Privacy Policy

In this Privacy Policy I explain how the personal data of people who visit the website, and of those who contact me through the channels presented on it, is processed. You will also find your rights set out here. The processing is carried out in accordance with Regulation (EU) 2016/679 (GDPR), with Legea nr. 190/2018 (Romania's national law implementing the GDPR) and with Legea nr. 506/2004 (the Romanian law on the processing of personal data in the electronic communications sector).

I recommend that you read this document carefully. If anything is unclear, you can write to me using the contact details below.

This website is published by Dr. Ana-Maria Spiridon, dentist, a member of the Colegiul Medicilor Stomatologi din România (the Romanian College of Dentists). For the processing relating to this website and to the contact channels presented on it (the data entered in the message composer, the data submitted through the contact form and the call-back request, telephone calls, correspondence by e-mail and through the messaging channels, cookies and the virtual assistant), the data controller is Dr. Ana-Maria Spiridon.

I carry out my clinical work as a collaborating dentist at several medical practices in Bucharest. The provider of the medical services presented on this website is the medical practice where the consultation or treatment takes place. Consultations and treatments are provided within it, and the medical practice is the data controller for the patient's medical record and for the medical documentation drawn up in the course of treatment.

If a request received by telephone or by message leads to an appointment, I pass on the data needed to organise the consultation to the medical practice where the consultation takes place, that is, to the provider at which the treatment is given. From the moment the medical record is opened, the medical practice is the controller for the data it contains and applies its own data protection notices and procedures.

You can contact me as follows:

• E-mail: office@dranamariaspiridon.com

• Telephone: by calling the telephone number published on the website

• Messaging: Facebook Messenger and Instagram Direct, through the buttons available on the website

• City where the services are provided: Bucharest

If you have a question or a request about the processing of your data and the exercise of the rights provided by the GDPR, you can write to me at the e-mail address above, marking your message “Data protection”. Please do not include detailed health data in the messages you send me through the messaging channels.

I have not appointed a Data Protection Officer (DPO). The processing described in this policy is not carried out by a public authority or body. It does not involve regular and systematic monitoring of data subjects on a large scale, and its core activity is not the large-scale processing of special categories of data. The conditions laid down in Art. 37(1) GDPR for the mandatory appointment of a DPO are therefore not met. For any data protection matter, the contact point remains the e-mail address indicated above.

The website does not ask you for your personal numerical code (CNP). Where the personal numerical code has to be processed in order to draw up medical or fiscal documents, this processing is carried out by the medical practice where the consultation or treatment takes place, in accordance with the legal obligations that apply to it.

Depending on how you interact with the website, the following categories of data may be processed:

• Identification and contact data: the name you choose to enter in the message composer, as well as the details you give me directly, by telephone, by e-mail or through the messaging channels. When you call me or write to me through the messaging channels, I receive, as applicable, your telephone number or the name shown in your profile, as part of the call or the message. On the website, you are asked for your e-mail address and telephone number only in the contact form, and for your telephone number also in the call-back request. Both are described below.

• Data submitted through the contact form: your name, e-mail address, telephone number, the reason for your enquiry and your message, as well as, optionally, how you heard about me. The name, e-mail address, telephone number, reason and message you enter in the contact form are sent to me by e-mail, through the Brevo service, only so that I can reply to you. If you fill in the optional item, it is sent to me in the same e-mail. After you submit the form, you receive an automatic confirmation e-mail at the address you gave, also sent through Brevo. The reason and the message may reveal a health concern. The website does not keep a copy of this data on its server. The data is kept as set out in section 7.

• Data submitted through the call-back request (“Would you prefer me to call you?”): your telephone number and, optionally, your name and the part of the day when you would prefer me to call. These details are sent to me by e-mail, through the Brevo service, and I use them only to call you back. The request does not generate a confirmation e-mail, because it does not ask for your e-mail address. The website does not keep a copy of these details. They are kept as set out in section 7. The call-back request is currently available only on the Romanian pages of this website.

