Privacy policy

a) Controller — RED4.AI Prosta Spółka Akcyjna, registered office: ul. Dąbrowskiego 20, Kraków, KRS: 0001083454, NIP: 6772473322, REGON: 520999604, operating the Service.

b) Service — the medjob.pl website available at medjob.pl, where people looking for healthcare jobs find offers and medical facilities publish job advertisements.

c) User — any natural person visiting the Service or using its features, whether a Guest User or a Signed-in User.

d) Guest User — a User without an Account or using the Service without signing in.

e) Signed-in User — a User with an Account who uses the Service after signing in.

f) Candidate — a Signed-in User with a candidate account looking for work in healthcare.

g) Employer — a healthcare provider, other medical facility or other entity publishing job offers in the Service as part of its business, including people acting on its behalf (Employer team members).

h) Account — the candidate account or the Employer panel, i.e. the features available after signing in, used to access the Service under the Terms.

i) Candidate Profile — the data about a Candidate saved in their Account: contact details, profession, specialities, experience, education, courses, job preferences and CV file.

j) Facility Profile — the Employer's public page in the Service with company data, its facilities and published offers.

k) RPWDL — the Polish Register of Healthcare Providers, run by Centrum e-Zdrowia.

l) GDPR — Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC.

m) Personal data — any information relating to an identified or identifiable natural person.

n) Processor — a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

o) Terms — the terms of service of the Service.

p) Cookies — small text files saved on the User's device that, among other things, keep you signed in and remember settings. Browser storage (localStorage) works in a similar way.

The controller of your personal data, i.e. the entity that determines the purposes and means of processing, is RED4.AI Prosta Spółka Akcyjna, registered office: ul. Dąbrowskiego 20, Kraków (full details are in the Controller definition in section 1).

For matters related to the processing of your personal data, in particular to exercise your rights, you can contact the Controller:

a) in writing, at the registered office address given in section 1;

b) by email, at kontakt@medjob.pl.

If the Controller appoints a data protection officer, their contact details will be given in this section.

Depending on how you use the Service, we process the following categories of personal data:

• Account data — email address, password (stored only as an encrypted hash) and account type (Candidate or Employer);
• Candidate Profile data — first and last name, profile photo, contact email, phone, city and region, licence to practise number (PWZ), profession, specialities, years of experience, work history, education, courses and training, salary expectations, preferred employment types and cities, willingness to relocate, availability date and an "about me" description;
• CV data — the uploaded CV file and data read from it; the file reaches an Employer only when you apply to their offer;
• Account activity data — saved offers, saved searches, submitted applications and their statuses;
• data of Employers and people acting on their behalf — Account email, company name, tax number (NIP), address, contact phone and email, facility data, offer content, logo and photos, and information about Employer team members and their permissions;
• registry data — facility data retrieved from the public RPWDL registry using the tax number (name, address, registration status, register ledger number, organisational structure and scope of services);
• billing data — data needed to accept payment and issue an invoice (company name, tax number, address, invoice email, payment and invoice history);
• technical data — IP address, device and browser type, sign-in session data and event logs needed to keep the Service secure.

We do not ask for health data or other special categories of data referred to in Art. 9 GDPR. Please do not include them in your Candidate Profile or CV unless you consider it necessary for a given recruitment.

Details of the purposes and legal bases of processing are in section 5.

We process personal data for the following purposes and on the following legal bases:

5.1. Using the Service without an Account

a) to provide job offers, Facility Profiles, search and the offer map — the legal basis is the performance of the electronic services agreement (Art. 6(1)(b) GDPR);

b) to diagnose problems with the Service, ensure its correct configuration and IT security — the legal basis is the Controller's legitimate interest in keeping the Service running properly (Art. 6(1)(f) GDPR); for this purpose we process technical data such as IP address and device, operating system and browser data;

c) to handle questions, feedback and requests sent to us by email — the legal basis is the Controller's legitimate interest (Art. 6(1)(f) GDPR). We then process your email address and any data you include in your message.

