1. Who is responsible for your data
The data controller is COSMIDENT SOCIAL S.R.L., tax ID (CUI) 42996658, Trade Register no. J2020002040228 (J22/2040/2020), registered office at Str. Vișan nr. 88, demisol (lower ground floor), Iași, Iași County, 700579, Romania (“Cosmident” or “the clinic”).
You can write to us at office@cosmident.ro, call 0750 211 256 or 0745 243 578 or send a letter to our registered office.
The clinic has not appointed a data protection officer (DPO): the processing carried out through this website does not meet the conditions in Article 37 of Regulation (EU) 2016/679 (“GDPR”). Send any data question to the e-mail address above.
2. What data we process and why
Booking requests and messages sent through the form. Your name, phone number, optionally your e-mail, the chosen service, preferred dentist, preferred date and time, your notes and, if you sent one, the cost estimate from the price list. We use them to contact you and arrange the appointment. Legal basis: Article 6(1)(b) GDPR (steps taken at your request before treatment). The form is sent only after you tick the box agreeing to the use of this data for your request.
Health information. If you write details about your problem in the notes or tell us by phone, this is health data. Clinic staff, who are bound by professional secrecy, use it only to prepare your consultation (Article 9(2)(h) GDPR). Please write only what is necessary; we discuss the rest at the consultation.
The chat assistant (CICI). The messages you type in the chat window and a session identifier kept in your browser. We use them to answer general questions about the clinic, prices and opening hours and, if you ask, to pass a booking request on to the clinic. Legal basis: Article 6(1)(b) and (f) GDPR. The assistant does not diagnose and does not replace a dentist; please do not type medical data in the chat.
Technical data. IP address, browser type and the logs of the server and of the protection service (Cloudflare). We use them to keep the website working and secure and to stop abuse. Legal basis: our legitimate interest, Article 6(1)(f) GDPR.
Interactive Google Maps map. It loads only if you choose “Load the map” or accept optional cookies; Google then receives your IP address and browser data. Legal basis: your consent, Article 6(1)(a) GDPR, which you can withdraw at any time from “Cookie settings”.
Phone, WhatsApp, e-mail. When you contact us directly, we use the data you send only to reply and book you in. For WhatsApp, Meta's policy also applies, which you accept in the app.
If you become a patient, your medical record is processed under health legislation (including Law no. 95/2006 and Law no. 46/2003 on patients' rights), separately from this website.
This website does not use traffic analytics, advertising pixels or marketing profiles.
3. Who else sees the data
The data is used by clinic staff. The following providers may also process it, only on the clinic's behalf and instructions (processors, Article 28 GDPR):
- INVENT EVOLUTION S.R.L. (Iași, tax ID 49679100) runs the website, the form and the CICI assistant. Form requests reach the clinic's management panel (IE Panel, hosted by Invent Evolution) and are e-mailed to the clinic, with a copy to Invent Evolution's technical team. The server keeps only a technical trace of the submission (time, an identifier and the result), without your name, phone number or message.
- OVHcloud hosts the website's server in the European Union.
- Cloudflare, Inc. delivers the pages and protects the website. It processes the IP address and technical data of each request. Transfers to the US rely on the EU-US Data Privacy Framework or standard contractual clauses.
- Google (Gmail) receives the copy of the request e-mail sent to the technical team. Google Maps loads only with your consent. Google LLC is certified under the Data Privacy Framework.
- Artificial intelligence providers contracted by Invent Evolution process the chat messages. If a provider processes data outside the European Economic Area, the transfer relies on an adequacy decision or standard contractual clauses (Articles 44–49 GDPR).
Data may be disclosed to authorities only where the law requires it. We never sell or rent your data.
4. How long we keep it
Form and chat requests are kept for as long as needed to reply and arrange your appointment; after that they are deleted, unless you become a patient, in which case the necessary information moves into your medical record, kept for the periods required by law. In the clinic's panel, form requests are deleted automatically after at most 180 days.
Technical and security logs are kept for short periods, as needed to run and protect the website.
Your cookie choice stays saved in your browser until you change it or clear the site data.
5. Your rights
You have the right to access your data, have it corrected or erased, restrict processing, data portability and to object to processing based on legitimate interest. You can withdraw consent at any time, without affecting what was done before.
To exercise any of these rights, write to office@cosmident.ro. We reply within one month (Article 12 GDPR).
If you believe your data is not processed correctly, you can complain to the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, Bucharest, www.dataprotection.ro.
6. Data security
The website uses an encrypted connection (HTTPS). Only people who need the requests can see them: clinic staff and, to run the website, the technical team.
7. Minors
For children under 16, the booking request is made by a parent or guardian.
8. Changes
We may update this policy when the website or the law changes. The date of the last update is shown above.