This policy explains what personal data we collect when you visit our website, send us an appointment request or become a patient of the clinic, why we use it, who we share it with, how long we keep it and what rights you have. We apply it in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and with the relevant Romanian legislation.
1. Who is responsible for your data
The data controller is Dental Protect SRL (trading as Light Dental Clinic), CUI (tax identification number) 12721957, Trade Register (Reg. Com.) number J2000001730401, with its registered office at Str. Luncșoara nr. 5, bl. 75, sc. A, et. P, ap. 1, Sector 2, București, and its place of business (the clinic) at Strada Roma nr. 28, Sector 1, București, 011774. For any question about your personal data, you can email us at contactlightdentalclinic.ro, call us on 0772 022 100 or send a letter to the clinic's address.
2. The principles we follow
- we process your data lawfully, fairly and transparently;
- we collect only the data we need for a specific purpose and do not use it for any other purpose incompatible with that one;
- we keep data accurate and up to date, and correct it without delay when you tell us about a change;
- we keep it only for as long as necessary or for as long as the law requires;
- we protect it with appropriate technical and organisational measures, and only the people who need it for their work have access to it.
3. What data we process
3.1. When you visit the website
Our server automatically records technical data: IP address, date and time of access, the page visited, and browser and device type. We use this data to run the website and keep it secure (for example, to block attack attempts). If you accept statistics cookies, data about how you use the website is also collected (details in our Cookie policy).
3.2. When you send us an appointment request
Through the booking form you send us your name, phone number, preferred day and time and, if you wish, a few words about your dental problem. This last field is optional and may contain health data; you fill it in only if you agree to this. We also record the language in which you used the website and the IP address from which the request was sent, to prevent abuse.
3.3. When you become our patient
For consultations and treatment we process: identification and contact data (surname, first name, date of birth, Romanian personal numeric code (CNP) where required for medical or tax documents, address, phone, email), health data (medical and dental history, allergies, previous treatments, dental chart, photographs and diagnostic images, treatment plan, signed consent forms) and payment and invoicing data. For patients who are minors, the data is provided by a parent or legal representative.
3.4. When you contact us
Through the contact form on the website you send us your name, an email address or a phone number where we can reply, and your message. We also record the language of the page and the IP address from which the message was sent, to prevent abuse. If you call us, email us or write to us on social media, we process the data you send us in your message in order to reply to you.
4. Why we use your data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Replying to your appointment request, confirming it by phone, reserving the time slot | steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR); for any health details written in the form, your consent (Art. 9(2)(a)) |
| Replying to messages sent through the contact form | our legitimate interest in answering the questions we receive (Art. 6(1)(f)) or, where the question concerns an appointment or a treatment, steps taken at your request prior to entering into a contract (Art. 6(1)(b)); for any health details written in the message, your consent (Art. 9(2)(a)) |
| Consultation, diagnosis, treatment and keeping your medical records | the contract for medical services (Art. 6(1)(b)), the legal obligations of a healthcare provider (Art. 6(1)(c)) and processing for the purposes of diagnosis and treatment by medical staff bound by professional secrecy (Art. 9(2)(h)) |
| SMS messages and calls to confirm appointments or remind you of them | performance of the contract and our legitimate interest in reducing missed appointments (Art. 6(1)(b) and (f)) |
| Invoicing, accounting and tax records | legal obligations (Art. 6(1)(c)) |
| Security of the website and IT systems, prevention of abuse | our legitimate interest in protecting patient data and our services (Art. 6(1)(f)) |
| Website visit statistics | the consent you give through the cookie banner (Art. 6(1)(a)), which you can withdraw at any time |
| Establishing, exercising or defending legal claims in court | legitimate interest (Art. 6(1)(f) and Art. 9(2)(f)) |
We do not use your data for marketing without your separate consent, we do not sell it, and we do not carry out profiling that produces legal effects concerning you.
5. Who we share your data with
Your data is accessible to the clinic's doctors and staff, strictly to the extent that they need it. We share it outside the clinic only when necessary, with:
- IT service providers that host the website, the clinic's email and its appointment system, under contracts that bind them to confidentiality and security;
- the SMS service provider, which receives only your phone number and the text of the confirmation or reminder message;
- the dental laboratory, which receives only the data strictly needed to make a restoration (for example, your name and the impression for a crown);
- other doctors or healthcare facilities, at your request or when needed for your treatment (for example, for an X-ray);
- accountants, legal advisers, banks and payment processors, to the extent necessary;
- public authorities, when the law requires us to.
All these recipients are bound by contract or by law to keep the data confidential.
6. Transfers outside the European Economic Area
The map on the website is provided by Google, and visit statistics (only with your consent) by Google Analytics. Google LLC may process some technical data in the United States; the transfer is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework. Medical data is not sent to Google.
7. How long we keep your data
- appointment requests that do not lead to a consultation: 12 months from submission, then deleted;
- messages sent through the contact form: 12 months from submission, then deleted automatically;
- medical records and medical documents: for the period required by the legislation on medical records and by professional rules, then securely destroyed;
- financial and accounting documents: for the period required by financial and accounting legislation;
- technical server logs: no more than 6 months, unless they are needed to investigate an incident;
- statistical data in Google Analytics: no more than 14 months.
8. Your rights
You have the right of access to your data, the right to rectification, to erasure, to restriction of processing, to data portability and to object, the right not to be subject to a decision based solely on automated processing, and the right to withdraw your consent at any time. How to exercise these rights, and the limits of each one, are explained on the Your rights (GDPR) page. You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (www.dataprotection.ro).
9. How we protect your data
The website uses an encrypted connection (HTTPS). The appointment system and patient records are accessible only to clinic staff, each with an individual account and password, and all access is logged. We make regular backups, which are stored securely. Our forms are protected against automated submissions. Our staff are trained and bound by confidentiality and medical secrecy.
10. Children's data
For patients under 16, appointments are made and consent to treatment is given by a parent or legal representative. We do not knowingly collect data directly from children through the website.
11. Changes
We may update this policy when our services or the law change. The version in force is always the one published on this page, with the date of the last update.