5.2. Candidate Account

To create an Account you must provide an email address and a password. Without them an Account cannot be created or used. The rest of the Candidate Profile is voluntary, but without it offer matching and applying may be limited.

We process the data:

a) to run the Account and its features — the Candidate Profile, saved offers, saved searches, applying to offers and tracking application status — the legal basis is the performance of the agreement or steps taken at your request before entering into it (Art. 6(1)(b) GDPR);

b) to match job offers to the Candidate Profile as described in section 6 — the legal basis is the performance of the agreement (Art. 6(1)(b) GDPR);

c) to send Account-related messages, e.g. email address confirmation or a password reset link — the legal basis is the performance of the agreement (Art. 6(1)(b) GDPR);

d) to diagnose problems with the Service and keep it secure — the legal basis is the Controller's legitimate interest (Art. 6(1)(f) GDPR).

5.3. Reading data from your CV

After you upload a CV, the Service can read data from it to help you complete your profile. The file is passed to an artificial intelligence model that extracts contact details, education, experience, courses, profession, specialities and the PWZ number. The result is only a suggestion: you see it in the profile wizard and decide what to save. The model makes no decisions about you. The legal basis is the performance of the agreement (Art. 6(1)(b) GDPR). The model provider processes the data on our behalf.

5.4. Employer Account and Facility Profile

When creating an Account, the Employer provides an email address, a password and company data, including the tax number. We process the data:

a) to run the Employer panel, publish the Facility Profile and job offers, and handle candidate applications — the legal basis is the performance of the agreement (Art. 6(1)(b) GDPR) and, for people acting on the Employer's behalf, the legitimate interest of the Controller and the Employer in enabling the Employer to use the Service (Art. 6(1)(f) GDPR);

b) to verify the facility in the RPWDL registry and complete its data — the legal basis is the Controller's legitimate interest in ensuring that offers are published by genuine medical facilities (Art. 6(1)(f) GDPR); we store the full registry response so we can check what data we received on a given day, and we repeat the verification periodically;

c) to determine the coordinates of the facility address and show it on the map — the legal basis is the Controller's legitimate interest (Art. 6(1)(f) GDPR);

d) to manage the Employer team, including access requests and granting or revoking permissions — the legal basis is the legitimate interest of the Controller and the Employer (Art. 6(1)(f) GDPR);

e) to provide technical support — authorised Controller staff may, for support purposes, view the Employer panel as the Employer sees it — the legal basis is the Controller's legitimate interest (Art. 6(1)(f) GDPR).

Facility Profile data (name, address, contact phone and email, description, logo, photos, offers) is public. If you enter a specific person's data there, e.g. their email or phone, it will be visible to everyone visiting the Service.

5.5. Facility profiles created from public registries

We create some Facility Profiles ourselves, before the facility sets up an Account, using public data from the RPWDL registry and other publicly available sources. Such profiles contain only facility data: name, tax number, address and facility contact details. If a facility is run by a natural person, e.g. as a professional practice, this data may be their personal data. We process it on the basis of the Controller's legitimate interest in presenting candidates with a complete database of healthcare employers (Art. 6(1)(f) GDPR). The facility can take over its profile and manage it, or request its removal by writing to kontakt@medjob.pl.

5.6. Paid services

Employers may publish offers for a fee under the Terms. Billing data is then necessary to accept and fulfil the order; without it the service cannot be provided. We process the data:

a) to fulfil the order and handle payment — the legal basis is the performance of the agreement (Art. 6(1)(b) GDPR); online payments are handled by a payment operator and we do not receive card details or bank login details;

b) to issue an invoice and meet tax and accounting obligations, including submitting the invoice to the Polish National e-Invoicing System (KSeF) — the legal basis is a legal obligation (Art. 6(1)(c) GDPR);

c) to handle deferred-payment invoicing and monitor payment limits — the legal basis is the Controller's legitimate interest (Art. 6(1)(f) GDPR);

d) for sales analytics and statistics — the legal basis is the Controller's legitimate interest in measuring the effectiveness of the Service and improving its features (Art. 6(1)(f) GDPR).

