GDPR

At Bucharest Hair Institute, patient confidentiality is part of medical care. This page explains, in plain terms, how we apply the General Data Protection Regulation – Regulation (EU) 2016/679 (“GDPR”) – and what rights you have over your data. Full details about the data collected through the website, legal bases, retention periods and cookies are available in our Privacy Policy.

1. What GDPR is

The GDPR is the European regulation that has applied in all EU Member States since 25 May 2018 and sets the rules for collecting, using and protecting personal data. In Romania, the GDPR is supplemented by Law no. 190/2018. For a medical clinic, these rules come on top of the duty of medical confidentiality.

2. Who is responsible for your data

The data controller is Bucharest Hair Institute, Bulevardul Pipera 58, Voluntari 077190, Ilfov County, Romania. For any question about your personal data, write to us at office@implantcapilar.com or call +40 712 629 651.

3. The principles we follow

• Lawfulness and transparency – we process data only when we have a legal basis, and we tell you clearly what we do with it.
• Purpose limitation – we use data only for the purposes it was collected for: appointments, consultations, treatment and the clinic’s legal obligations.
• Data minimisation – we ask only for the information we need.
• Accuracy – we help you update or correct your data.
• Storage limitation – we do not keep data longer than necessary or than the law requires.
• Integrity and confidentiality – we protect data through appropriate technical and organisational measures.
• Accountability – we can demonstrate how we comply with these rules.

4. What data we process, in brief

• contact details (name, phone, e-mail) sent through the form, by phone, by e-mail or via WhatsApp;
• information about your request and your appointment history;
• health data: your hair condition, relevant medical history, scalp photos and the medical records created at the clinic;
• technical data about your browsing on the website, collected through cookies only with your consent (except strictly necessary cookies).

5. Medical data – a special category

The GDPR treats health data as a special category of data that requires extra protection. We process it only to assess and treat you, based on your explicit consent or for the provision of health care (Art. 9(2)(a) and (h) GDPR), and only the doctors and staff involved in your care, who are bound by professional secrecy, have access to it.

Before/after photos and testimonials are published on the website or on social media only with your separate written consent. You can withdraw this consent at any time, and the materials will be removed from the channels we manage.

6. Your rights, explained

• Right to be informed – to know who processes your data, for what purpose and for how long.
• Right of access – to get confirmation that we process your data and a copy of it.
• Right to rectification – to have inaccurate data corrected or incomplete data completed.
• Right to erasure (“right to be forgotten”) – to ask us to delete your data, except data we are legally required to keep, such as medical and accounting records.
• Right to restriction of processing – to ask us to temporarily stop using your data, for example while we check its accuracy.
• Right to data portability – to receive the data you provided in a structured, commonly used format, or to have it sent to another controller where technically feasible.
• Right to object – to object to processing based on our legitimate interest and, at any time, to the use of your data for marketing.
• Right to withdraw consent – at any time, without affecting the lawfulness of processing carried out before.
• Right not to be subject to automated decisions – we do not make decisions based solely on automated processing that significantly affect you.
• Right to lodge a complaint – with the supervisory authority (see section 10).

7. How to send us a request

1. Write to us at office@implantcapilar.com or send a written request to the clinic’s address.
2. Include your full name, contact details and the right you wish to exercise, with as much detail as possible (for example, the period or type of data concerned).
3. To protect your data, we may ask for additional information to confirm your identity before acting on your request.
4. We will reply within one month of receiving your request. If the request is complex or we receive many requests, this period may be extended by two further months, in which case we will let you know within the first month.

Exercising your rights is free of charge. If requests are manifestly unfounded or excessive, in particular because they are repetitive, we may charge a reasonable fee or refuse the request, explaining why.

8. How we protect your data

• access to data only for authorised staff, on a “need to know” basis;
• confidentiality obligations for staff and collaborators;
• encrypted connection (HTTPS) on the website and spam protection for forms;
• service providers (hosting, e-mail, analytics) that process data only on our instructions, under contracts that comply with Art. 28 GDPR;
• transfers outside the European Economic Area only with appropriate safeguards, such as the EU-U.S. Data Privacy Framework or standard contractual clauses.

9. Security incidents

If a personal data breach occurs that poses a risk to people’s rights, we notify the National Supervisory Authority within 72 hours of becoming aware of it, as required by the GDPR. If the risk is high, we also inform you without undue delay about what happened and what measures we have taken.

10. Complaints

If you believe your data is not being processed correctly, please contact us first so that we can resolve the situation. You always have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, Bucharest, www.dataprotection.ro, or to go to court.

11. More information

For details about the data collected through the website, purposes, legal bases, retention periods, recipients and cookies, see our Privacy Policy. For the rules on using the website, see our Terms and conditions.

12. Contact

Bucharest Hair Institute
Bulevardul Pipera 58, Voluntari 077190, Ilfov County, Romania
Phone: +40 712 629 651
E-mail: office@implantcapilar.com