Patient information notice

Why this is a separate document

Information about your teeth, your general health and your treatment is special category data under article 9 of the GDPR. It is held to a higher standard than your phone number, and the rules on keeping it, sharing it and deleting it are different — strict enough that mixing the two into one policy would obscure both.

This notice is given to you here and on paper at your first appointment. It is the document that governs your record as a patient.

Who holds your record

[to confirm: registered name], operating as Elias Dental at Bulevardul Dimitrie Cantemir nr. 4, Bloc 3C, Scara B, ap. 38, Bucharest 040242, Romania. CUI [to confirm: CUI]. Registered with the Registrul Unic al Cabinetelor Medicale under [to confirm: RUCM registration number]. Dr. Khaled Mohammed is a member of the Colegiul Medicilor Stomatologi din România, [to confirm: CMSR membership number].

The person to contact about your record, or about anything in this notice, is [to confirm: named person for data protection], at the address at the foot of this page.

What is in your record

• Who you are: name, date of birth, address, phone number, email.
• Your health: the reason you came, your dental and relevant medical history, medication you take, allergies, and anything we need to know before giving an anaesthetic or prescribing.
• What we found and what we did: examination findings, tooth-by-tooth notes, intraoral scans, X-rays and photographs, treatment plans, the estimates you were given, consent you signed, and notes from every appointment.
• Appointments and money: when you came, when you did not, what you were invoiced and what you paid.

Your national identification number (CNP) is optional and we do not ask for it by default. ANAF has confirmed that an invoice to a private individual does not require it — a name and an address are enough. If there is ever a specific reason we need it, we will tell you what the reason is.

Why we are allowed to hold it

• To examine, diagnose and treat you. Article 9(2)(h) of the GDPR — processing necessary for the provision of health care by a health professional bound by an obligation of professional secrecy — read with article 6(1)(b).
• Because the law requires records to be kept. Article 6(1)(c) and article 9(2)(h), under Legea nr. 95/2006 on healthcare reform, Legea nr. 46/2003 on patients' rights, and the Ministry of Health orders on medical documentation.
• To invoice you and account for it. Article 6(1)(c), under the Fiscal Code and the accounting law.
• To defend a claim, if one is ever made. Article 9(2)(f).
• For photographs used outside your own record — on the website, or in teaching — your separate, specific, written consent, article 9(2)(a). This is a distinct consent from the one you give for treatment, it is never a condition of being treated, and you can withdraw it at any time.

Professional secrecy

Every member of the practice is bound by medical professional secrecy under Legea nr. 95/2006 and the Codul deontologic al medicului stomatolog. That obligation exists independently of data protection law, it applies to everything you tell us, and it does not end when your treatment does.

Who else may see it

• The dental laboratory that makes a crown, a veneer, a bridge or an aligner for you — the technical information needed to make it, and no more.
• A specialist or hospital we refer you to, with your knowledge.
• The practice's accountant, for invoices and payments only — never your clinical notes.
• Casa Națională de Asigurări de Sănătate, if and only if your treatment is claimed under a contract with it. [to confirm: whether the practice holds a CNAS contract].
• Your insurer, only where you ask us to and only what you authorise.
• A court, ANSPDCP, the CMSR or another authority, where we are legally obliged to produce it.
• The companies that run our software and store our files, under written data processing agreements. [to confirm: final processor list].

We do not sell your data, we do not share it for advertising, and we will not send you marketing unless you have separately asked for it. Appointment reminders are part of your care, not marketing, and refusing marketing does not stop them.

Where it is kept

Within the European Union. Systems and storage are chosen on that basis, and any processor outside the EU would require a transfer mechanism and a written justification. [to confirm: final hosting and storage locations].

How long we keep it

This is not yet settled and we will not guess at it. Public sources conflict: professional guidance points to five years for certain primary documents, while the archives legislation and Ministry of Health orders are read as requiring an outpatient record to be kept for up to thirty years.

[to confirm: clinical record retention period, to be resolved by the practice's lawyer]

Until it is resolved, the practice keeps records for the longest period any source supports, on the basis that keeping a record too long is a smaller wrong than destroying one a patient or a court later needs.

Financial documents are kept for five years from 1 July of the year following the financial year they belong to, under the accounting law as amended by Legea nr. 36/2023.

Your rights, and the one real limit on them

You may ask us to:

• show you your record and give you a copy, including your scans and X-rays;
• correct anything factually wrong in it;
• restrict or object to particular processing;
• give you a portable copy of what you provided to us;
• withdraw a consent you gave — for photographs, for marketing, for anything given on that basis — at any time.

Ask in writing at the address below. We will respond within one month, and we will need to establish your identity first.

Erasure

We usually cannot delete your clinical record on request, and we would be acting unlawfully if we did. Article 17(3)(b) and (c) of the GDPR withhold the right to erasure where processing is necessary for compliance with a legal obligation or for reasons of public interest in public health — and Romanian law obliges us to retain medical documentation for the periods above.

We would rather you learned this here than after asking. If you make a request we cannot grant, we will tell you so in writing, tell you which obligation prevents it, and tell you when the record will be destroyed. Anything held beyond a legal obligation — a marketing preference, a photograph consent — we will delete.

Your rights as a patient

Separately from data protection, Legea nr. 46/2003 gives you the right to be informed about your condition and the proposed treatment in terms you understand, to a second opinion, to refuse or stop treatment after being told what that means, and to have your privacy respected during examination and treatment. The deontological code also requires that you are told what treatment will cost before it begins — which is why every plan is quoted in writing in advance.

If you are not satisfied

Speak to us first; most things are a misunderstanding and are fixed in a conversation. If that does not resolve it, you may complain to:

• the Colegiul Medicilor Stomatologi din România, on professional conduct;
• the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, B-dul G-ral. Gheorghe Magheru 28-30, Bucharest, dataprotection.ro, on how your data was handled;
• the courts.