
For contact, error reports and personal-data enquiries or requests, use bfialek@rheumanext.pl. Only I personally handle this mailbox.
The rheumanext.pl portal presents Companion, Clinic Assistant, RheumaCheck and RheumaCare with ready-made synthetic cases. It does not provide patient accounts, a form for personal symptoms or medical-record imports.
Results are computed in the browser from built-in synthetic cases. The connected v2 workflow transfers material and updates between Companion and Clinic Assistant after a user action, in the same page’s memory. RheumaCheck recalculates transferred symptoms, while RheumaCare recalculates a separate prepared RA case. Standalone product examples keep their own state. The portal does not collect visitors’ health information or send results to an application server.
The example state and review actions remain in the current page’s memory. Resetting, reloading or switching language restarts the connected v2 workflow. In standalone examples, switching language retains the selected case but starts its review again.
The selected case identifier may appear in the part of the address after #. This fragment is not sent in an HTTP request to the server. It remains visible in the address, which you may copy or retain in your browser.
Do not enter information about real people into the demonstrations. Results are not for diagnosis, treatment or any other clinical use.
The copy button places a readable result on the clipboard if the browser’s settings allow it. The connected v2 workflow lets you download the review material as a TXT file. RheumaCare also provides a separate download of its core JSON document. Printing or saving to PDF uses the browser’s functions.
Copied text, downloaded files and saved or physical printouts remain outside the application. Resetting does not remove them. Their subsequent storage depends on the browser, device and application receiving them. Retain the fictional-data labels and use restrictions.
Your browser transmits the data needed to retrieve the website and its resources. The hosting service processes, among other things, the IP address, requested URL and request time for this purpose. Logs may also contain the response status, error information and browser information transmitted in the request.
The portal code contains no advertising analytics, advertising or external fonts. It sets no application cookies and does not store demonstration state in localStorage, sessionStorage or IndexedDB. Not transmitting results does not mean there are no network requests: pages, scripts, styles, images and the favicon are downloaded.
Separately from the portal code, hosting infrastructure handles traffic and technical functions. OVH documentation describes a technical SERVER ID cookie that keeps a session on the same server. Your browser may also retain history and cached files, which you can manage in its settings.
I process the data needed to deliver and secure the website and diagnose faults so that the portal can operate reliably and safely. The legal basis is Article 6(1)(f) GDPR: the legitimate interest in operating and protecting the website.
If you write to me, I process your sender address, the contact details you provide, the message and necessary message metadata to reply and deal with the matter. The legal basis is Article 6(1)(f) GDPR: the interest in handling enquiries and reports and retaining the context needed for the matter. Contact is voluntary; I cannot reply without a return address. You do not need to provide health information or identity documents.
I handle personal-data requests under Article 6(1)(c) GDPR in connection with the duties in Articles 12–22 GDPR. I retain only the evidence needed to show how a request was handled. Where necessary to establish, exercise or defend a specific legal claim, I may process the relevant data under Article 6(1)(f) GDPR.
Contact details are not used for unsolicited marketing messages. The portal does not profile visitors or make decisions about them based solely on automated processing that have legal or similarly significant effects. Demonstration results concern fictional cases.
The email link opens your email application; the website does not send a message on your behalf. Messages travel through the email services used. Provide only the information needed to deal with the matter.
This contact channel is not a medical consultation service. Do not send health information, medical records or patient-identifying information. If such unnecessary data reaches the mailbox, I will not use it in demonstrations or for clinical assessment and will delete it without undue delay once identified. Sending it is not treated as consent to medical services.
For an error report, the page address, synthetic example name, browser and problem description are helpful. Check that screenshots and attachments contain no other person’s data. I use correspondence to reply and handle the matter, not to create demonstration cases.
I keep ordinary project correspondence until the matter is closed and for no more than 12 months afterwards. A matter is closed after the final reply, or after 90 days without a reply from the sender if no action remains outstanding.
I keep correspondence about an error for no more than 24 months after the report is closed. Once information that could link the report to a person has been removed, I may retain the technical description and the test of the fix.
I keep a minimal record of personal-data requests for up to 3 years after the final reply. This records the scope of the request, necessary identification, dates and how it was handled. Working copies of data prepared for a response are deleted within 30 days after the reply, unless a specific ongoing matter requires their retention.
Each month I review upcoming deadlines so that data is deleted no later than the periods stated. I remove unnecessary messages, attachments, working copies and trash. I also delete data earlier when it is no longer needed or a valid request or objection requires it. Longer retention is limited to material needed for a specific legal duty or dispute, until that need ends. These rules apply to correspondence under my control; separate provider backup and log cycles are described in the OVH service information.
OVH Sp. z o.o. (OVHcloud), Powstańców Śląskich 9, 53-332 Wrocław, Poland, provides hosting and the public contact mailbox. The portal uses PRO hosting in the eu-west-gra region — Gravelines, France; bfialek@rheumanext.pl uses MXPLAN 100 hosting and the Roundcube interface. Roundcube is an interface to the mailbox, not a separate email provider.
OVH processes data on my behalf under a data-processing agreement, as needed to operate and secure the services. This also covers messages, email logs and metadata. Personal handling of the mailbox does not exclude technical processing by the provider. For separate purposes of their own, such as legal duties or billing, OVH and the relevant email-delivery operators may act as independent controllers.
