The Data Controller and the Legal Framework

The controller who determines the purposes and means of processing your data is DENTAL SELECT CARE SRL, with its registered office at Str. Palatul Justiției nr. 60, Ap. BIR. 1, Sector 4, cod poștal 040096, București, registered under 39658045.

We process personal data in accordance with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (GDPR), Law no. 190/2018, healthcare legislation and the other rules applicable in Romania. The competent supervisory authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP).

Principles of Processing

We are committed to observing the principles set out by the GDPR in everything relating to your data:

Lawfulness, fairness and transparency – we process data fairly and inform you clearly about what we do with it.
Purpose limitation – we collect data only for specified, explicit and legitimate purposes, in particular for the provision of dental care.
Data minimisation – we request only the data necessary for the intended purpose.
Accuracy – we make sure that data is correct and up to date, and you can support us by reporting any change.
Storage limitation – we keep data only for as long as necessary for the purposes and legal obligations (for example, the retention periods for medical records).
Integrity and confidentiality – we apply appropriate technical and organisational measures to protect data against unauthorised access, loss or disclosure.
Accountability – we can demonstrate, at any time, the compliance of the processing operations we carry out.

The Legal Bases for Processing

The processing of your data is based, depending on the situation, on one or more of the following legal bases:

Consent (Article 6(1)(a) and Article 9(2)(a) GDPR) – for example, for marketing communications or for certain processing operations for which we ask for your explicit agreement. Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out prior to the withdrawal.
Performance of a contract (Article 6(1)(b) GDPR) – to provide the dental services you have requested, schedule appointments and manage our relationship with you as a patient.
Legal obligation (Article 6(1)(c) GDPR) – to fulfil the obligations laid down by medical, tax and archiving legislation that apply to us as a healthcare provider.
Vital interests (Article 6(1)(d) and Article 9(2)(c) GDPR) – where processing is necessary to protect your health or life, or that of another person, in situations where you are unable to give your consent.
Medical purposes (Article 9(2)(h) GDPR) – the processing of health data is necessary to establish an accurate diagnosis, provide care and manage health systems and services, under the responsibility of a professional subject to the obligation of professional secrecy.
Legitimate interest (Article 6(1)(f) GDPR) – for example, for information security and the improvement of our services, where our interests do not override your rights and freedoms.

Special Categories of Data (Health Data)

As a dental clinic, we inevitably process special categories of data, in particular health data: medical history, allergies, treatments undertaken, X-rays, intraoral images and digital impressions, treatment plans and other information necessary for your care.

This data benefits from an enhanced level of protection. We process it exclusively for medical purposes, under the responsibility of staff who have an obligation to observe professional secrecy, and we apply security measures appropriate to its sensitivity. Access to it is limited to those who need this information in order to provide you with care or to fulfil legal obligations.

Your Rights as a Data Subject

The GDPR guarantees you a series of rights that you can exercise at any time:

The right of access – you can obtain confirmation that we process your data and a copy of it.
The right to rectification – you can request the correction of inaccurate data or the completion of incomplete data.
The right to erasure (“the right to be forgotten”) – you can request the erasure of data under certain conditions; this right is limited by the legal obligations to retain medical records.
The right to restriction of processing – you can request that processing be restricted in the situations provided for by law.
The right to data portability – you can receive the data you have provided in a structured, commonly used and machine-readable format, or have it transmitted to another controller, where applicable.
The right to object – you can object to processing based on legitimate interest, as well as to processing for direct marketing purposes.
The right not to be subject to an automated decision – detailed below.
The right to withdraw your consent – at any time, for processing based on consent, without affecting the lawfulness of prior processing.
The right to lodge a complaint with the supervisory authority (ANSPDCP).

How to Exercise Your Rights

To exercise any of the rights above, you can contact us at contact@dentalselect.ro or at +40 723 344 100, or in writing at our registered office at Str. Palatul Justiției nr. 60, Ap. BIR. 1, Sector 4, cod poștal 040096, București. Please submit a clear request, stating the right you wish to exercise.

For your security, we may ask you for additional information to confirm your identity before acting on the request. We will respond within a maximum of one month from receipt of the request; this period may be extended by two months, depending on the complexity and number of requests, in which case you will be informed. Exercising your rights is, in principle, free of charge.

Data Recipients and Transfers

Your data may be disclosed, under the conditions provided by law, to categories of recipients such as: dental laboratories, collaborating medical service providers, IT and archiving service providers, accountants, as well as public authorities where there is a legal obligation.

As a rule, we process data within the European Union / European Economic Area. In situations where a transfer to a third country would be necessary, it will be carried out only in compliance with the safeguards provided by the GDPR (for example, an adequacy decision of the European Commission or standard contractual clauses), so that the level of data protection remains adequate.

Automated Decisions and Profiling

Decisions regarding your diagnosis and treatment plan are made by medical staff and are not based solely on automated data processing. We do not use automated decision-making processes that produce legal effects on you or that similarly significantly affect you, without human intervention. Should such a situation arise, you will be informed and will benefit from the safeguards provided by the GDPR, including the right to human intervention.

Lodging a Complaint with the ANSPDCP

If you consider that the processing of your data does not comply with data protection legislation, you have the right to address the National Supervisory Authority for Personal Data Processing (ANSPDCP).

The authority's contact details: address B-dul General Gheorghe Magheru nr. 28-30, Sector 1, cod poștal 010336, București, website www.dataprotection.ro. We do, however, encourage you to contact us first, at contact@dentalselect.ro, so that together we can try to resolve any concern or complaint quickly.

Contact – The Data Protection Officer

For any question about the way we process your data or to exercise your rights, you can contact us:

Controller: DENTAL SELECT CARE SRL, 39658045
Address: Str. Palatul Justiției nr. 60, Ap. BIR. 1, Sector 4, cod poștal 040096, București
Data Protection Officer (DPO): contact@dentalselect.ro
Phone: +40 723 344 100

Protection of Personal Data (GDPR)