Personal data processing information

Data controller

CMI Dr. Curteanu Simona, individual dental practice, address: Str. Constantin Noica nr. 26, Oradea, Bihor County, Romania, tax ID (CUI) 21426212.

Data protection contact: webmaster@drcurteanu.ro, phone +40 766 340 870.

Data Protection Officer (DPO): appointing a DPO is mandatory only in the cases set out in Art. 37 GDPR. Contact: webmaster@drcurteanu.ro.

Categories of data and sources

We process two distinct data flows, under different regimes:

• Data collected through the website (appointment form): name, phone, optionally email, preferred date, service of interest and the free-text message you choose to write. Source: directly from you.
• Data collected at the practice, as part of dental care: identification data and health data, under the applicable medical regulations. This is not collected through the website.
• Minimal technical data generated by hosting (server logs), needed to operate and secure the site.

Purposes and legal bases

• Appointments and communication with requesters — Art. 6(1)(b) GDPR (steps at the data subject's request) and, for optional fields, (a) (consent).
• Providing dental services and keeping medical documentation — Art. 6(1)(c) and Art. 9(2)(h) GDPR, together with the applicable medical legislation.
• Website preferences (language) and loading the map — Art. 6(1)(a) GDPR (consent), given through the cookie banner.
• Website security and abuse prevention (anti-spam that collects no additional personal data) — Art. 6(1)(f) GDPR (legitimate interest).
• Compliance with legal obligations (e.g. tax or reporting) — Art. 6(1)(c) GDPR.

Health data

Health data is a special category of personal data and receives additional protection. The website does not request such data: the form has no fields for diagnosis, medical history, medication, X-rays or photographs.

If you nevertheless write medical information in the message field, it is treated confidentially, used only to answer you, and minimised. Please avoid this and let us discuss clinical details at the practice.

Medical staff are bound by medical professional secrecy under the applicable Romanian legislation.

Recipients and processors

Data submitted through the site is accessible only to practice staff and to the following providers acting as processors:

• The hosting and site delivery provider (cloud infrastructure), for running the website and technical logs.
• The transactional email provider, through which the form notification reaches the practice's address.
• Google Ireland Limited, only if you choose to load the embedded map; in that case Google acts as an independent controller for data collected through its service.
• Public authorities, where there is a legal obligation to disclose.

International transfers

The infrastructure used may involve processing outside the European Economic Area. In such cases, the transfer is carried out based on the safeguards provided by Chapter V GDPR (typically standard contractual clauses). The up-to-date list of providers and applicable safeguards can be requested at webmaster@drcurteanu.ro.

Retention periods

Requests received through the site: kept as long as needed to handle them and to record the communication, then deleted.

Medical documentation: kept for the period required by the applicable medical regulations. Exact periods follow the legislation and the practice's procedures.

Cookie preferences: up to 12 months, or until consent is withdrawn.

Automated decision-making and profiling

We do not take decisions based solely on automated processing and we do not carry out profiling. The site contains no behavioural analytics or behavioural advertising tools.

Your rights and how to exercise them

You may request access, rectification, erasure, restriction of processing, portability, object to processing based on legitimate interest, and withdraw consent at any time without affecting the lawfulness of prior processing.

Send your request to webmaster@drcurteanu.ro or submit it at the practice. We reply within one month, extendable by two months for complex requests, in which case we inform you.

Some rights may be limited — for example erasure does not apply to medical documentation the practice is legally required to keep.

You have the right to lodge a complaint with the Romanian supervisory authority (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Bucharest, www.dataprotection.ro, and to seek a judicial remedy.