Politique de Confidentialité (GDPR)

Last updated: June 2, 2026

Table of Contents

  1. Identity of the Data Controller
  2. What Personal Data We Collect
  3. Purpose and Legal Basis for Processing
  4. Sensitive Medical Data (Special Category — Art. 9 GDPR)
  5. Data Sharing with Third Parties
  6. Cookies and Tracking Technologies
  7. International Data Transfers
  8. Retention Period
  9. Your Rights (GDPR)
  10. Data Security
  11. Policy Changes
  12. DPO Contact

1. Identity of the Data Controller

The controller responsible for processing your personal data is:

  • Name: COJOCARU C. RADU-SILVIAN — Specialist Doctor in Plastic Surgery — Reconstructive Microsurgery
  • Tax ID (CIF): 44186399
  • Headquarters: 36A Baba Novac St., Cluj-Napoca, Cluj County, Romania
  • DPO Email: office@clinicaestetica.ro
  • Phone: +40 751 900 610

2. What Personal Data We Collect

Depending on your interaction with the site and our services, we may collect the following categories of data:

Category Collected Data Source
Identification Data First name, last name Booking form, consultation
Contact Data Phone number, email address Booking form, WhatsApp, email
Technical Data IP address, browser type, operating system, visited pages Automatically, when accessing the site
Marketing Data UTM parameters, gclid, cookies Automatically, via cookies (with consent)
Sensitive Medical Data Medical photos, medical history, preoperative evaluations Direct consultation, WhatsApp (with explicit consent)

3. Purpose and Legal Basis for Processing

Purpose Legal Basis (GDPR)
Processing and managing appointments Art. 6(1)(b) — Performance of a contract / pre-contractual measures
Providing medical services Art. 9(2)(h) — Purposes of preventive medicine / medical diagnosis
Communicating with the patient (confirmation, reminder) Art. 6(1)(b) — Performance of a contract
Fulfilling legal obligations (medical records, taxation) Art. 6(1)(c) — Legal obligation
Publishing "before and after" photos Art. 9(2)(a) — Explicit written consent of the patient
Web traffic analysis (Google Analytics, Clarity) Art. 6(1)(a) — Consent (cookie banner)
Marketing and advertising (Google Ads, Meta Pixel) Art. 6(1)(a) — Consent (cookie banner)

4. Sensitive Medical Data (Art. 9 GDPR)

🔒 High Protection: Health data is considered a special category of personal data according to Article 9 of the GDPR Regulation. We provide a high level of security and protection.

Medical data (patient photos, medical history, preoperative evaluations) are:

  • Collected exclusively with the patient's explicit consent or under the medical exception (Art. 9(2)(h) GDPR).
  • Accessible only to the attending physician (Dr. Radu Cojocaru) and authorized medical personnel directly involved in patient care.
  • Stored in secure systems, with restricted access and protected by passwords.
  • Not shared with third parties (marketing companies, social media platforms, etc.) without the express written consent of the patient.
  • "Before and after" photos are published on the site only with the separate written consent of the patient, which can be withdrawn at any time.

5. Data Sharing with Third Parties

For the proper functioning of services, your data may be shared with the following third parties:

Third Party / Provider Purpose Transferred Data
Google (Analytics, Ads, Tag Manager) Traffic analysis and advertising campaign optimization Anonymized technical data, cookies (with consent)
Microsoft Clarity User behavior analysis on the site Anonymized technical data (with consent)
Meta (Facebook/Instagram Pixel) Remarketing and campaign optimization Technical data, cookies (with consent)
PlusCredit Facilitating installment financing Data provided directly by the patient on the PlusCredit platform
Stripe Card payment processing Payment data (processed directly by Stripe, no local storage)
OneSignal Push notifications (with explicit consent) Anonymous technical identifier
Hosting Provider (Cloudflare/server) Website hosting Technical data (IP address, server logs)

We do not sell and do not rent your personal data to third parties. Patient medical data is never shared with the marketing platforms listed above.

6. Cookies and Tracking Technologies

The site uses cookies for operation, analysis, and marketing. You can manage your cookie preferences via the cookie banner displayed on your first visit or by accessing the Cookie Policy.

7. International Data Transfers

Some of our providers (Google, Meta, Microsoft, Stripe) may process data outside the European Economic Area (EEA). In all cases, these transfers are made based on adequacy decisions or standard contractual clauses (SCC).

8. Retention Period

  • Appointment Data: For the duration of the doctor-patient relationship + maximum 3 years from the last interaction.
  • Medical Records: According to current medical legislation (minimum 5 years).
  • Marketing Data (cookies): Maximum 90 days from collection.
  • Tax Data: 10 years (according to the Tax Code).

9. Your Rights (GDPR)

According to GDPR, you have rights regarding your personal data: Right of access, Right to rectification, Right to erasure ("right to be forgotten"), Right to restriction of processing, Right to data portability, Right to object, and Right to withdraw consent.

How to exercise your rights?

Send a written request to the email address office@clinicaestetica.ro with the subject "GDPR Request". We will respond within a maximum of 30 calendar days.

Supervisory Authority:

You have the right to file a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP) at www.dataprotection.ro.

10. Data Security

We have implemented appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, or unauthorized disclosure.

11. Policy Changes

We reserve the right to periodically update this policy. The updated version will be published on this page.

12. DPO Contact