• Data entered in the message composer (available on the home page, on the services page, on each service's own page and in the virtual assistant): the options you choose from the predefined lists (the reason, how long it has lasted, the intensity, the services that interest you, or that service's own questions), the answers you write to the virtual assistant's questions, and the name and free text you choose to add. The reason selected or described may, by its nature, reveal a health concern. The text of the message is drafted automatically, with the help of the Amazon Bedrock service (see section 5). The composer does not ask you for a preferred appointment slot, does not send the message itself and does not store it. The composed text is shown on your screen and copied to the clipboard, so that you can paste it and send it yourself, if you wish, through Facebook Messenger or Instagram Direct. The Messenger and Instagram buttons on the website only open the conversation, without passing on the text of the message. The message reaches me only after you send it yourself.

• Health data, a special category of data (Art. 9 GDPR): the information about your oral health that you choose to share by telephone or through the online channels. The clinical documentation itself consists of the medical history, diagnoses, dental treatment plans and records (crowns, bridges, veneers, implants, dentures), dental X-rays (including orthopantomography, cephalometric radiography, 3D CBCT), clinical images, allergies and relevant previous conditions. It is drawn up and kept by the medical practice where the consultation or treatment takes place, in the patient's medical record.

• Data from correspondence and calls: the messages exchanged by e-mail or through the messaging channels and, for telephone calls, the telephone number, the date and time of the call and the information you give me during the conversation.

• Data from your interaction with the virtual assistant (chatbot): the content of the conversation and the questions you ask.

• Technical and website usage data: IP address, device and browser identifiers, the pages accessed, the date and time of access, as well as the data collected through cookies and similar technologies (including Google Analytics 4), under the conditions described in the Cookie Policy and only on the basis of your consent.

• Data from public reviews: the displayed name and the content of the review you have published on Facebook, copied by hand from the Facebook page and entered into the website as such.

Through the online channels, I do not ask for, and do not wish to receive, more data than is necessary for the specific purpose of the interaction.

I process your data only for specific purposes and on the basis of a legal ground provided by the GDPR:

• Composing, at your request, the text you then send yourself through Facebook Messenger or Instagram Direct, and handling the requests received by telephone, by e-mail or through the messaging channels. Legal basis: taking steps at your request prior to entering into a contract [Art. 6(1)(b) GDPR] and, where applicable, the legitimate interest in responding to you and communicating effectively [Art. 6(1)(f) GDPR].

• Replying to messages sent through the contact form, and making the call requested through the call-back request. Legal basis: your explicit consent, given by ticking the box in the form [Art. 6(1)(a) and Art. 9(2)(a) GDPR]. You can withdraw it at any time by writing to me at the e-mail address indicated in section 1. Withdrawal does not affect the lawfulness of the processing carried out beforehand.

• Handling appointment requests received by telephone or through the messaging channels, and passing the data needed to organise the consultation to the medical practice where it takes place. Legal basis: pre-contractual steps at your request [Art. 6(1)(b) GDPR].

• Dental medicine services are provided and the medical documentation is drawn up within the medical practice where the consultation or treatment takes place, which acts as the provider. You will find the specific legal bases for health data explained in the next section.

• Complying with legal obligations (for example, keeping the correspondence needed to resolve a complaint, or responding to requests from the competent authorities). Legal basis: the legal obligation [Art. 6(1)(c) GDPR].

• Cookies and tools for analytics and ad measurement (Google Analytics 4 and Google Ads). The Google Ads tag is configured on the website. It sends to Google the clicks on the Call and AI Assistant buttons, as well as the submission of the call-back request, to measure the effectiveness of the ads. It is not used for personalised advertising. Legal basis for the analytics and advertising cookies: your consent [Art. 6(1)(a) GDPR], which you can give or refuse in the cookie banner and withdraw at any time. Without this consent, the clicks and the submission of the call-back request are sent without advertising cookies, through the Google Consent Mode mechanism (see the Cookie Policy).