5.7. Applying to job offers

When you apply to an offer, we share with the Employer who published it the data from your Candidate Profile — name, contact details, profession, specialities, PWZ number, experience, education, courses and preferences — your CV file, if uploaded, and the match percentage for the offer. From then on the Employer is the controller of this data for the purposes of its recruitment and is responsible for informing you about its processing.

To the extent that we store the application and display it in the Employer panel, we act on behalf of and on the instructions of the Employer, as a Processor. The legal basis for sharing the data with the Employer is the performance of the agreement with you (Art. 6(1)(b) GDPR) — applying is a service you request.

An Employer sees your Candidate Profile only if you applied to their offer. Your profile is not public and is not shared with other Employers.

5.8. Establishing, pursuing or defending claims

In some cases we may process your data to establish, pursue or defend claims, in court or out of court. The legal basis is the Controller's legitimate interest in protecting its rights (Art. 6(1)(f) GDPR). We process data for this purpose only when a situation has actually arisen while using the Service that gives reason to suspect such claims exist on your or our side.

The Service automatically calculates how well a job offer fits a Candidate Profile (match percentage). This is profiling within the meaning of the GDPR.

The calculation uses Candidate Profile data such as:

• profession and specialities,
• years of experience,
• home city, preferred cities and willingness to relocate,
• preferred employment types,
• salary expectations.

On this basis the Service orders the offer list so the best matches appear higher and shows the match percentage next to offers. Matching never limits access to any offer — it only affects the order and presentation of offers. It produces no legal effects for you and does not similarly significantly affect you.

Employers see the match percentage only for candidates who applied to their own offer. The Service never rejects applications automatically — hiring decisions are made by the Employer.

The legal basis is the performance of the agreement (Art. 6(1)(b) GDPR). You can change or delete the profile data that matching depends on at any time. You also have the right to human intervention: you can contact the Controller to express your point of view, contest the match result or state preferences we will take into account.

Your data may be entrusted to entities that help us run the Service. They process it under an agreement with the Controller and only on its instructions. These are in particular providers of:

• hosting, server infrastructure, database, sign-in and file storage;
• email delivery for Account-related messages;
• maps and address search;
• the artificial intelligence model used to read data from CVs;
• online payment processing (PayU S.A.);
• the invoicing system;
• accounting, legal and advisory services.

We send the Employer's tax number to the RPWDL registry in the verification query, and invoice data to the National e-Invoicing System (KSeF) run by the Polish Minister of Finance.

Within the limits of the law, your data may also be disclosed to authorised public bodies in connection with their tasks, in particular the prosecutor's office, the police, the President of the Personal Data Protection Office (UODO) and the President of the Office of Competition and Consumer Protection (UOKiK).

Candidate data is received by the Employer whose offer the Candidate applied to. This depends solely on your actions in the Service. The Employer becomes the controller of this data and must, among other things, provide you with information about its processing.

We do not sell your data or share it with partners for marketing purposes.

As a rule, we do not transfer your personal data outside the European Economic Area (EEA).

However, some IT providers we use are based or operate infrastructure outside the EEA. Where such a transfer occurs, it is made only to countries covered by a European Commission adequacy decision or with appropriate safeguards, such as standard contractual clauses approved by the European Commission.

This applies in particular to:

a) Supabase, Inc. (USA) — database, sign-in and file storage;

b) Cloudflare, Inc. (USA) — hosting and delivery of the Service;

c) OpenAI (USA) — the artificial intelligence model used to read data from CVs, provided through the Lovable platform;

d) MapTiler AG (Switzerland) — maps and address search; Switzerland is covered by a European Commission adequacy decision.

For transfers to the USA we make sure, where possible, that recipients participate in the Data Privacy Framework, which guarantees respect for rights under the GDPR. More information is available at dataprivacyframework.gov.

