Privacy Policy
Publication date of this version:
Who processes your data
- Name
- SANTEKRON S.R.L.
- Legal form
- Societate cu răspundere limitată (S.R.L.)
- Registered office
- Str. Parcul Mic nr. 9, bl. 108, ap. 4, 500386 Brașov, jud. Brașov
- Trade Register number
- J2013000972086
- Tax identification code
- 31911133
- Place of business, where medical activity is carried out
- Bulevardul Alexandru Vlahuță nr. 51, Brașov, jud. Brașov
- Telephone
- 0268313645
- integris.brasov@gmail.com
We are the controller within the meaning of Regulation (EU) 2016/679 (GDPR) for all the processing described below: we decide why and how your data is used.
Data protection contact
For any question about your data, write to the address below, for the attention of the contact person indicated.
- Contact person
- Pruteanu Vasile
- integris.brasov@gmail.com
The clinic has not designated a data protection officer within the meaning of Article 37 GDPR.
What we process, why, and on what legal basis
Booking an appointment
When you book — online, by phone or at reception — we process your name and surname, telephone number, email address, the service and doctor you choose and, if you give them to us, your date of birth and the message you write.
Why: to reserve the slot, confirm your appointment and remind you of it.
Legal basis: performance of the contract for medical services — Article 6(1)(b) GDPR.
Date of birth is optional; we ask for it to tell you apart from another patient with the same name. Booking works the same without it.
Your medical record
Your history, diagnosis, treatment plan, procedures performed, prescriptions, referrals and radiological images (panoramic radiography, teleradiography, CBCT) form your medical record.
Why: to treat you, ensure continuity of care and meet our legal documentation obligations.
Legal basis: Article 9(2)(h) GDPR — preventive medicine, medical diagnosis and the provision of health care — read together with Article 6(1)(c) and with Romanian Law no. 95/2006 on healthcare reform and Order of the Ministry of Health no. 1410/2016.
This data is processed by medical staff bound by professional secrecy.
Your patient account on the website
If you create an account, we process your email address and password (stored solely as a cryptographic hash — we neither know it nor can read it).
Why: so you can see your appointments and contact details.
Legal basis: Article 6(1)(b) GDPR. The account is optional: you can book without one.
Appointment reminders and notices
We send you by email your booking confirmation, a reminder the day before and, where applicable, notice of a change.
Legal basis: Article 6(1)(b) GDPR — they are part of the service you requested. You can switch them off at any time, from your account or by asking at reception.
The clinic does not send text messages. All notifications go by email.
Commercial communications
Only if you have given your explicit consent may we send you information about new services or prevention programmes.
Legal basis: Article 6(1)(a) GDPR — consent.
You can withdraw it at any time, and withdrawing is as easy as giving it. Withdrawal does not affect the lawfulness of communications sent beforehand.
Internal patient classification
Administrative staff may mark a record with an internal interest label (“high / medium / low”), used for the clinic's internal reports on the number of returning patients.
Legal basis: the clinic's legitimate interest in knowing how many patients return — Article 6(1)(f) GDPR.
The label is set by a person, not calculated automatically, is not based on health data, and has no effect whatsoever on your treatment, your booking priority or your price. You have the right to object to this processing (Article 21 GDPR) and the right to find out which label your record carries (Article 15).
The contact form
Your name, telephone number, email address and the message you write.
Legal basis: Article 6(1)(f) — our legitimate interest in answering an enquiry.
Please do not describe symptoms or conditions in the contact form. For any medical problem, call us or book an appointment.
The waiting list
If you ask to be told when a slot frees up, we keep your name, contact details and the service you want until the offer is claimed or you withdraw the request.
Legal basis: Article 6(1)(b) GDPR.
The access log
The application records who consulted which record and when, including exceptional access, with the reason given in writing.
Why: so that we can prove your record was seen only by those entitled to see it.
Legal basis: the security obligation — Article 32 GDPR, read with Article 5(2).
The log cannot be altered and cannot be deleted, by the design of the database.
Cookies and the map
In short: we use only strictly necessary cookies, and the map embedded on the contact page loads only after you agree. Without your agreement, the page shows a static map served from our own server, which contacts no third party.
Full details are in our cookie policy.
