Version 1.0 · effective 21 September 2026
These Terms have been prepared in Polish and English. In the event of any discrepancy, the Polish version prevails.
§ 1. General provisions
1. These Terms set out the rules for the provision of electronic services within the Client Portal operated by the Healthcare Poland Foundation, seated in Warsaw, entered in the National Court Register under KRS number 0001066269 (the “Foundation”), and constitute terms of service within the meaning of Article 8(1)(1) of the Polish Act of 18 July 2002 on the provision of electronic services.
2. The Terms are made available free of charge before the conclusion of the agreement, in a manner allowing their acquisition, reproduction and recording.
3. Contact regarding these Terms: global@healthcarepoland.pl.
§ 2. Definitions
1. Portal — the Foundation’s information system available at healthcarepoland.pl in the section requiring authentication.
2. User — a natural person acting in the name and on behalf of an Entity, within that Entity’s professional or business activity, to whom the Foundation has granted access to the Portal.
3. Entity — the legal person, organisational unit or entrepreneur represented by the User.
4. Value Stream — a distinct subject-matter area of the Foundation to which Resources are assigned and within which access is granted.
5. Resources — documents, templates, methodologies, checklists, reports, recordings and other materials made available in the Portal.
6. Account — the set of data and permissions assigned personally to the User.
7. GDPR — Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.
§ 3. Type and scope of services
1. The Foundation provides, by electronic means, the service of maintaining an Account and making Resources available within the granted Value Streams.
2. The service is provided free of charge, within the Foundation’s statutory activity, and does not constitute a reciprocal performance.
3. Resources are informational and methodological in nature. They do not constitute legal advice, medical advice, an audit, certification, conformity assessment or investment recommendation. They are not intended for direct use in diagnosis or treatment.
4. The Foundation does not provide medical services and does not supervise how Resources are used by the User or the Entity. Decisions taken on the basis of the Resources are the sole responsibility of the Entity.
5. Resources reflect the state of knowledge and the state of the law as at the date indicated in the given document. The Foundation does not undertake to keep them current.
6. The Portal is not a medical device within the meaning of Regulation (EU) 2017/745, nor a high-risk artificial intelligence system within the meaning of Regulation (EU) 2024/1689. The Foundation reserves the right to suspend any function that could lead to a different classification.
§ 4. Technical requirements and prohibition of interference
1. Use of the Portal requires a device with internet access, a current browser supporting HTTPS and JavaScript, and an active e-mail address.
2. The Foundation notifies Users of the risks typical of electronic services, in particular interception of transmission, malicious software and attempts to obtain credentials by deception.
3. It is prohibited to take any action disrupting the operation of the Portal, including testing its security without the Foundation’s prior written consent, automated downloading of Resources beyond ordinary use, and circumventing access control mechanisms.
§ 5. Conclusion of the agreement, verification and representations
1. Submission of an access request constitutes an invitation to conclude an agreement. The agreement is concluded upon activation of the Account by the Foundation. The Foundation is not obliged to activate an Account or to justify a refusal.
2. By submitting a request, the applicant represents that: a) they act in a professional capacity and are not a consumer within the meaning of Article 221 of the Polish Civil Code; b) they are duly authorised to represent the indicated Entity within the scope of the request; c) the data provided are true and current; d) neither they nor the represented Entity are subject to sanctions of the European Union, the United Nations or the United States of America, nor do they act on behalf of an entity so sanctioned; e) they are not submitting the request in order to obtain Resources for an entity competing with the Foundation.
3. The Foundation may request documents confirming the authorisation and status of the Entity, in particular before granting access to Value Streams marked as restricted.
4. Until activation, the Account remains inactive and logging in is not possible.
5. The Account is personal and non-transferable. Sharing credentials with another person constitutes a material breach of these Terms.
6. The scope of Value Streams is granted on the principle of least privilege and may be changed at any time, including by restriction. Submitting a request does not give rise to any claim to access a particular Value Stream.
§ 6. Resources — licence and restrictions
1. Resources are the intellectual property of the Foundation or of entities that have granted it the relevant rights.
2. The Foundation grants the User a non-exclusive, non-transferable, revocable licence, without the right to sublicense, valid for as long as the Account remains active, covering solely: a) accessing the Resources; b) reproducing the Resources for the internal purposes of the Entity; c) adapting templates and checklists into the Entity’s internal documentation.
3. It is prohibited in particular to: make Resources available to persons outside the Entity, publish them in any form, resell them, incorporate them into services provided to third parties, use them to train, fine-tune or evaluate artificial intelligence models, remove provenance markings or watermarks, and decompile protective mechanisms.
4. Access to the Portal does not entitle the User to use the Foundation’s marks or those of its programmes, including CAC HCPL, CyberC4HE and CMA, nor to claim certification that the Entity has not obtained in separate proceedings.
