Who we are
This notice is issued by NexoMed S.R.L. (Romania) ("we", "us"). Contact for data protection matters: [email protected]. Where required, our data protection officer or representative is: [DPO / UK and EU representative details].
Our role and the clinics' role (subject to legal review)
The allocation of roles below reflects our current understanding and is subject to legal review.
- We act as controller for coordination data: your account, contact details, assessment answers, messages with coordinators, the consents you give and records of what was shared with whom.
- Each clinic you authorise acts as an independent controller for the information it receives and for your clinical care, once you have authorised sharing with that clinic. Its own privacy notice applies to that processing.
- We do not act as a joint controller with clinics for clinical records, and clinics are not our processors for your care.
What we collect
- Identity and contact details: name, email address, telephone number, country of residence.
- Assessment information: the treatment you are considering, timing and travel preferences.
- Health information you choose to provide: dental concerns, relevant medical history, X-rays, scans or photographs.
- Communications: messages with coordinators and clinics through our platform.
- Technical data: device and log information needed to run and secure the service, and cookie data as described in our cookie policy.
Health data and explicit consent
Information about your dental and general health is special category data. We process it only on the basis of your explicit consent under Article 9(2)(a) of the UK GDPR and EU GDPR.
You give consent separately and specifically: once for us to hold your health information for coordination, and again for each clinic you authorise to receive it. Consent is never bundled with marketing or with acceptance of our terms. You can withdraw consent at any time; this does not affect processing already carried out, and a clinic that has already received your information will hold it under its own obligations.
How we use your information
- To respond to your enquiry and coordinate contact with the clinics you authorise (contract or steps at your request; explicit consent for health data).
- To operate, secure and improve the service (legitimate interests).
- To meet legal and regulatory obligations, such as record-keeping and responding to authorities (legal obligation).
- To send optional updates, only if you separately opt in (consent).
We do not use automated decision-making that produces legal or similarly significant effects. We do not use artificial intelligence or machine-learning tools to process health data.
Who we share it with
- Clinics you have specifically authorised, and only the information you chose to share with them.
- Service providers acting as our processors (for example hosting, email delivery, secure file storage) under written contracts. List: [processor list to be completed].
- Authorities where the law requires it.
We never share health data with advertising or social media platforms, and we do not sell personal data. Any marketing measurement is configured so that health information is not transmitted.
International transfers
Clinics are located in Romania, within the European Economic Area. Transfers between the UK and the EEA rely on the applicable adequacy arrangements. Where a processor is located elsewhere, we use appropriate safeguards such as standard contractual clauses. Details: [transfer mechanisms to be confirmed].
How long we keep it
Retention periods are configurable and set per data category. Our intended defaults are: [retention schedule to be confirmed]. Inactive enquiries and uploaded health documents are deleted or anonymised at the end of their retention period unless we must keep them for a legal reason. Clinics set their own retention for clinical records under their legal obligations.
Your rights
- Access: ask for a copy of the personal data we hold about you.
- Export (portability): receive data you provided in a structured, machine-readable format.
- Erasure: ask us to delete your data, subject to legal exceptions.
- Rectification: correct inaccurate or incomplete data.
- Restriction: ask us to limit how we use your data in certain circumstances.
- Objection: object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent at any time, including consent for each clinic.
Many of these can be exercised directly from your patient portal. Otherwise, contact [email protected]. We aim to respond within one month.
Security
We use access controls, encryption in transit and at rest, audit logging of access to health documents, and staff confidentiality obligations. No system is completely secure; if a breach affects you, we will tell you where the law requires.