Your rights over your personal data
Publication date of this version:
The privacy policy says what we process. This page says how you ask for something and what happens next.
What you can ask for
| Right | What it means in practice |
|---|---|
| Access (Art. 15) | To find out what data we hold about you and receive a copy |
| Rectification (Art. 16) | To correct wrong data or complete incomplete data |
| Erasure (Art. 17) | To delete data — with the limits below for the medical record |
| Restriction (Art. 18) | To keep the data but stop using it |
| Portability (Art. 20) | To receive your data in a machine-readable format |
| Objection (Art. 21) | To object to processing based on our legitimate interest |
| Withdrawing consent | At any time, where consent is the basis |
How to make a request
Write to the email address below or come to reception. There is no mandatory form and you do not need to cite an article of the Regulation — simply tell us what you want.
It helps if you tell us: which data you are interested in (all of it, or just part — appointments, medical record, communications), for what period, and how you want the reply (by email, on paper at reception).
- Contact person
- Pruteanu Vasile
- Email for requests concerning personal data
- integris.brasov@gmail.com
How we verify your identity
This is not a formality: your record contains health data, and sending it to the wrong person would do irreparable harm. Therefore:
- if you write from the email address we already hold in your file, that is enough for ordinary requests;
- if you write from another address, or you ask for a copy of your medical record, please collect the reply in person at reception, with your identity document — or suggest another secure route;
- we do not ask you to email a copy of your ID, and we do not ask for additional data we do not need.
For a request made through a representative, please present the representative's identity document and the written power of attorney or the document proving their capacity as legal representative. For a minor, the request is made by a parent or guardian, with proof of that capacity.
How long we take
30 days from receipt, for any GDPR request (Article 12(3)). If the request is complex, the period may be extended by two months, but we tell you within the first 30 days and explain why.
48 hours for a request for a copy of your medical record — a shorter, special period laid down in Order of the Ministry of Health no. 1410/2016, Article 9(3).
We charge no fee. Only where a request is manifestly unfounded or excessive — for example repeated without reason — does the law allow us a reasonable charge, or refusal, which we explain to you.
What we cannot delete, and why
The medical record is not erased on request while the legal retention period runs.
The reason is not our convenience: we process it under a legal obligation and we may need it for the establishment or defence of legal claims — situations in which Article 17(3)(b) and (e) GDPR expressly exclude the right to erasure. Law no. 95/2006 and the rules on medical documentation require retention, and Article 688 of that Law concerns defence against an allegation of malpractice, which can arise years later. A deleted record would leave both the patient and the doctor without evidence.
What we can do instead, if you ask:
- delete your website account — email, password, sessions. The record stays, the account does not;
- stop all communications — reminders, notices, anything;
- restrict processing (Article 18): keep the record without using it for anything beyond what the law requires.
There is a dedicated page for deleting your account, which shows you point by point what disappears and what remains, before you press anything.
Automated decisions
We take no automated decisions producing legal effects concerning you or similarly significantly affecting you (Article 22). No appointment, no price and no clinical decision is determined by an algorithm.
We use an internal commercial-interest label, set by a person, for the clinic's internal reports on the number of returning patients. It does not affect treatment, booking priority or price, and you may object to its use. Details are in our privacy policy.
If you are not satisfied with our reply
Tell us — often it is a misunderstanding cleared up in an exchange of messages.
You always have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing: B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, 010336 Bucharest, anspdcp@dataprotection.ro, www.dataprotection.ro. You may also go to court.
Contact
The clinic has not designated a data protection officer within the meaning of Article 37 GDPR.
This page is published in Romanian and English. In the event of any discrepancy between the two versions, the Romanian version prevails.