Here you can find out what personal data we process when you visit the website www.exigentdentalclinic.ro or contact us, why we process it, how long we keep it and what rights you have, in accordance with Regulation (EU) 2016/679 (GDPR).

1. Who the data controller is
   The data controller is RUNOTY DENTAL CLINICS S.R.L., with its registered office in Bucharest, Sector 4, 129B Olteniței Street, tax ID (CUI) 51722236, registered with the Trade Register under no. J2025031150003, which operates Exigent Dental Clinic (Bucharest, Sector 6, 14A Timișoara Blvd.).
   For any question about your data, write to us at exigentdentalclinic@gmail.com or call us at 0731 528 207.

2. What this policy covers
   This policy applies to data processed through the website and through the messages you send us on the channels displayed on the website: phone, email, Facebook and Instagram.
   Data in your medical record, processed in the clinic as part of consultations and treatments, is covered by a separate notice, which you receive in the clinic.

3. Where we get the data from
   The data is provided directly by you when you call us, write to us or send us messages. For minor patients, the data is provided by the parent or legal guardian. When you visit the website, some technical data is collected automatically.

4. What data we process and why
   When you visit the website
   What data: IP address, browser and device type, pages visited, date and time of the visit.
   Why: for the operation and security of the website.
   Legal basis: our legitimate interest in having a secure and functional website (Art. 6(1)(f) GDPR). Non-essential cookies are used only with your consent (Art. 6(1)(a) GDPR), as described in the Cookie policy.
   How long: according to the periods described in the Cookie policy.
   When you call or write to us for an appointment
   What data: last name, first name, phone number, email, reason for the appointment and any other information you voluntarily provide.
   Why: to schedule and confirm the appointment.
   Legal basis: steps taken at your request before the medical service is provided (Art. 6(1)(b) GDPR).
   How long: 12 months from the last interaction, if you do not become a patient. If you become a patient, the data becomes part of your medical record.
   When you describe a health problem to us
   What data: information about your dental health (symptoms, conditions, previous treatments).
   Why: to assess urgency and prepare the consultation.
   Legal basis: processing necessary for the purpose of medical care (Art. 9(2)(h) GDPR).
   How long: 12 months from the last interaction, if you do not become a patient. If you become a patient, the information becomes part of your medical record.
   Please do not send us, by message, more detailed medical information than is needed for the appointment.
   When you send us a question or a complaint
   What data: name, contact details, content of the message.
   Why: to reply to you and resolve your request.
   Legal basis: our legitimate interest in responding to requests (Art. 6(1)(f) GDPR).
   How long: 12 months from the last interaction. Complaints are kept as long as needed to resolve them and then for the period during which legal claims may be made.
   When you interact with us on Facebook or Instagram
   What data: your name and profile picture, your messages, comments and reactions, as well as the public information in your profile.
   Why: to reply to messages and comments.
   Legal basis: our legitimate interest in communicating with those who contact us (Art. 6(1)(f) GDPR).
   How long: the data remains on Meta’s platforms, according to their policies. For our pages’ statistics, Meta Platforms Ireland Limited and the Clinic are joint controllers.

5. Children’s data
   The website is not directly aimed at minors. For minor patients, the data is provided by the parent or legal guardian, who also gives the necessary consents.

6. Who we share the data with
   We do not sell or rent your data. We share it only with providers who help us operate, under contract and only as far as necessary:
   Wix.com Ltd., the provider of the platform on which the website is hosted;
   Wix, through the Google Reviews app, which displays the clinic’s public Google reviews on the website;
   Google, for the Google Maps map displayed on the website and for the email service used by the clinic;
   Meta Platforms Ireland Limited, for messages received on Facebook and Instagram;
   public authorities, only when required by law.

7. Transfer of data outside the European Union
   Some of these providers may process data outside the European Economic Area. In these cases, the transfer is based on an adequacy decision of the European Commission or on the standard contractual clauses approved by the Commission.

8. Your rights
   You have the following rights:
   the right of access: to find out whether we process your data and to receive a free copy of it;
   the right to rectification: to request the correction of inaccurate or incomplete data;
   the right to erasure: to request the deletion of your data, except for data we are required by law to keep or data needed to defend a legal claim;
   the right to restriction: to request that processing be limited, for example while we verify the accuracy of the data;
   the right to data portability: to receive your data in a structured format and to request that it be sent to another controller;
   the right to object: to object to processing based on our legitimate interest;
   the right to withdraw your consent at any time, without affecting the processing carried out before the withdrawal;
   the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro.

9. How to exercise your rights
   Write to us at exigentdentalclinic@gmail.com. We will reply within one month of receiving your request. This period may be extended by two more months for complex requests, in which case we will let you know.
   We may ask for additional information to confirm your identity. If we cannot fulfill a request, for example because of a legal obligation, we will tell you why.

10. Data security
    We use technical and organizational measures to protect data against unauthorized access, loss or alteration. Only clinic staff who need the data for their work have access to it.
    If you suspect that your data has been compromised, please write to us immediately at exigentdentalclinic@gmail.com.
    After the retention period expires, the data is deleted or irreversibly anonymized.

11. Automated decisions
    We do not make decisions based solely on automated processing and we do not create visitor profiles.

12. Changes
    We may update this policy when new services are added to the website. The version in force is the one published here, with the date of the last update.