Privacy Policy
Last updated: 16 October 2026
This policy describes how we process the personal data of visitors to primeclinic.ro and of people who contact us through it. The data of the clinic's patients — including medical data — is processed under a separate Patient Information Notice, which you receive at your first visit to the clinic.
1. Who we are
The data controller is Prime Protocol S.R.L., registered office at Strada Stockholm nr. 10, Sector 1, Bucharest, 011786, Romania, Trade Register no. J2026021960002, VAT no. RO54407284 ("Prime Clinic", "we").
For any request concerning your data, contact us at [email protected] or by post at the address above.
2. What data we process and where it comes from
We collect only the data you give us directly or that results from your use of the site:
| Situation | Data | Source |
|---|---|---|
| You complete the "Request a consultation" form | Full name, email address, the service you are interested in (Membership or Check-Up 360°), date and time of the request | You |
| You call the number shown on the site | Your phone number and the content of the conversation | You |
| You accept analytics cookies | Usage statistics (pages viewed, visit duration, device and browser type, approximate country/city, visit source), linked to a random identifier; IP addresses are anonymised | Google Analytics, only with your consent |
| You visit the site (any visitor) | Technical server logs (IP address, time, page requested), kept briefly for security | Our hosting provider |
The ten-second test on the site ("Do you know your ApoB?") runs entirely in your browser; the answers are neither transmitted nor stored.
The site is not intended for persons under 16 and we do not knowingly collect their data.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| To respond to your consultation request and contact you about it | Your consent, given by ticking the box in the form — art. 6(1)(a); steps at your request prior to entering into a contract — art. 6(1)(b) |
| To send you information about our services, if you subscribed for that purpose | Your consent, confirmed by email (double opt-in) — art. 6(1)(a) |
| To understand how the site is used and measure our communication | Your consent, given in the cookie banner — art. 6(1)(a) and art. 4 of Romanian Law no. 506/2004 |
| To keep the site secure and working | Our legitimate interest in operating a secure site — art. 6(1)(f) |
| To comply with legal obligations and defend our rights | Legal obligation — art. 6(1)(c); legitimate interest — art. 6(1)(f) |
We make no automated decisions with legal effects on you and build no profiles from data collected through the site.
If you do not provide the data in the form, we cannot answer your request; you can always contact us by phone instead.
4. Who we share data with
We do not sell or rent your data. We share it only with:
- Processors acting on our behalf under contracts compliant with art. 28 GDPR:
- MailerLite (UAB MailerLite, Vilnius, Lithuania — European Union): receiving and managing form requests and subscriptions;
- Cloudflare (Cloudflare, Inc.): hosting the site and protecting it from attacks; certified under the EU-U.S. Data Privacy Framework;
- Google (Google Ireland Limited): usage statistics, only with your consent, as described in our Cookie Policy;
- Google Workspace: our email, through which we receive and answer requests.
- Prime Clinic S.R.L. (VAT no. 54207286), the company operating the clinic at Strada Stockholm 10, when your request concerns an appointment or a membership; from that point, your data as a patient is processed under the clinic's Patient Information Notice.
- Public authorities, where the law requires it.
5. Transfers outside the European Union
Data is stored, as a rule, within the European Union. For Cloudflare and Google services, some data may be processed in the United States; both companies are certified under the EU-U.S. Data Privacy Framework, recognised by the European Commission's adequacy decision of 10 July 2023, and additionally apply the Commission's standard contractual clauses.
6. How long we keep data
| Data | Retention |
|---|---|
| Form requests not followed by a contractual relationship | 12 months from the last correspondence |
| Requests followed by registration as a patient | Per the clinic's Patient Information Notice (medical records are kept as required by health legislation) |
| Subscriptions to communications | Until you unsubscribe; an unsubscribe link is in every email |
| Analytics data (Google Analytics) | 14 months, then aggregated |
| Technical server logs | 30 days at most |
| Consent cookie | 6 months |
7. Data security
The site is served exclusively over encrypted connections (HTTPS). The form sends data directly to our request-management system without storing it on the site. Access to requests is limited to the people who need to answer you. Fonts and all site resources are hosted by us, so your visit is not disclosed to third parties without your consent.
8. Your rights
Under the GDPR you have the following rights:
- the right of access to the data we hold about you (art. 15);
- the right to rectification of inaccurate or incomplete data (art. 16);
- the right to erasure ("right to be forgotten"), as provided by law (art. 17);
- the right to restriction of processing (art. 18);
- the right to data portability for data provided on the basis of consent (art. 20);
- the right to object to processing based on legitimate interest (art. 21);
- the right to withdraw consent at any time, without affecting the lawfulness of prior processing (art. 7(3)) — for cookies via the "Cookie settings" link; for communications via the unsubscribe link; for requests by writing to us;
- the right not to be subject to a decision based solely on automated processing (art. 22).
To exercise your rights, write to [email protected]. We reply within one month; in complex cases this may be extended by two further months, and we will tell you if so. We may ask for information to confirm your identity.
If you consider that the processing of your data breaches the law, you have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, Bucharest, www.dataprotection.ro, and to bring proceedings before the competent courts.
9. Changes to this policy
We may update this policy when our services or the law change. The current version, with the date of its last update, is always published on this page.
10. Contact
Prime Protocol S.R.L. · Strada Stockholm nr. 10, Sector 1, Bucharest, 011786 · [email protected] · +40 755 043 224
← Back to the site