5. Downloaded files may be marked with the identifier of the downloading Account, in order to establish the source of any unauthorised disclosure.
§ 7. User content
1. The User represents that they are entitled to provide the Foundation with the content entered into the Portal and that providing it does not infringe third-party rights or any duty of confidentiality.
2. The User grants the Foundation a non-exclusive, royalty-free licence to use content entered into the Portal — covering recording, reproduction, storage, adaptation and the creation of anonymised datasets — solely for the purposes set out in § 8(2). To the extent that content has been used in aggregate or anonymised works, the licence survives termination of the agreement.
3. The User shall not enter into the Portal personal data of third parties, and in particular data referred to in Article 9(1) GDPR, including health data, or data covered by medical confidentiality — unless the parties have concluded a separate data processing agreement setting out the conditions of such processing.
4. Entering data in breach of paragraph 3 constitutes a material breach of these Terms. The Foundation is entitled to delete such data immediately and to suspend the Account, and the User and the Entity bear responsibility for the consequences of entering it.
§ 8. Manual, machine, automated and AI-assisted processing
1. The Foundation processes data and content provided within the Portal manually, by machine, in an automated manner and using artificial intelligence systems.
2. Processing covers in particular: provision of the service and maintenance of the Account, ensuring security and detecting abuse, indexing and searching content, classifying and summarising documents, statistical and comparative analyses, the Foundation’s research, standardisation, certification and implementation work, and the development of its services.
3. The Foundation does not take decisions concerning the User based solely on automated processing which would produce legal effects concerning them or similarly significantly affect them. The output of automated tools, including the assessment of an access request and security signals, is reviewed by an authorised member of the Foundation’s staff who is empowered to change the outcome.
4. Content generated or materially processed by artificial intelligence systems is marked as such. It does not constitute advice or a determination and requires independent verification by the User.
5. The Foundation does not use User content to train, fine-tune or evaluate artificial intelligence models — whether its own or those of external providers — without separate, freely given consent. The Foundation stipulates this undertaking in its agreements with providers.
6. Aggregate results and benchmarks are published solely in a form that prevents identification of an individual Entity, with a minimum sample size of five Entities.
7. Further processing for statistical and research purposes is carried out with the safeguards referred to in Article 89(1) GDPR, in particular pseudonymisation and minimisation.
8. Detailed information on the processing of personal data is set out in the Data Processing Notice, which constitutes a separate document.
§ 9. Confidentiality
1. Resources marked as confidential, as well as information on security architecture, vulnerabilities and incidents, constitute confidential information of the Foundation.
2. The User and the Entity undertake to maintain confidentiality for the duration of the agreement and for five years after its termination.
3. This obligation does not cover information that is publicly available without breach of these Terms, or disclosure required by law or by a decision of a competent authority — of which the User shall inform the Foundation without delay, unless prohibited by law.
4. For Value Streams comprising materials relating to infrastructure security, the Foundation may make access conditional upon the conclusion of a separate non-disclosure agreement.
§ 10. Security, User obligations and suspension of the Account
1. The Foundation applies technical and organisational measures appropriate to the risk, in particular encryption of transmission, role-based access control, storage of files outside the public directory with controlled download, event logging, backups and limitation of authentication attempts.
2. The User undertakes to keep credentials confidential, to report without delay any loss of control over the Account or suspicion of unauthorised access, and to report without delay the cessation of their authorisation to represent the Entity.
3. The Foundation may suspend the Account with immediate effect where: a) credentials have been shared with another person; b) an attempt has been made to circumvent access control or to test security without the Foundation’s consent; c) Resources are downloaded in bulk or disseminated in breach of § 6; d) data have been entered in breach of § 7(3); e) data provided in the request prove to be untrue; f) the User’s authorisation to represent the Entity has ceased; g) the User or the Entity has become subject to sanctions referred to in § 5(2); h) use of the Portal endangers the security of the system or of other users.
4. A good-faith report by the User of a vulnerability or malfunction of the Portal does not in itself constitute grounds for suspension of the Account.
5. The Foundation informs the User of the suspension together with its basis and allows the submission of explanations within 14 days. Failure to submit explanations entitles the Foundation to terminate the agreement.
§ 11. Liability
1. The Portal is made available on an “as is” basis. The Foundation gives no warranty as to continuity, availability, throughput or error-free operation and does not undertake to maintain any particular service level.
2. The Foundation may introduce technical breaks and may change, restrict or withdraw functions and Resources, giving advance notice where possible.
3. The Foundation is not liable for the consequences of decisions taken by the User or the Entity on the basis of the Resources, nor for their fitness for a particular purpose, their compliance with supervisory requirements, or the outcome of any proceedings conducted in respect of the Entity.
