Privacy policy and terms of use

Processing of personal data

INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA

For NOVOMED CLINIC, the protection of personal data is very important. That is why we pay particular attention to your data. Data is processed lawfully, fairly and transparently, with appropriate security of the data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage.

The purpose of this Information notice is to explain how we make sure that your personal data is processed lawfully under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, or GDPR).

About us

NOVOMED CLINIC aims to provide all the conditions a patient needs to successfully treat the conditions they suffer from. To this end, specialists in various medical specialties work together as a multidisciplinary team built around the patient, so as to have a complete view of the treatment needs.

Name: BEST HEALTHCARE SYSTEM S.R.L. (NOVOMED CLINIC)

Registered office: Str. Soveja nr. 78, bl. FT3, sc. A, parter, ap. 1, Constanța, Romania

Tax identification code (CUI): 38945184

Trade Register number: J2018000506130

Phone: +40 724 007 799

Email: office@novomed.ro

Contact details of the data protection officer:

Correspondence address: Str. Soveja nr. 78, bl. FT3, sc. A, parter, ap. 1, Constanța, Romania

Email: office@novomed.ro

Personal data processed by NOVOMED CLINIC

• General information: surname, first name, home address, email, phone, date of birth, age, citizenship, personal numeric code (CNP), workplace, birth certificate, information from the identity document, signature, nationality, sex, family members’ data;
• Contact details: phone number, email address, home address or address of residence;
• Medical data needed for tests and treatment: medical history (the patient’s medical history, including previous conditions, surgery, accidents or injuries, drug allergies and other relevant information); results of tests and investigations (results of blood and urine tests, imaging such as X-rays, ultrasound and CT scans, electrocardiograms, biopsy results and other relevant medical tests); diagnosis (information on the medical diagnosis, including the description of the condition, its severity and possible complications); treatment (information on prescribed medication, doses and frequency, surgery performed, physical or rehabilitation therapy and other recommended treatments); consultation notes (detailed records of the medical consultation, which may include symptoms reported by the patient, the doctor’s observations, the clinical assessment and recommendations); insurance information (details of the patient’s health insurance, such as the policy number, type of cover and other relevant information); emergency contact details (information about emergency contacts, such as their name, relationship to the patient and phone number);
• Recruitment data: CV, employment record book (where applicable), the level and field of studies required for the position; supporting documents that may include data such as a criminal record certificate, a reference from the last employer (where applicable), a psychological examination certificate (where applicable);
• Billing and payment data: billing address; bank account number; bank card number; full name of the bank account or card holder; the date from which the bank card is valid; the expiry date of the bank card

Legal bases for processing personal data

Personal data will be processed only when there is a legal basis established by national or European law. Special categories of personal data, such as health data, will be processed when:

• the data subject has given explicit consent to the processing of those personal data for one or more specified purposes;
• processing is necessary for carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law, insofar as it is authorized by Union or Member State law or a collective agreement under Member State law providing for appropriate safeguards for the fundamental rights and interests of the data subject;
• processing is necessary to protect the vital interests of the data subject or of another natural person, where the data subject is physically or legally incapable of giving consent;
• processing relates to personal data which are manifestly made public by the data subject;
• processing is necessary for the establishment, exercise or defense of legal claims;
• processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and interests of the data subject;
• processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services, on the basis of Union or Member State law or pursuant to a contract with a health professional;
• processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;
• processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and interests of the data subject.

How long personal data is stored

NOVOMED CLINIC ensures the confidentiality of the personal data processed in accordance with the consent given by the data subject and with the law. Access to information treated as confidential is limited to those persons who, because of their work, need to know it in order to carry out the purpose and the legal relationships with NOVOMED CLINIC. These persons are bound to keep this information confidential, undertaking in turn to ensure and maintain the confidentiality of these data and information and to process them in accordance with the law. NOVOMED CLINIC complies with the legal provisions applicable to its field of activity, including Law no. 95/2006 on healthcare reform, as regards the storage period of personal data.

