Privacy policy

Who is responsible

The controller of the personal data described here is [to confirm: registered name], operating as Elias Dental at Bulevardul Dimitrie Cantemir nr. 4, Bloc 3C, Scara B, ap. 38, Bucharest 040242, Romania, registered under [to confirm: CUI] and [to confirm: RUCM registration number].

Questions about this policy, and requests about your own data, go to the address at the foot of this page. The person responsible for them at the practice is [to confirm: named person for data protection].

This policy is about visiting the website. If you are a patient of the practice, the information held about your care is covered by the separate patient information notice, which is the document that matters for your health records.

What we collect, and only when you send it

This site collects nothing about you as you read it. There is no analytics, no advertising pixel, no session recording, no third-party script and no embedded map on any page. The treatment pages, the assessment questions and the results gallery all run without sending anything anywhere.

Information reaches us in exactly three ways, all of which you start:

The contact form

If you complete it, we receive your name and phone number, and, if you choose to fill them in, your email address, which treatment you are asking about, and whatever you write in the message field.

Two fields are required and the rest are optional, because two fields are enough to call you back. Please do not describe symptoms or medical history in the message field — an email is not a secure channel, and anything clinical is better said in the chair or over the phone.

WhatsApp

The contact page and the button in the corner of every page open a conversation in WhatsApp with a message already written. Once you send it, we see your WhatsApp display name, your phone number and whatever you write.

WhatsApp is operated by Meta Platforms Ireland Limited, not by us. Its handling of your message is governed by its own privacy policy, and we have no control over it. We use it because it is how most of our patients prefer to reach us, but if you would rather not use it, the phone number and the form are there instead.

Calling or emailing us directly

The number and address are published on the contact page. If you use them we hold whatever you tell us, for as long as described below.

Why we are allowed to hold it

• To answer you. Article 6(1)(b) and (f) of the GDPR — taking steps at your request before entering into a service relationship, and our legitimate interest in responding to someone who asked us a question. If you send us an enquiry, we will reply to it; that is the whole purpose and we do not use it for anything else.
• Non-essential storage on your device. Your consent, under article 4(5) of Legea nr. 506/2004. See the cookie policy.
• Records we are obliged to keep. Article 6(1)(c), where a law requires it — which applies to invoices and patient records rather than to website enquiries.

We do not use your information for marketing unless you have separately and specifically agreed to it, and we do not sell it, rent it, or share it for anyone else's advertising. There is no automated decision-making and no profiling.

The assessment questions on the home page send nothing. They run entirely in your browser, we never see your answers, and no result is recorded.

Who else sees it

• The company hosting this website, which unavoidably processes requests to serve pages: [to confirm: hosting provider].
• Resend, which delivers the contact form as an email to the practice, if that route is enabled. [to confirm: whether Resend's EU region is in use].
• Meta Platforms Ireland Limited, for messages you choose to send on WhatsApp.
• Professional advisers and authorities, where we are required to disclose something by law.

Each of these acts on our instructions under a written data processing agreement, except Meta, which is an independent controller of your WhatsApp messages.

Transfers outside the EU

The practice's intention is that data stays in the European Union, and processors are chosen on that basis. Where a processor is outside the EU or has parent companies that are, the transfer relies on the European Commission's standard contractual clauses or on an adequacy decision. [to confirm: final processor list and transfer basis for each].

How long we keep it

• Website enquiries, where they do not lead to an appointment: no longer than [to confirm: retention period for enquiries], then deleted.
• Enquiries that become appointments: the relevant information moves into your patient record and is then governed by the retention rules in the patient information notice.
• The record of your cookie choice: 180 days on your own device.

Your rights

Under the GDPR and Legea nr. 190/2018 you may ask us to:

• tell you what we hold about you, and give you a copy;
• correct anything inaccurate;
• delete it, where no law requires us to keep it — note that patient records and financial documents are subject to statutory retention periods and cannot be deleted on request while those periods run, which is explained in the patient information notice;
• restrict or object to what we are doing with it;
• receive it in a portable form, where we hold it on the basis of your consent or a contract;
• withdraw consent at any time, without affecting anything done before you did.

Write to the address at the foot of this page. We will reply within one month. We may first need to establish that you are who you say you are, which is a protection for you rather than an obstacle.

If you are not satisfied with our answer, you may complain to the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Bucharest, dataprotection.ro. You may also go to court.

Security

The site is served over HTTPS. The contact form is rate-limited and validated, and the practice's email is protected by [to confirm: account security measures in use]. No website is beyond risk, which is the reason the form asks for as little as it can get away with and asks you not to put clinical detail in it.

Changes

If this policy changes materially, the version and date shown at the top of the page change with it. Where the change affects what is stored on your device, you will be asked for consent again rather than assumed to have given it.