We keep personal data only as long as necessary for the purposes for which it was collected. The retention period depends on the purpose and legal basis:

1) data processed in connection with the agreement, including Account and Candidate Profile data, is kept until the Account is deleted. You can delete your Account at any time in settings — we then also delete your Profile, CV file, photo, saved offers, saved searches and submitted applications;

2) data processed on the basis of the Controller's legitimate interest is kept until that interest is fulfilled or until you successfully object;

3) billing documents, including invoices, are kept for the period required by tax and accounting law — as a rule 5 years from the end of the calendar year in which the tax obligation arose;

4) after an Account is deleted we may keep limited data where necessary to establish, pursue or defend claims — until the limitation period expires;

5) the Employer may keep application data longer under its own rules — contact the Employer directly about this;

6) data stored in cookies and browser storage is kept until you sign out or delete it in your browser settings (section 11).

In connection with the processing of your personal data you have the following rights:

a) right of access — to obtain information about the processing of your data, including its purposes and legal bases, scope, recipients and planned erasure date, and to receive a copy of the data (Art. 15 GDPR);

b) right to rectification — to have inaccurate or incomplete data corrected or completed (Art. 16 GDPR);

c) right to erasure — in the cases and under the rules set out in Art. 17 GDPR;

d) right to restriction of processing — in the situations and under the rules set out in Art. 18 GDPR;

e) right to data portability — to receive the data you provided to us in a structured, commonly used, machine-readable format and to have it transmitted to another controller (Art. 20 GDPR);

f) right to object — to processing based on legitimate interest, in the situations and under the rules set out in Art. 21 GDPR;

g) right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;

h) right to lodge a complaint with the President of the Personal Data Protection Office (UODO) if you believe the processing of your data breaches the GDPR.

You can correct or delete most of your data yourself in your Account. You can also exercise the rights in points a)–g) by writing to kontakt@medjob.pl. Please state which right you wish to exercise. If needed, we will ask you to clarify your request. We reply without undue delay and no later than one month after receiving the request.

The Service uses cookies and browser storage where necessary for it to work, in particular to:

a) keep you signed in to your Account and navigate the Service;

b) remember your chosen language and view settings, e.g. the offer map view;

c) keep your Account secure.

We use "session" files, kept until you sign out or close the browser, and "persistent" files, kept for the period set in their parameters or until you delete them.

Strictly necessary cookies do not require consent. You can manage them in your browser settings — deleting or blocking them will, however, sign you out and may prevent you from using your Account.

Analytics cookies (Google Analytics 4). With your consent we use Google Analytics 4, a tool by Google Ireland Limited, for statistics on how the Service is used (e.g. page views, approximate traffic sources, actions such as searching or applying for an offer). For signed-in users we attach an internal, pseudonymous account identifier and the account type — we never send your name, e-mail, phone number or other contact details. The legal basis is your consent (Art. 6(1)(a) GDPR). Google Analytics 4 does not store IP addresses; Google signals, advertising features and ad personalisation are disabled — we do not use advertising cookies or profile you for ads. The Google script loads only after you give consent in the cookie banner; without consent your browser sends no requests to Google. You can withdraw or change your consent at any time via the "Cookie settings" link in the page footer — on withdrawal we delete the Google Analytics cookies (_ga). Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

Maps in the Service are served through our own server, so the map provider does not receive your IP address.

We apply technical and organisational measures appropriate to the risks and the categories of data processed. They protect data against disclosure to unauthorised persons, alteration, loss, damage or destruction, and against unlawful processing. They include in particular:

• Account access only after signing in with an email address and password;
• passwords stored only as hashes;
• encrypted connections (SSL/TLS certificate);
• database access rules that let each User see only the data they are entitled to — e.g. an Employer sees a Candidate Profile only if the Candidate applied to their offer;
• CV files and profile photos kept in private storage with no public URLs;
• limiting Controller staff access to data to the necessary minimum.

The Controller may change this Privacy Policy for important reasons, in particular:

• development of the Service's features and services affecting the content of the Policy;
• changes in the law, including data protection law.

We will announce significant changes on the Service or by email.

Matters not covered by this Policy are governed by the GDPR and generally applicable Polish law.

Questions about security and the processing of personal data can be sent to kontakt@medjob.pl.