Privacy Policy

1. Identity and contact details of the Operator

S.C. CHIROMAX S.R.L., with its registered office in Galati, Str. Domneasca no. 82, Galati county, registered at the Trade Register Office under no. J17/1973/2004, with CUI 17007143, as a personal data operator, respects the confidentiality and security of the processing of personal data of each visitor/Patient* (data subject) of the site https://chiromax.ro referred to below as the „site”. .

1.2. If there are any questions regarding the personal data collected through the Medical Platform*, the data subject is requested to submit a written request:

sauce

  • in writing, by post, to the following address: Galați Municipality, Str. Domneasca no. 82, Galați county.

conform to definitionțas stipulated in the terms și Condiții.

1.3. Individuals submitting such requests to the Operator are kindly asked to include information such as “data protection” in the subject line of the email or on the envelope, ensuring that these requests will be handled with priority.

1.4. The data subject shall receive a response within 30 days of the document being communicated to the Operator, an extension of this period may only apply in exceptional circumstances. In such cases, the data subject shall be duly informed of this extension.

2. Principles of personal data processing and safeguards

2.1. We make every effort to ensure that the information entered into our databases is used only for determined, explicit, and legitimate purposes. In processing personal data, the Controller shall act lawfully, fairly, and transparently. Data processing is adequate and limited, only in proportion to the necessity of achieving the purpose for which it was collected. Personal data will be retained for the period necessary to fulfil the purposes for which they are collected, and processing will be carried out in a manner adequate to ensure the security and integrity of the data. No data transfer will be carried out without adequate precautionary measures, in accordance with the applicable legislation on the protection of personal data.

2.2. In accordance with the requirements of Regulation No. 679/2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR) and Law No. 190/2018 on the implementation measures of the Regulation, the Operator is obliged to administer safely and only for the specified purposes, the personal data provided by website visitors (meaning browsing the site without completing the booking form) or Patients (meaning purchasing medical services through the site).

2.3. To ensure the lawfulness of personal data processing, the Operator assumes responsibility for implementing appropriate technical and organisational measures to protect against unauthorised access, use, alteration or destruction of personal data in accordance with current legislation and best practices applicable to personal data.

2.4. S.C. CHIROMAX S.R.L. shall not disclose personal data collected through the website. https://chiromax.ro , except for authorised employees or persons empowered to whom these data are necessary in order to process them on behalf of the Operator (website service provider, hosting provider, accounting, etc.) or in case the obligation to disclose represents a legal obligation of the Operator or its employees. 

3. Categories of data collected by the Operator

S.C. CHIROMAX S.R.L. collects personal data based on voluntary provision by data subjects. The categories of personal data collected depend on the nature of how the visitor uses the site.

3.2. For the purpose of providing consultations and medical services, the data subject voluntarily provides the information entered into the Appointment form – name and surname, address, e-mail address, telephone number, medical data provided in the „Message - describe what type of consultation/medical service you want” field.

The data controller gives special attention to the personal data provided by Patients, as this falls into special categories of personal data, as defined by Article 9 GDPR: „(1) The processing of personal data (...) relating to person[al data] is prohibitedănătatea (… ). (2) Paragraph (1) does not applyă in the followingăthe torchesț(ii) (h) processing is necessaryă îfor purposes related to establishing a medical diagnosis, for providing assistland Medicală after a medical treatment (...).”

3.3. The Operator may unintentionally collect other data which does not lead to the unique identification of the data subject (type of browser used, language of browser used, type of operating system used, IP address of the computer used to browse the site, date and time of site access, access status - e.g. file transfer, file availability, etc., possible form content, as well as other technical parameters) provided by the internet browser through which access to the site is made and may be used by the Operator to improve the services offered to Patients. Such information will not, however, be used to identify site visitors and will not be made public, other than under the conditions described in this Privacy Policy.

4. Purposes and legal grounds for processing personal data

4.1. S.C. CHIROMAX S.R.L. processes the personal data provided by the visitor/patient for the following purposes and legal grounds:

4.1.1. in order to communicate with the patient to provide medical services in accordance with the Terms and Conditions (processing is necessary for the performance of the medical services contract in accordance with Art. 6(1)(b) GDPR;

4.1.2. for the purpose of providing healthcare in accordance with the Terms and Conditions (processing is necessary for the purposes of medical diagnosis, provision of healthcare or medical treatment in accordance with Article 9(h) of the GDPR;

4.1.3. for the purpose of providing the requested information, in the event of completing contact forms in accordance with Article 6(f) of the GDPR;

4.1.4. in legitimate interest, personal data collected involuntarily, in order to understand customer needs and expectations and to improve medical services provided in accordance with Article 6(f) of the GDPR;

5. Data subject rights

5.1. On the basis of a written request, submitted in accordance with the instructions provided in Section I, you may exercise the following rights:

5.1.1. The right of access means the right of the data subject to obtain confirmation from the Operator as to whether or not personal data concerning them (the visitor/patient) are being processed and, in the affirmative, to gain access to that data and information on how their data are being processed;

5.1.2. The right to data portability refers to the right of the data subject to receive personal data in a structured, commonly used and automatically readable format, and the right for this data to be transmitted directly to another operator, but only if this is technically feasible.;

5.1.3. The right to object concerns the right of the data subject to object to the processing of personal data when the processing is necessary for the performance of a task carried out in the public interest or when it concerns the legitimate interests of the Controller.;

5.1.4. The right to rectification refers to the correction, without undue delay, of inaccurate personal data. The rectification shall be communicated to each recipient to whom the data have been disclosed, unless this proves impossible or involves disproportionate efforts for the Controller;

5.1.5. The right to erasure of data (“right to be forgotten”) means the right of the data;

5.1.6. The right to restrict processing may be exercised where the accuracy of the data processed by the Controller is contested, for a period enabling the correctness of the data to be verified; processing is unlawful, and the data subject opposes the erasure of personal data, requesting restriction instead; where the Company no longer needs the personal data for the purposes of processing but the data subject requires them for the establishment, exercise or defence of legal claims; where the data subject has objected to processing pending verification of whether the legitimate grounds of the Controller override those of the data subject.

5.1.7. In the event that it is considered that the rights provided by GDPR have been infringed, any data subject has the option to contact the National Supervisory Authority for the Processing of Personal Data (A.N.S.P.D.C.P.) by lodging a complaint. At the same time, the data subject has the right to contact the competent courts.

6. Storage of personal data

6.1. Personal data is processed within the territory of the European Union. This data is retained for a period appropriate to the purpose for which it was processed, in accordance with legal requirements. Usual data processing for which there is no statutory retention period will be considered in relation to the general statute of limitations, as the maximum duration for storage in the Operator's databases.

7. Changes to the Privacy Policy

Insofar as the Operator deems it necessary to change the privacy rules, they will publish the respective modifications to inform the data subjects about the information they collect and how they use it, so as to ensure that all visitors or Patients are informed.

Last updated: 07.11.2022