Privacy Policy

Last update: July 2025

SmileCity (“we”, “us”, “the clinic”, "we are") is committed to protecting the confidentiality and integrity of the personal data you entrust to us. We strive to comply with all relevant regulations, including GDPR (EU Regulation 2016/679) and applicable national laws.

1. The data we collect

• Identification and contact: name, surname, date of birth, telephone, e-mail address, postal address.

• Medical data: medical and dental history, diagnoses, treatments, X-rays, clinical photographs.

• Financial data: details of invoices, payments, payment plans.

• Online browsing data: IP, browser type, pages viewed, cookies (according to Cookies Policy).

2. Purposes of data processing

• Provision of dental services (diagnosis, treatment, follow-up).

• Scheduling visits and communicating with patients.

• Radiology performed on site - storage in medical record.

• Issuing tax documents.

• Service improvement and communication with patients (with consent only).

3. Legal basis for processing

Processing is lawful if based on:

• Anesthetics and treatments: necessary for the performance of a contract.

• Free consent, where applicable (e.g. marketing).

• Legal obligations: medical archiving, tax reporting.

• Legitimate interests of the clinic, within the limits of the authorities and patients' rights.

4. Who we share data with

• Health professionals: collaborating doctors, dental laboratories.

• Public authorities: ANSPDCP, tax entrepunere, health authorities.

• Service providers: accounting, IT, software maintenance.

• Never we do not sell or give data for commercial campaigns.

5. Duration of data retention

• Medical and financial data is kept for a minimum of 10 years.

• In the case of minor patients, the record remains at least until the age of 26.

• Digital data (e.g. cookies) is stored according to the Cookies Policy.

6. Your rights

You have the following rights under GDPR:

1. Right of access

2. Right of rectification

3. Right to erasure („right to be forgotten”)

4. Right to restrict processing

5. Right to object

6. Right to data portability

7. Right to withdraw consent

To exercise your rights, write to us at [clinical email]. For complaints, you can contact the ANSPDCP (www.dataprotection.ro).

7. Data security

• Secure access with differentiated passwords and rights.

• Regular backup system.

• Computers and servers protected and encrypted where appropriate.

• Employees trained on data confidentiality.

8. Policy changes

We regularly update this policy. The latest revision is listed in the header.

9. We use a tracking code (gb_tid) in URLs to understand which advertisements or links lead to visits, CTA clicks, form completions and form submissions. We may temporarily store this code (for example in a session or cookie) to attribute activity to a campaign. We do not use it to track users on unrelated sites.