We use no traffic analytics and we have no advertising tracking pixels.
How long we keep your data
| Category | Period |
|---|---|
| Medical record, including radiological images | See the explanation below |
| Appointments and their history | As long as the medical record is kept |
| Patient account | Until the account is deleted |
| Consent to commercial communications | Until withdrawn |
| Log of notifications sent | 1 year |
| Record of your cookie choice | 1 year |
| Conversations with the website assistant | 30 days |
| Sign-in attempts | 30 days |
The medical record. We cannot yet state a number of years, and Article 13(2)(a) GDPR allows us to give you the criteria instead: the record is kept for the period laid down in the clinic's archival schedule, approved by the Brașov County Service of the National Archives under Law no. 16/1996, and at least for as long as medical liability may be engaged for the act in question.
Deleting your account does not delete your medical record. These are two different things, and the reason is explained below, under the right to erasure.
Who we share data with
We do not sell data to anyone and we do not use it for third-party advertising.
Processors — suppliers who process data on our behalf, under contract and solely on our instructions:
| Who | What they do | Where the data is stored |
|---|---|---|
| Tudor Costin Consultanță | Develops and maintains the application; administers the server | Romania |
| Hetzner Online GmbH | Hosts the server, as a sub-processor of Tudor Costin Consultanță | Germany |
| Resend | Delivers the clinic's emails | United States of America |
The clinic's database — including medical records — is stored on servers in Germany, that is, within the European Union.
Transfer outside the European Union. The only processing that leaves the EU is email: it passes through Resend, a supplier established in the USA. The transfer concerns your name, email address and the content of the message (an appointment confirmation, the time and place) — never your medical record.
Safeguards for the transfer. The transfer to Resend is based on the standard contractual clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, incorporated into the data processing agreement concluded with Resend. In addition, Resend participates in the EU–U.S. Data Privacy Framework.
You may obtain a copy of the safeguards by writing to the contact address indicated above.
Other recipients, in specific situations: collaborating doctors involved in your treatment; the dental laboratory, for prosthetic work, which receives it identified by a code, without your name; public authorities, upon a legally founded request; where applicable, a lawyer or bailiff, for the recovery of a debt.
Invoicing is done internally, by clinic staff. We do not send invoices bearing patient names to any external accounting firm.
Your rights
You have the right of access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20), objection (Article 21), and to withdraw consent at any time where consent is the basis.
How to exercise them: write to the contact address indicated above or come to reception. We reply within 30 days. For a request for a copy of your medical record the period is 48 hours (Order of the Ministry of Health no. 1410/2016, Article 9(3)).
We charge no fee, except for manifestly unfounded or excessive requests, where the law allows us a reasonable charge.
The rights you have over your data and how to exercise them are described at length separately: data subject rights.
About the right to erasure
Your medical record cannot be erased on request while the retention period runs: we process it on the basis of a legal obligation and for the establishment or defence of legal claims, which triggers the exceptions in Article 17(3)(b) and (e) GDPR and Article 688 of Law no. 95/2006.
What we can do, at your request: delete your website account, stop all communications, and restrict processing (Article 18) — that is, keep the record without using it further, save where the law requires.
What disappears and what remains when an account is deleted
We take no automated decisions producing legal or similarly significant effects concerning you, and we carry out no automated profiling (Article 22).
If you are not satisfied
Please write to us first — most matters are resolved directly.
You always have the right, however, to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, 010336 Bucharest, anspdcp@dataprotection.ro, www.dataprotection.ro. You may also go to court.
Do you have to give us your data?
For booking and treatment: yes — your name and a means of contact are necessary, and without them we cannot book you. The data in your medical record is required by law.
Optional: date of birth, a website account, consent to commercial communications, and accepting non-essential cookies. Refusing them does not affect your access to care in any way.
How we protect your data
Access to records is limited by role, and every consultation is recorded. Traffic between browser and server is encrypted. Backups of the database are taken daily and verified by restoration. Paper documents are kept in locked spaces, accessible only to clinic staff.
Changes
If we amend this policy, we publish the new version on this page with the date of the update. For significant changes we also notify you by email, if we have your address.
This policy is published in Romanian and English. In the event of any discrepancy between the two versions, the Romanian version prevails.