• Data needed for purposes related to medical services will be stored for the duration of the medical services contract, and for the period needed to fulfill the legal obligations under applicable law, including Law no. 95/2006 on healthcare reform.
• Payment and billing data will be stored for 10 years, in accordance with Accounting Law no. 82/1991;
• Video surveillance data, used to ensure the security of property and people, and call recordings will be stored for 30 calendar days, in accordance with the legal bases provided by law;
• Call recording data will be stored for 6 months, in accordance with the legal bases provided by law, and documents uploaded to the website will be stored for 30 days, after which they will be deleted automatically;
• Recruitment data will be kept for 6 months after the end of the recruitment/selection process;
• Data will be processed for marketing purposes for the duration of the contractual relationship with NOVOMED CLINIC, as well as after it ends. If the data subject withdraws consent to direct marketing, the data will no longer be processed for this purpose from the moment consent is withdrawn.
• The data subject’s data may also be processed for as long as there is a legal obligation to keep the data, or another legal basis exists, in accordance with Article 6 of the EU General Data Protection Regulation.

Data processed through the website www.novomed.ro

The booking form. When you fill in the form on the website, we process the data you enter (name, phone, email, preferred date, the specialty and the doctor chosen) in order to contact you and arrange the appointment. The legal basis is your request, meaning the steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR), and the consent you give by ticking the box in the form, for information that may concern your health (Art. 9(2)(a) GDPR). We keep this data for as long as needed to reply to you and arrange the appointment; if you become a patient, it becomes part of your medical record and is kept for the periods above.

Phone calls and WhatsApp. If you call us or message us on WhatsApp from the website, we use your phone number and the information you give us to reply to you and book your appointment. WhatsApp conversations go through the WhatsApp service, operated for Europe by WhatsApp Ireland Limited, which applies its own privacy policy. For visitors who reach the website from a Google ad, the number shown may be automatically replaced with a Google forwarding number, so that we can find out how many calls come from ads. Google reports call data to us (date, time, duration and area code), not the content of the conversation.

The virtual assistant “Ana”. The assistant was developed specifically for NOVOMED CLINIC and answers based on the information published on this website. The messages you write in the chat window are processed by NOVOMED CLINIC, as controller, only to answer your questions. They pass through the server the assistant runs on (n8n.cyberfield.ro), managed on our behalf by an IT contractor. Your browser keeps a conversation identifier (in local storage, under the name “n8n-chat/sessionId”) so that you can continue the conversation. Please do not write medical data, your personal numeric code or other sensitive data in the chat. To book a consultation, message us on WhatsApp at +40 724 007 799.

Statistics and ad measurement. We use Google Analytics 4 and Google Tag Manager to find out, in aggregate, how the website is used: the pages visited, the length of the visit, the type of device, the approximate city and the source of the visit, as well as taps on the phone number, on WhatsApp and form submissions, without their content. We use Google Ads to measure how effective our ads are, for example whether a click on an ad was followed by a call or a booking. These services are provided by Google Ireland Limited. The legal basis is your consent, which you give or refuse in the cookie banner and can withdraw at any time (see the cookie policy).

The map on the contact page. The contact page shows a Google Maps map (Google Ireland Limited). When the map loads, Google receives your IP address and technical data about your browser.

Hosting and security. The server hosting the website automatically records technical data (IP address, date and time, page accessed, browser type) for the operation and security of the website. The legal basis is our legitimate interest in keeping the website secure (Art. 6(1)(f) GDPR).

Cookie policy

Cookies are small files that a website saves in your browser. The website www.novomed.ro uses:

• Strictly necessary cookies: cookieyes-consent (CookieYes), which stores the choice you made in the cookie banner, for 1 year. These do not require your consent.
• Analytics cookies: _ga and _ga_* (Google Analytics), which distinguish visitors and sessions, for up to 2 years.
• Marketing cookies: _gcl_au (Google Ads), which measures conversions from ads, for 3 months, as well as cookies set by Google on its own domains (for example doubleclick.net) to measure ads.
• Browser local storage: n8n-chat/sessionId (the virtual assistant), which keeps the current conversation.

Analytics and marketing cookies are used based on your consent. On your first visit, the cookie banner lets you accept them, refuse them or choose by category. You can change your choice at any time with the cookie button in the bottom left corner of the screen or by deleting cookies in your browser settings. How Google uses this data: policies.google.com/technologies/partner-sites.