4. To the extent permitted by law, the Foundation is not liable for lost profits, indirect damage, loss of data, loss of reputation or business interruption, and its liability for actual damage is limited to PLN 10,000 in respect of all events in a given calendar year.
5. The limitations in paragraphs 3 and 4 do not apply to damage caused intentionally, nor to cases in which liability cannot be excluded or limited under mandatory provisions of law, including Article 82 GDPR.
6. The User and the Entity shall hold the Foundation harmless and satisfy third-party claims — including those of supervisory authorities and data subjects — brought against the Foundation in connection with a breach of § 6, § 7 or § 9, including reasonable legal costs.
7. The Foundation is not liable for non-performance resulting from force majeure, including cyberattacks on providers’ infrastructure, failures of external links, decisions of public authorities and states of emergency.
§ 12. Complaints and dispute resolution
1. Complaints are submitted to global@healthcarepoland.pl, indicating the User, the subject of the complaint and the request.
2. The Foundation examines a complaint within 30 days of receipt and responds in documentary form.
3. The parties shall seek an amicable resolution. A dispute may, with the consent of both parties, be referred to mediation conducted by the Centre for Mediation, Conciliation and Arbitration at the Foundation. Referral to mediation is not a condition of bringing court proceedings. In a dispute involving the Foundation, persons connected with the Foundation by employment, membership of its bodies or standing cooperation are excluded from the proceedings.
4. The governing law is Polish law. The competent court is the common court having jurisdiction over the Foundation’s registered office.
5. Paragraph 4 is without prejudice to mandatory provisions of the law of the Entity’s country of establishment, does not exclude the competence of supervisory authorities in data protection matters, and does not deprive data subjects of the rights provided for in Articles 77–79 GDPR.
§ 13. Transfers outside the European Economic Area and sanctions
1. The Foundation may transfer data outside the European Economic Area solely on the basis of a European Commission adequacy decision or standard contractual clauses, following a transfer impact assessment.
2. The list of categories of recipients and countries of processing is set out in the Data Processing Notice. A copy of the safeguards may be obtained upon request sent to the Foundation’s contact address.
3. The User shall not make Resources available outside the Entity’s country of establishment without the Foundation’s prior written consent — this applies in particular to materials describing infrastructure vulnerabilities and security assessment methodologies.
4. The User shall ensure that use of the Resources complies with the rules on control of trade in dual-use goods and technologies and with sanctions regimes binding on the Foundation or the Entity.
5. The User shall inform the Foundation without delay of any request by a third-country authority for disclosure of Resources or data originating from the Portal, unless prohibited by law, and shall limit disclosure to the strictly required scope.
§ 14. Amendments to the Terms
1. The Foundation may amend these Terms for important reasons, in particular a change in the law, a change in the scope or manner of providing the service, security considerations or organisational changes on the part of the Foundation.
2. The Foundation notifies of an amendment in the Portal and to the e-mail address assigned to the Account, at least 14 days in advance.
3. Use of the Portal after an amendment takes effect constitutes acceptance of it. A User who does not accept an amendment may terminate the agreement with immediate effect before the date on which it takes effect.
4. Amendments resulting from mandatory provisions of law or necessary to remove a security threat may take effect immediately.
5. The Foundation records the version of the Terms accepted by the User together with the date of acceptance.
§ 15. Termination and consequences
1. The User may terminate the agreement at any time, without stating reasons, with immediate effect.
2. The Foundation may terminate the agreement on 14 days’ notice, and in the cases set out in § 10(3) — with immediate effect.
3. An Account from which no login has occurred for 12 consecutive months expires following prior notice sent at least 30 days in advance.
4. Upon termination, access to the Portal and the licence referred to in § 6(2) expire. The User shall cease using downloaded Resources and delete copies of them, except for copies whose retention is required by law.
5. The following survive termination: § 6(3) and (4), § 7(2), § 9, § 11 and § 12(4) and (5).
6. Anonymised works created before termination remain in the Foundation’s resources.
§ 16. Final provisions
1. The Foundation may transfer the rights and obligations arising from these Terms to an affiliated entity or a legal successor, giving the User at least 14 days’ notice; the User is then entitled to terminate the agreement with immediate effect.
2. The User may not transfer rights or obligations without the Foundation’s written consent.
3. If any provision of these Terms proves invalid or ineffective, the remaining provisions remain in force, and the invalid provision shall be replaced by a legally permissible provision closest to the parties’ intention.
4. These Terms have been drawn up in Polish and English. In the event of any discrepancy, the Polish version prevails.
5. Matters not regulated herein are governed by Polish law, in particular the Civil Code, the Act on the provision of electronic services, the Act on copyright and related rights, and the GDPR.
6. These Terms enter into force on the date of their publication in the Portal.
