Privacy policy
Version 2026-10-08.1 · last updated: 8 October 2026
1. Who we are
The data controller is ANA DERM SRL, tax ID 46029919, J40/7989/2022, with its registered office at Intr. Urcușului 23–37, Spațiul Comercial Nr. 2, Sector 4, București 041244 (trade name DermaSpot, the “Clinic”, “we”).
Contact: +40 756 100 386 · contact@dermaspot.ro. Use the same address for data-protection requests. We have not appointed a data protection officer (DPO).
This policy describes processing on the DermaSpot website, including this address and https://www.dermaspot.ro once the site is published there, and in appointment messages.
If the clinic enables the Instagram feed, we store a long-lived access token and cache recent public posts (images and captions) so the site does not load Instagram scripts or cookies. Cached media is a clinic asset, not a patient file.
If a page shows live Google reviews, we cache the public author name, star rating, quote and review link from the Google Places API. We do not load Google scripts or cookies on the site for this. Reviewers remain Google users; we do not attach those quotes to patient records.
2. What data we process
| Category | Examples | Source |
|---|---|---|
| Identity and contact | first name, last name, phone, email, date of birth (optional) | from you, at booking or at the clinic |
| Appointments | service, doctor, date, time, status, notes, payment (CAS / private) | generated by the system and by you |
| Communication | email and, if you accepted, SMS; delivery status | from you and from providers |
| Medical data | consultation notes, photos, PDFs, X-rays (DICOM) | from the treating doctor |
| Google account | email address of the connected Google account, calendar list, and event times the doctor chooses to read | from Google, only if that doctor connects Google Calendar |
| Technical data | security logs, staff session cookie, language cookie, and — only if you accept — a Google Analytics identifier | automatically, when you use the site |
We do not collect a national ID (CNP) on the site. We do not use advertising cookies. Visit statistics use Google Analytics only after you accept. Details: Cookie policy.
3. Legal bases
- Appointments and essential messages — performing the request (Art. 6(1)(b)) and healthcare (Art. 9(2)(h)).
- Verification code — legitimate interest in preventing fake bookings (Art. 6(1)(f)).
- SMS / email reminders — optional consent (Art. 6(1)(a)). You can withdraw it from the management link or by writing to us. Essential messages (request received, confirmed, cancelled) are still sent on the verified channel as part of the service.
- Medical record — healthcare (Art. 9(2)(h)) and archiving duties. It does not depend on marketing consent.
- Security and internal reports — legal duties and legitimate interest; reports do not identify patients.
- Visit statistics — consent (Art. 6(1)(a)), via the cookie banner. You can withdraw it from “Cookie settings”. No medical data is included.
We do not take automated decisions with legal effects. We do not sell personal data.
4. Recipients
Clinic staff see data according to their role. Medical notes and documents are available to doctors; access is logged.
Processors (with a processing agreement where required):
- DigitalOcean LLC — application and database hosting in the European Union.
- Amazon Web Services EMEA (S3, Frankfurt) — storage of uploaded medical documents.
- SMS messages are sent from the clinic’s own phone.
- SpaceMail — sending emails.
- Expo (650 Industries, Inc., USA) — push notifications to the doctors’ app, without medical data.
- Google Ireland Limited and Google LLC — Google Analytics, only after consent. Pages viewed and a browser identifier. No patient record.
Google user data
When a doctor connects Google Calendar, we receive Google user data: the Google account email address, the list of calendars, and the start and end times of events on the calendars that doctor selects. We use it only to block those times in DermaSpot and to create, update, or delete that doctor’s appointment events in the chosen Google Calendar. An appointment event shows the patient’s first name and last-name initial, the service, and the time. It does not include medical notes. We store the connection tokens encrypted. The doctor can disconnect at any time; we then delete the tokens and stop the sync.
We share, transfer, or disclose that Google user data only with:
- Google Ireland Limited and Google LLC — we write the appointment events into the doctor’s own Google Calendar. Google also receives the Analytics data described above, and only after cookie consent.
- DigitalOcean LLC (European Union) — hosts the application and database that store the encrypted tokens, the Google account email, and the busy times, solely to run this service.
- Clinic staff — see the busy times on the clinic schedule so a slot is not booked twice. They do not see the titles, descriptions, or guests of the doctor’s other Google events.
- Public authorities — only where the law requires a disclosure.
We do not sell Google user data. We do not share, transfer, or disclose it to advertising networks, data brokers, or any other third party. We do not use it for advertising. Public Google reviews shown on the site are cached by us and are not linked to a patient record; aside from people who view the page, that cache is held only by us and by DigitalOcean as our host.
Medical documents stay in the EU (DigitalOcean + AWS Frankfurt). Expo and, if you accept analytics, Google may involve transfers outside the EU, based on the provider’s standard contractual clauses. We do not put medical notes in those messages or in analytics.
5. Retention
- Medical record (notes, documents): 10 years from the last visit.
- Contact and appointment data: for the duration of the relationship, aligned with the medical record.
- Message content: 90 days, then redacted; delivery metadata may remain.
- OTP codes and management links: up to 7 days after the appointment.
- Audit logs: 5 years. Staff session cookie: 30 days. Language cookie: 1 year. Cookie choice: 6 months. Google Analytics cookies: up to 2 years, only after acceptance.
6. Your rights
You have the rights of access, rectification, erasure (within medical-archiving limits), restriction, portability and objection, plus withdrawal of consent for reminders. Erasing identity does not erase the medical record while the law requires us to keep it.
Write to contact@dermaspot.ro. We reply within one month. You may lodge a complaint with ANSPDCP (www.dataprotection.ro, Bd. Gheorghe Magheru 28–30, Bucharest).
7. Security
TLS connections, EU hosting, role-based access, logging of medical-record access, password authentication and mandatory 2FA for staff.
8. Minors
Online booking is for people aged 18 or over. For a minor, a parent or legal representative may book through clinic staff, not through the public form.
9. Changes
Any change appears on this page, with the date and version number.