Your rights

• Right of access: You have the right to obtain from NOVOMED CLINIC confirmation as to whether or not it processes your personal data and, where it does, access to that data and to certain information set out in the Regulation.
• Right to rectification: You have the right to obtain from NOVOMED CLINIC the rectification of inaccurate personal data. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by providing a supplementary statement.
• Right to erasure (“right to be forgotten”): Known in particular as the “right to be forgotten”, this is based on the principle of guaranteeing every individual the freedom to decide what happens to their personal data, including having it erased, if there is no compelling or specific reason for continuing to process and store it.
• Right to restriction of processing: Restriction of processing means marking stored personal data in order to limit its future processing.
• Right to data portability: The purpose of this right is to give you more effective control over your personal data. The right to data portability applies only where: the data is processed by automated means; the data subject has consented to the processing; the processing is necessary to perform a contract.
• Right to object: You have the right to object when your personal data is processed for direct marketing; for profiling; by automated means; or for scientific or historical purposes.
• Right not to be subject to automated decision-making, including profiling: To comply with this right, NOVOMED CLINIC will continuously check whether any of its processing operations involves automated decision-making and will update its procedures accordingly to meet the requirements of the GDPR.
• The right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal, under certain conditions expressly provided by national and European law, as well as the right to lodge a complaint with a supervisory authority.

To exercise any of the rights mentioned above, or to send any question or concern about the matters in this information notice, you can contact us using the contact details given at the beginning of this document.

Right to lodge a complaint. If you consider that the processing of your data breaches the law, you have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP): B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucharest, Romania; phone +40 318 059 211 or +40 318 059 212; email anspdcp@dataprotection.ro; www.dataprotection.ro.

Categories of recipients of personal data

Personal data is processed mainly by NOVOMED CLINIC, but in certain specific situations external partners will be involved. NOVOMED CLINIC’s external partners will process personal data only if they provide sufficient guarantees to implement appropriate technical and organizational measures, so that the processing meets the requirements of the Regulation and ensures the protection of the data subject’s rights.

• Collaborating doctors: The relationship with the collaborating doctors who provide services for NOVOMED CLINIC is strictly regulated in terms of personal data protection, so that all legal obligations regarding the confidentiality of patient data are met.
• Romanian or foreign insurers: Some medical services may be paid in full or in part by the Romanian state or by insurers, or paid by the insured person. We will use personal data to complete the legal formalities with them and will comply with all applicable laws and regulations.
• Public institutions and public authorities: the National Health Insurance House, the Ministry of Health, the National Institute of Public Health or others. In these cases, personal data is processed to perform a task carried out in the public interest or in the exercise of official authority, and on the basis of specific legal provisions.
• Auditors, lawyers or other external consultants: These professionals will process data only in strict compliance with professional secrecy and the confidentiality of personal data.
• Providers of medical applications or services: For lab tests, NOVOMED CLINIC works with certain medical laboratories. In our contractual relationship with them, we constantly make sure they provide sufficient guarantees so that the processing meets all personal data protection requirements.
• IT and online service providers: the website hosting provider, Google (Analytics, Tag Manager, Ads, Maps), CookieYes (cookie consent management), the provider of the virtual assistant platform (n8n.cyberfield.ro) and, if you contact us on WhatsApp, WhatsApp Ireland Limited. They receive only the data needed for the service concerned.

Data transfers

Except in the situations below, NOVOMED CLINIC does not transfer personal data to a country outside the European Economic Area or to an international organization. The Google services used on the website (Google Analytics, Google Tag Manager, Google Ads, Google Maps) may transfer technical data about your visit, such as online identifiers and your IP address, to Google LLC in the United States of America. These transfers are based on the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework, under which Google LLC is certified, and, where applicable, on standard contractual clauses approved by the European Commission.

Refusal to provide your data

NOVOMED CLINIC will process personal data only lawfully, strictly respecting the principles of personal data processing set by national and European law. You are not obliged to provide your personal data, but refusing to do so will make it impossible to access our medical services.

No automated decision-making

Neither the personal data nor any of the processing operations at NOVOMED CLINIC involve decision-making based solely on automated processing of data, including profiling.

Changes to this Information notice

Because NOVOMED CLINIC constantly works to comply with personal data protection requirements, this notice may be changed and updated at any time. Please check this page each time you use our services.