Privacy policy

Doctor Talmaciu Clinic treats your personal information with care and responsibility.

We are constantly taking into account in our work and are subject to the rules and procedures laid down by Regulation No. 679 of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

1. Definitions

Within the meaning of the Regulation:

“personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity;

Examples of personal data: name, e-mail address, weight, height, medical information etc.

“processing” means any operation or set of operations which is performed upon personal data or sets of personal data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Examples of processing operations: registration of images, adding the CNP in a report to CASMB, deletion of a former employee’s data from the clinic’s records, etc.

1. Types of personal data processed in the clinic and the purpose of the processing

From the moment you enter the Doctor Talmaciu clinic, located in Bucharest, 3 Tusnad Street, or from the moment you call or email the clinic staff by phone or email in order to obtain an appointment or information on rates, available doctors or the like, certain personal data are processed:

your image, in the common areas and in the surgeries (through the video surveillance system located in the clinic premises, in order to maintain security in the space, and in order to verify the compliance of auxiliary staff with strict hygiene rules),

voice, through the same surveillance system placed in the clinic premises, in order to clarify your agreement to all stages of treatment, and to ensure and certify that you have been correctly and fully informed about the treatment, risks, possible side effects, etc.,

name and surname (for the purpose of making an appointment, or to identify your medical record in the system),

CNP ul (in the case of patients who access services paid by CASMB, the CNP ul is the mandatory identifier required by CASMB in the reports that the clinic makes to this institution, so that you can benefit from services paid in the public health insurance system),

data about your state of health (treatments you are undergoing, medical conditions you suffer from, pregnancy, etc.). This data is processed pursuant to Article 9 (2) (h) of the Regulation, for the purposes of providing dental services, the choice of medical treatment and the correct and appropriate intervention for your state of health.

By accessing the site www.doctortalmaciu.ro are automatically collected and stored in traffic reports: cookies, IP of the device from which the user connects to the site, the general location from where the user accesses the site, browser type, history of pages accessed.

At the express request of patients who do not wish to have their voice or image recorded, the cameras inside the office may be turned off, or, if the request concerns voice only, only the camera microphone may be turned off. In these situations the treatment will be carried out over a period of time that will allow detailed documentation of: the initial check-up, the doctor’s findings following this check-up, the doctor’s recommendations, the proposed treatment, the possible risks if the treatment is not followed, the possible risks inherent in the treatment, the patient’s agreement to each of these aspects. All this will be in writing and will be presented to the patient for his/her written consent, after which the actual treatment can start. The costs involved by the duration of the sessions thus extended will be added to the fees charged by the clinic for the respective interventions and will be borne by the patient.

• The principles we follow during any type of processing

Whether we are talking about filling out a patient record, performing an X-ray, or sending your data to CASMB, we limit the data strictly to the purpose for which we use it. We will not ask for data that is not necessary for the purposes listed above, we will not fill out a report or a chart with more than is strictly necessary to deliver the service or to submit the report.

We will not transmit your data to third parties. The institutions to which we are obliged to transmit your data are the Public Health Department – Radiation Hygiene Department (department that monitors the compliance of the clinic with the conditions for performing imaging interventions) and the Bucharest Health Insurance House (entity that manages the data of the insured and settles the services included in the national plan).

We will never process your biometric data, ethnicity, nationality, political orientation, sexual orientation, etc.

We will not process the data for any purpose other than to provide you with the medical services you request.

We will not retain data beyond a period of time that justifies, on a case-by-case basis, its retention. Recordings from the closed-circuit audio-video surveillance system are automatically erased after a period of 30 days from their recording. Medical data are kept for the entire period of prescription of the public institution’s right to request proof of them (5 years from their recording).

All clinic staff is trained on the rules of personal data management. Each category of staff – administrative (reception, accounting), doctors, nurses – knows and has strict access to the category of data they are entitled to access in order to fulfill their duties:

reception – completion of patient records, scheduling management, transmission to the DSP of reports on X-rays

nurses – have the least access, due to lack of need to know patients’ personal data

doctors – consult patient records, completed by patients under the guidance of reception staff

• have access by the nature of their duties to all medical data, which they are obliged to check
• prepare reports to CASMB and DSP

As for the audio-video surveillance system, it is located in common areas – waiting rooms, hallways, reception, reception, courtyard, and in the offices. Recreation areas (kitchen, balcony, cloakroom) or restrooms are not monitored.

1. Rights guaranteed to data subjects
2. Information and access to personal data

Whether the data is collected directly from the data subject or from a third party, the following information will be transmitted to the data subject, to the extent that the data subject does not already have it:

1. the identity and contact details of the controller and, where applicable, its representative;
2. contact details of the Data Protection Officer, where applicable;
3. the purposes for which personal data are processed and the legal basis of the processing;
4. legitimate interests pursued by the controller or a third party where the processing is done for their purposes;
5. the recipients or categories of recipients of personal data;
6. if applicable, the clinic’s intention to transfer personal data to a third country or an international organization and the appropriate safeguards pursuant to Article 46 and 49 of the GDPR, and the means to obtain a copy of them, if they have been made available.