• Ensuring the security of the website and of the systems, preventing abuse and diagnosing technical problems. Legal basis: the legitimate interest in maintaining a secure and functional online environment [Art. 6(1)(f) GDPR].

• Establishing, exercising or defending a legal claim in court. Legal basis: the legitimate interest [Art. 6(1)(f) GDPR] or the legal obligation [Art. 6(1)(c) GDPR].

Health data enjoys special protection and is processed as follows:

• Within dental care (consultation, diagnosis, dental treatment plan, monitoring), the processing is necessary for the purposes of preventive medicine, establishing a diagnosis and providing dental medical care, under Art. 9(2)(h) read together with Art. 9(3) GDPR. This data is processed within the medical practice where the consultation or treatment takes place, by the treating doctor and the staff of that practice. They are bound by the legal obligation of professional secrecy, in accordance with Legea nr. 46/2003 (the Romanian Patients' Rights Law) and with the Codul deontologic al medicului stomatolog (the Dentists' Code of Professional Conduct).

• If you choose, on your own initiative, to share information about your health with me by telephone or online (through the message composer, by e-mail, through messaging or through the virtual assistant), I process it strictly in order to contact you and act on your request, under Art. 9(2)(h) read together with Art. 9(3) GDPR and the legitimate interest in responding to you [Art. 6(1)(f) GDPR].

• Health data arising from the contact form or the call-back request (the reason, the message, or even the fact that you are asking me to call you) is processed so that I can reply to you or, for a call-back request, call you back, on the basis of your explicit consent, given by ticking the box in the form [Art. 9(2)(a) GDPR]. The fact that you have submitted a call-back request is also sent to Google through the Google Ads tag, to measure the effectiveness of the ads (see section 3). Your telephone number, your name and the other details entered in the request are not sent to Google.

Professional medical secrecy and the obligation of confidentiality are not limited in time and remain in force even after the relationship with the patient has ended. Please do not send detailed health data (diagnoses, conditions, clinical images) through the message composer, through the contact form, by e-mail, through messaging or through the virtual assistant. A few words about the reason you are writing are enough to draft a message, and we can discuss the details safely at a consultation.

I do not sell your data. It may be disclosed or made accessible to the following categories of recipients, strictly to the extent necessary:

• The medical practice where the consultation or treatment takes place: the provider at which consultations and treatments are given. I share with it the data needed to organise the appointment and to carry out the medical procedure, and the medical practice processes this data as a controller in its own right.

• The web hosting and infrastructure provider: Amazon Web Services (AWS), through the AWS Amplify and Amazon S3 services, which host the website and securely keep the proof of your cookie options, together with usage counters that contain no personal data. The data entered in the message composer is not stored.

• Amazon Web Services (Amazon Bedrock): for the operation of the virtual assistant (chatbot) and of the message composer. The service processes the content of the conversations, to generate the assistant's response, and the data entered in the composer, to draft the text of the message. It is used in a European Union region.

• Google: for statistical analysis (Google Analytics 4), only with your consent. The Google Ads tag is configured on the website. It sends to Google the clicks on the Call and AI Assistant buttons, as well as the submission of the call-back request, to measure the effectiveness of the ads. It is not used for personalised advertising. Advertising cookies are placed only with your consent, as set out in the Cookie Policy.

• Meta Platforms (Facebook Messenger, Instagram): when you choose to write to me through Facebook Messenger or through Instagram Direct, the messages are transmitted to and stored on Meta's infrastructure, in accordance with its own policies. The same happens with a message drafted with the message composer, when you paste it and send it through one of these apps. For the messages sent through these platforms, the platform provider acts as an independent controller.

• Brevo: the e-mail sending service through which the details you enter in the contact form and in the call-back request reach me. The contact form's automatic confirmation e-mail is also sent to you through Brevo.

• Amazon Web Services (Amazon WorkMail): the service that hosts the mailbox receiving the messages sent to the e-mail address indicated in section 1. The mailbox is located in an AWS region in the European Union (Ireland), and the service is provided on the basis of contractual confidentiality and security safeguards.