The provider uses authorised subprocessors identified in its service documents. The MX Plan terms identify VADESECURE as a participant in detecting fraudulent or unwanted messages and malware. Flagged messages, including false positives, may be passed on for analysis and improvement of the protection system under the arrangements in section 10.
The separate administrative address postmaster@rheumanext.pl has a forwarding rule to WP Poczta, provided by Wirtualna Polska Media S.A. Messages sent to that address may reach this service with the data they contain and technical information about email operation. Both mailboxes belong to me. The rule applies to postmaster; bfialek@rheumanext.pl remains the public contact channel. The rules in section 7 also apply to administrative correspondence under my control.
OVH service documents are available at https://www.ovhcloud.com/pl/terms-and-conditions/contracts/. Data may be disclosed to competent authorities where required by law. I do not sell correspondents’ data or disclose it for advertising.
The hosting terms describe statistics prepared from traffic data, such as IP addresses, URLs and request duration, after anonymisation and aggregation. Reports remain available for up to 40 months. This is a period for statistical reports, not raw server logs or message content.
Website-visit and error logs and records of administrative operations are separate from statistical reports. Which records are created depends on the operations performed. The 40-month period does not define their rotation or technical-backup retention. OVH has not yet confirmed the exact period for these records to me; I do not apply the periods for statistics or email to them.
The MX Plan agreement provides for email logs and metadata to be retained for 12 months and made available through support on request. Ordinary messages remain in the mailbox while the service is used, subject to deletion by the user. My correspondence deletion rules are in section 7.
As part of email protection, incoming messages detected as containing malware are deleted without delivery. Outgoing messages detected as containing malware are withheld for one year; outgoing messages detected as fraudulent or unwanted are withheld for 12 months from sending. These are the provider’s specific protection rules, not retention periods for all correspondence.
For hosting in Gravelines, OVH documentation describes file-backup points at 1, 2, 3, 7 and 14 days and an additional location in Roubaix, France. It also describes daily backups of email included with hosting to another data centre. Website-backup points do not define email-backup retention or the physical deletion date of every log.
Deleting a message from the active mailbox does not necessarily remove all of the provider’s technical copies at the same time. I do not have a confirmed maximum period for removing an individual message from OVH backups or a confirmed backup cycle for the WP administrative mailbox. My own archives and copies follow the rules in section 7; when restoring such a copy, I reapply earlier deletions.
For termination of email bundled with hosting, the MX Plan terms refer to the hosting terms, which provide for data deletion within at most 45 days after the service expires. This concerns service termination, not ordinary deletion of an individual message. Retention required by law or a binding request from a competent authority is subject to the relevant exceptions in the data-processing agreement.
The location of the website hosting in Gravelines, France, does not mean that all email, backups and service operations are in the same data centre. The data-processing agreement distinguishes storage location from necessary remote access to operate and secure the services. The exact countries used for email and backup storage, and support access for this particular service, remain to be confirmed by OVH.
OVH’s subprocessor list provides for participation by group entities in the EU and also in Canada and the United Kingdom. For transfers outside the EEA, the agreement provides for appropriate grounds: a European Commission adequacy decision where it covers the transfer, or standard contractual clauses and the required safeguards. The data-processing agreement includes those clauses; the list alone does not identify who accessed a particular message.
Within the MX Plan protection system, messages described in section 8 may be processed by VADESECURE in the EU or in countries covered by an applicable European Commission adequacy decision. The agreement limits retention to the time needed to update the system, with a maximum of 30 days. It also describes sharing anonymised metadata elements with VADESECURE to improve threat detection.
You may request information about, or a copy of, the safeguards applicable to the processing of your data by emailing bfialek@rheumanext.pl. Following an external link or using your own email service is also subject to that service’s arrangements.
Subject to the GDPR’s conditions, you may access your data and obtain a copy, and request correction, erasure or restriction of processing. Where processing relies on legitimate interests, you may object on grounds relating to your particular situation. Processing may continue after an objection only where the law permits it.
Data portability applies to automated processing based on consent or a contract. If consent is used in a particular case, you may withdraw it at any time without affecting the lawfulness of earlier processing. Using this website or sending an ordinary enquiry is not a request for marketing consent.
If you consider that processing breaches data-protection rules, you may complain to the President of Poland’s Personal Data Protection Office: uodo.gov.pl. You may also contact the competent supervisory authority, particularly in the country of your habitual residence, workplace or the alleged infringement. Judicial remedies are also available.
Write to bfialek@rheumanext.pl or the correspondence address given above. Describe your request and how I can reply. No special form or subject line is required. If there are reasonable doubts about your identity, I will ask only for the information needed to confirm it.
I will inform you of the action taken without undue delay and no later than one month after receiving your request. If its complexity or the number of requests makes this necessary, the deadline may be extended by up to two further months. I will explain the extension and its reasons within the first month.
If I take no action, I will explain the reason within one month and tell you about complaint and judicial remedies. Requests are normally free of charge; a justified fee or refusal is possible only for manifestly unfounded or excessive requests, as provided by the GDPR.
Document version: RN-V2-LEGAL-PUBLIC-1. Effective date: 9 September 2026. The synthetic-workflow description was updated for the RheumaNext v2 R1 release dated 10 September 2026. The current policy is available on this page and may be saved or printed through your browser.
If I change the purposes or the way data is processed, I will update this information accordingly. I will provide the required information before using data for a new purpose. Expansion to information about real people is outside the current demonstration scope.