In addition to the information mentioned above, when personal data are obtained, the Clinic shall provide the data subject with the following additional information necessary to ensure fair and transparent processing:

1. the period for which personal data will be stored or, if this is not possible, the criteria used to determine this period;
2. the existence of the right to request to the Clinic, in relation to personal data concerning the data subject, access to, rectification or erasure of, or restriction of processing or the right to object to processing, as well as the right to data portability;
3. where the processing was obtained by consent, the existence of the right to withdraw consent at any time, without affecting the lawfulness of the processing carried out on the basis of consent prior to its withdrawal;
4. the right to lodge a complaint with the relevant supervisory authority – ANSPDCP;
5. whether the provision of personal data constitutes a legal or contractual obligation or an obligation necessary for the conclusion of a contract, as well as whether the data subject is obliged to provide such personal data and what are the possible consequences of failure to comply with this obligation;
6. the existence of an automated decision-making process including profiling, as well as, at least in those cases, relevant information on the logic involved and on the significance and expected consequences of such processing for the data subject.
7. Data subject’s right of access

The Clinic guarantees the right of data subjects to obtain a confirmation as to whether or not their data is processed, as well as to access all the information referred to in point 1 above.

3. Right to rectification, erasure, restriction of processing, objection

Any inaccurate data will be deleted or rectified, as appropriate, at the request of the data subject or when the error is discovered. Unless there is a legal obligation to the contrary, any data will be erased or their processing will be restricted at the request of the data subject when they are no longer necessary for the purposes for which they were collected or processed, or the data subject has withdrawn consent or objects to the processing for reasons related to his or her particular situation. In these situations, if the data have been transferred to other operators, the Clinic will inform them of the restriction or erasure request and will instruct them to erase any copies, reproductions or links to the data concerned.

4. The right to portability and the right not to be subject to a decision based solely on automated processing, including profiling.

Where the processing is based on consent and is carried out by automated means, the data subject has the right to receive the personal data concerning him or her which he or she has provided to the clinic in a structured, commonly used and machine-readable format and to have this data transmitted to another controller.

Except in situations where there is the consent of the data subject, or the processing is necessary for the conclusion or performance of a contract, the data subject shall not be subject to a decision based solely on automated processing, including profiling, which would produce legal effects concerning the data subject or similarly affect him or her to a significant extent.

1. Processing security

The processing of personal data is subject to appropriate technical and organizational measures, including, inter alia:

1. pseudonymization and encryption of personal data;
2. the ability to ensure the confidentiality, integrity, availability and continued availability and resilience of processing systems and services;
3. the ability to restore the availability of and access to personal data in a timely manner in the event of a physical or technical incident;
4. a process for periodically testing, evaluating and assessing the effectiveness of technical and organizational measures to ensure the security of processing;
5. password-based access to computer systems;
6. restricted physical access to office space and data center;
7. keeping physical files in secure storage cabinets with restricted access to authorized persons.

In the event of a data security breach, the clinic will notify the supervisory authority within the legal deadline of 72 hours from the time it became aware of the breach, as well as the data subject, if the breach is likely to result in a high risk to the rights and freedoms of natural persons. In both cases, the information shall include at least a description of the incident, a contact point where further information can be obtained, the likely consequences and the action taken or proposed to be taken. However, the data subject will still not be informed, if the clinic has implemented measures making the affected data unintelligible to any unauthorized person, or if it has taken subsequent measures whereby the risk to the data subject’s rights is no longer likely to materialize.

1. Organizational measures taken by the clinic to protect personal data collected

The equipment storing the audio-video recordings are located in a space where access is restricted – the room is locked, the only person who has access is the security officer of the clinic, its owner, Dr. Bogdan Talmaciu.

Images are not shown on the monitors.

The technical maintenance of the system is performed by an authorized IGPR company, based on a contract. The staff who checks the system does not have the password to access the recorded data, which is strictly in the possession of the owner.

The audio-video surveillance system is made by a company authorized by IGPR and is checked and approved by the police.

Video surveillance is not monitored – no one is watching the images as they are being recorded or afterwards.

A data subject’s request to access his or her images must be made in writing. The images in which the person is captured must first technically undergo a blurring procedure to blur the images of other persons in the same recording.

Any incidents in which records are accessed by unauthorized persons will be notified to the ANSPDCP within 72 hours from the time the access was reported.

You can contact the clinic for any questions regarding the processing of your personal data, and you will receive a reply within 15 days of your request, at the following e-mail address: contact@doctortalmaciu.ro.