• Public authorities, courts or other bodies, when there is a legal obligation to that effect.

When these providers process data on my behalf, they act as processors and are bound by data processing agreements concluded in accordance with Art. 28 GDPR. The medical practice where the consultation or treatment takes place, Google and Meta Platforms act as controllers for their own processing, in accordance with their own notices.

Some of the providers I use (in particular Google and Meta Platforms and, where applicable, AWS) may process data on servers located outside the European Economic Area, including in the United States of America.

When such transfers take place, I make sure that they are protected by appropriate safeguards within the meaning of the GDPR, namely the Standard Contractual Clauses adopted by the European Commission [Art. 46(2)(c) GDPR] and/or the provider's certification under the EU-U.S. Data Privacy Framework. You have the right to obtain information about the safeguards applied by writing to me at the e-mail address indicated in section 1.

Data is kept only for as long as is necessary for the purposes for which it was collected or to comply with legal obligations. The main situations are as follows:

• The patient's medical record and the dental medical documentation: are drawn up, kept and archived by the medical practice where the consultation or treatment takes place, within the time limits laid down by the legislation applicable to healthcare providers and by the professional regulations. Requests concerning these documents should be addressed to that medical practice.

• The financial and accounting documents relating to the dental services (invoices and supporting documents): are issued and kept by the medical practice where the consultation or treatment takes place, within the time limits laid down by Legea contabilității nr. 82/1991 (the Romanian Accounting Law).

• Requests received by telephone, by e-mail (including through the contact form and the call-back request) or through the messaging channels, and the related correspondence: for as long as is needed to resolve them and, after that, for a proportionate period, as a rule up to 24 months, except where they are needed to defend a legal claim or to fulfil a legal obligation.

• The data entered in the message composer: is not stored. It is used solely to compose the text of the message and is not kept after the visit ends. If you choose to send the message, it remains in your Messenger or Instagram conversation and is subject to the rules on correspondence set out above.

• Appointment requests received through these channels: for as long as the request is being handled. The data needed for treatment is entered in the medical record kept by the medical practice where the consultation or treatment takes place.

• Conversations with the virtual assistant: short periods, proportionate to the purpose of operating the service and preventing abuse.

• Technical logs and security data: short periods, proportionate to the security and technical diagnostic purpose.

• Data processed on the basis of consent (for example, analytics cookies): until consent is withdrawn or until the cookie's lifespan expires.

When these periods expire, the data is securely deleted or anonymised.

As a data subject, you have the following rights under the GDPR:

• The right of access (Art. 15): to obtain confirmation that your data is being processed and a copy of it.

• The right to rectification (Art. 16): to correct inaccurate data or to complete incomplete data.

• The right to erasure, the “right to be forgotten” (Art. 17): to obtain the erasure of the data under certain conditions. This right is not absolute and does not apply where processing is necessary to comply with a legal obligation. For example, the documents in the medical record cannot be erased before the legal retention periods applicable to the provider have expired.

• The right to restriction of processing (Art. 18).

• The right to data portability (Art. 20), for data processed by automated means, on the basis of consent or a contract.

• The right to object (Art. 21): to object to processing based on the legitimate interest, for reasons relating to your particular situation.

• The right to withdraw consent at any time [Art. 7(3) GDPR], where processing is based on consent. Withdrawal does not affect the lawfulness of the processing carried out beforehand.

• The right to lodge a complaint with the supervisory authority (see the ANSPDCP section).

To exercise your rights regarding the processing described in this policy, you can write to me at the e-mail address indicated in section 1. For rights concerning the medical record and the clinical documentation, the request should be addressed to the medical practice where the consultation or treatment took place, because it is the controller for that data. As a rule, a reply is given within one month of receipt of the request.

Even if you request the erasure of the data, object to the processing (Art. 21 GDPR) or request its restriction (Art. 18 GDPR), the data and the related documents may continue to be kept and processed, to the extent necessary for the establishment, exercise or defence of a legal claim in court [Art. 17(3)(e), Art. 18(2) and Art. 21(1) GDPR]. This concerns both the correspondence kept in connection with the website and the medical documents held at the medical practice where the consultation or treatment took place, for the duration of the applicable limitation periods and of the legal archiving periods.

