Privacy Policy

Identity of the data controller

The data controller is Doctors DBG SRL (TODO-legal: full legal name, trade register number, tax ID, registered address — to be completed by a lawyer before publication).

Data Protection Officer (DPO)

Our Data Protection Officer can be contacted by email at: dpo@dbg.ro. Any request to exercise your rights or questions regarding data processing should be addressed to this email.

• Responsabil cu Protecția Datelor
• Email: dpo@dbg.ro

Purposes and legal basis for processing

Appointments and patient relationship management

We process identification data (name, surname, phone, email) for the purpose of scheduling consultations and treatment-related communications. Legal basis: Art. 6(1)(b) GDPR — performance of a contract (or pre-contractual measures at the data subject's request).

Medical file and health data

We collect and store medical data (anamnesis, diagnoses, X-rays, treatment plans, dental records) constituting special categories of data under Art. 9 GDPR. Legal basis: Art. 9(2)(h) GDPR read together with Art. 6(1)(c) — legal obligation under Romanian Law no. 95/2006 on healthcare reform and Ministry of Health Order no. 1410/2016.

Invoicing and accounting

We process identification and financial data required to issue invoices and transmit them through the e-Invoice system (ANAF), as well as to fulfil accounting obligations. Legal basis: Art. 6(1)(c) GDPR — legal obligation (Romanian Fiscal Code, Law no. 82/1991 on accounting).

Marketing and promotional communications

With your explicit consent (a separate opt-in checkbox), we may send newsletters and communications about new services, promotions or oral health tips. Legal basis: Art. 6(1)(a) GDPR — your consent. You may withdraw your consent at any time via the unsubscribe link in any email or by contacting the DPO.

Categories of recipients

Your data may be shared, strictly for the purposes stated, with the following categories of recipients: (a) CNAS/PIAS — for reimbursement of health-insurance-covered services; (b) Partner dental laboratory — for prosthetic work; (c) Accountant/accounting firm — for tax and accounting obligations; (d) ANAF via the e-Invoice system — for electronic invoice transmission; (e) Payment processor (Stripe / Netopia) — for online electronic transactions where applicable; (f) VPS hosting provider — the application server is hosted on our own infrastructure or that of a European Economic Area provider with appropriate DPA agreements. For site visitors, outside the medical relationship, the following are added: (g) Google Ireland Ltd. — the map embedded in the footer and on the Contact page receives your IP address when the page loads; (h) IP geolocation provider — only if visitor session tracking is enabled and the local database is not used. Details in the Cookie Policy.

Transfers of data outside the EU

Your data is processed exclusively within the European Economic Area (EEA). If we use sub-processors outside the EEA (e.g. auxiliary cloud services), they benefit from adequate safeguards (Adequacy Decision, Standard Contractual Clauses — SCCs) detailed in the Records of Processing Activities (ROPA) available on request to the DPO.

Data retention periods

Data is retained as follows: (a) Medical file — 30 years from the last consultation, per Ministry of Health Order no. 1410/2016; (b) Accounting documents and invoices — 10 years, per Art. 25(1) of Law no. 82/1991; (c) Marketing data — 12 months from the last interaction or until consent is withdrawn; (d) Activity logs — 12 months; (e) Marketing consent evidence — for the duration of the relationship and 3 years thereafter (legal proof). Upon expiry, data is deleted or anonymised.

Security measures (Art. 32 GDPR)

Health data is a special category of personal data (Art. 9 GDPR), so we apply technical and organisational measures proportionate to that risk:

• Encryption in transit (HTTPS/TLS) and encryption at rest for identification data (name, personal numeric code, contact details).
• Two-factor authentication (TOTP) for clinic staff accounts, together with account lockout after repeated failed sign-in attempts.
• Role-based access control — each member of staff only reaches the data their role requires.
• An audit log of every access to a medical record, retained and reviewable by the Data Protection Officer.
• Encrypted backups of the database and of stored files, with a documented restore procedure.
• A documented personal data breach procedure, including notification to ANSPDCP within 72 hours.

Rights of the data subject

Right of access (Art. 15 GDPR)

You have the right to obtain confirmation that we process data about you and a copy thereof, together with information about purposes, categories, recipients and retention periods.

Right to rectification (Art. 16 GDPR)

You have the right to request correction of inaccurate data or completion of incomplete data.

Right to erasure (Art. 17 GDPR)

You have the right to request erasure of your data. Please note that medical records and financial documents are subject to legal retention obligations and cannot be deleted before the statutory periods expire (see the Retention Periods section). In such cases we will proceed with anonymisation.

Right to restriction of processing (Art. 18 GDPR)

You have the right to request restriction of processing in the cases provided by GDPR (contesting accuracy, unlawful processing, exercising legal rights).

Right to data portability (Art. 20 GDPR)

You have the right to receive data you provided on the basis of a contract or consent in a structured, commonly used, machine-readable format.

Right to object (Art. 21 GDPR)

You have the right to object to the processing of your data for direct marketing purposes. You may unsubscribe at any time via the link in any email or by contacting the DPO.

Withdrawal of consent

Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

Right to lodge a complaint with ANSPDCP

You have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), located at 28-30 B-dul G-ral. Gheorghe Magheru, sector 1, Bucharest, website: www.dataprotection.ro.

DSAR procedure (data subject access request)

To exercise any of the above rights, send an email to dpo@dbg.ro with the subject 'DSAR — [request type]' and a copy of an identity document (front side). We will respond within 30 calendar days of receiving a complete request. In complex cases the deadline may be extended by a further 60 days, with prior notice to you.

Profiling and automated decision-making

We do not use profiling or automated decision-making that produces legal effects or similarly significant effects on data subjects (Art. 22 GDPR).

Cookies

Detailed information about the cookies used on this website, their categories, duration and how to manage your preferences can be found in the Cookie Policy. Cookie Policy.

Changes to this policy

Any significant change to this policy will be communicated by posting on the website at least 30 days before it takes effect or, if we hold your email address, by direct notification.