Patient reviews (the displayed name and the content of the review) that you have published on the Facebook page are shown on the website. These reviews are copied by hand and entered into the website as such. The website does not connect to Facebook and does not retrieve reviews automatically. Their display on the website is based on the legitimate interest in presenting genuine opinions [Art. 6(1)(f) GDPR]. You can object to their display by writing to me at the e-mail address indicated in section 1.

No internally generated rating or average score is published or used, and no reviews or scores are fabricated.

Clinical photographs (including “before/after” images used for educational or illustrative purposes), dental X-rays and records made for the purpose of dental diagnosis and treatment form part of the patient's medical record. They are kept by the medical practice where the consultation or treatment takes place and processed under Art. 9(2)(h) GDPR (healthcare).

An image may be used for educational purposes or for public presentation only with the explicit, prior and written consent of the person concerned and, in the case of minors, of the parent or legal guardian. Withdrawing consent stops the public educational or presentational use, but does not affect the retention of the clinical documents in the medical record.

Identifiable clinical images of minors are not published in the absence of the consents mentioned above.

I apply appropriate technical and organisational measures to protect the data against unauthorised access, loss, destruction or disclosure [Art. 32 GDPR]. In practice, these are access control, encryption in transit, access restriction on a need-to-know basis and internal confidentiality procedures.

In the event of a security breach involving personal data that is likely to result in a risk to your rights and freedoms, I will notify the ANSPDCP within 72 hours of becoming aware of it [Art. 33 GDPR]. Where the breach is likely to result in a high risk, I will also inform you, without undue delay [Art. 34 GDPR]. Incidents concerning the medical record or the systems of the medical practice where the consultation or treatment takes place are handled by that medical practice, under the same legal conditions.

The virtual assistant (chatbot) available on the website gives automated answers to questions of a general nature (information about services, indicative fees and the ways of getting in touch). The answers are formulated solely on the basis of the website's public content, and the assistant has an exclusively informational role. Please note that you are interacting with an automated system, not with a natural person. The virtual assistant is not intended for emergencies. In an emergency, call 112.

No decision that would produce legal or medical effects concerning you is taken on the basis of automated processing alone [Art. 22 GDPR]. The virtual assistant does not make diagnoses and does not establish dental treatment plans. Any treatment plan is established by Dr. Ana-Maria Spiridon, after a consultation, at the medical practice where the consultation takes place. The surgical steps are performed by collaborating surgeons and are planned together with them. I recommend that you do not enter sensitive data, including detailed health data, into the conversation. If you use the virtual assistant to draft a message, the reason you describe is information about your health. It is used only to draft the message, which you send yourself, and if you would rather not go into detail, a few words are enough.

The website and the online channels presented on it are not intended for direct use by minors without the involvement of a parent or legal guardian. Dental services provided to minors are discussed and consented to with the parents or legal guardians, in accordance with Legea nr. 46/2003.

If you are a parent or legal guardian and consider that a minor has submitted data without your consent, please contact me so that the necessary measures can be taken.

If you consider that the processing of your data infringes data protection legislation, you have the right to lodge a complaint with the supervisory authority:

The National Supervisory Authority for the Processing of Personal Data (ANSPDCP)

• Address: B-dul G-ral Gheorghe Magheru nr. 28-30, Sector 1, postal code 010336, București, Romania

• E-mail: anspdcp@dataprotection.ro

• Website: www.dataprotection.ro

However, please contact me first, as I will try to resolve any grievance directly.

Besides the rights provided by the GDPR, you also have the specific patient rights regulated by Legea nr. 46/2003. All information concerning your health status, diagnosis, treatment and personal data is confidential (Art. 21). This information may be disclosed to other persons only with your explicit consent or where the law expressly requires it (Art. 22). Finally, you have the right of access to your personal medical data (Art. 24).