1. About This Policy

    This policy explains how Dr-Online Services SRL processes personal data in connection with the informational website https://dr-online.net, the public directory of doctors and clinics, and contact or demonstration requests.

    It is intended for website visitors, doctors, clinic representatives, patients and others who contact us.

    Using virtual medical practices and applications, including medical records and consultations, requires the specific privacy notices applicable to those services. This policy does not replace the healthcare provider’s own notice.

    2. Data Controller and Contact

    For the activities described here, the controller is Dr-Online Services SRL, Romanian company identification number 47466563, registered with the Trade Register under number J2023000827402, with its registered office at 26 Avionului Street, Office B, 1st floor, Sector 1, Bucharest, Romania.

    For questions or to exercise your personal data rights, email contact@dr-online.ro or call +40 767 260 133.

    3. Personal Data We Process

    • Contact and demonstration requests: name, email address, telephone number, professional information entered and the contents of requests or correspondence.
    • Doctor and clinic directory: professional details displayed in profiles, such as names, specialties, affiliations, location, biography, photographs and professional contact information, where included.
    • Browsing and security: IP address and technical information transmitted when using the website, including pages requested, access times, browser and device.
    • Preferences: selected language and information associated with technologies described in the Cookie Policy.

    General contact and DEMO forms are not intended to collect medical data. Please do not submit Romanian personal identification numbers (CNP), copies of identity documents, diagnoses, laboratory results or medical documents through these forms.

    4. Purposes and Legal Bases for Processing

    Responding to requests: we use data to communicate, answer questions and arrange demonstrations. When you request steps toward entering into a contract to which you will be a party, processing is based on Article 6(1)(b) of the GDPR. For general enquiries and communication with clinic representatives, our legal basis is the legitimate interest in handling requests and professional relationships under Article 6(1)(f).

    Professional directory: we use information to present healthcare providers and facilitate contact. Depending on the circumstances, processing may be based on performance of a contract where the professional is a party, or a legitimate interest in managing the directory and displaying relevant professional information. Photographs and other materials are used subject to applicable rights.

    Operation and security: technical data is processed under our legitimate interest in providing and protecting the website, identifying errors and preventing unauthorized access or abusive messages.

    Legal obligations and claims: we process information needed to comply with legal obligations, including handling data protection requests. Establishing, exercising or defending legal claims may be based on legitimate interests within the limits of the law.

    Submitting a DEMO request does not automatically subscribe you to a newsletter. Any future marketing activities will be accompanied by the relevant information and legal basis.

    5. Sources of Personal Data

    Contact details come from the information you provide. Professional details may be supplied by a doctor, clinic or their representative. Technical data is generated through website access.

    When we receive information about a person from another source, that individual is informed within the applicable conditions and deadlines, including information about the relevant source.

    6. Recipients of Personal Data

    Data may be accessed by authorized personnel and service providers involved in hosting, technical administration and communications necessary to operate the website, within their respective duties and services.

    The contractual hosting provider is XARITES-THE CREATIVE AGENCY S.R.L., company identification number RO35381226.

    Information published in public doctor and clinic profiles can be accessed by visitors and indexed by search engines. Publishing professional information does not mean that private requests submitted through forms are published.

    We may disclose information to authorities or professional advisers when required by law or reasonably necessary to defend legal rights.

    7. How Long We Keep Personal Data

    Contact and demonstration enquiries that do not result in a contract are retained for a maximum of 12 months from the last interaction.

    If a contract is concluded, information required for the relationship is retained according to the contractual purpose and applicable legal obligations; the 12-month period for enquiries without a contract does not automatically apply to such records.

    Professional profile information is retained while the listing remains active and justified. Requests for correction or removal are assessed according to the basis for publication and the individual’s rights.

    For technical data, retention is determined by the need to diagnose errors, identify incidents and protect services. Data relevant to an incident may be retained for the duration of its investigation and resolution.

    Information needed for a specific legal obligation or dispute may be retained separately for as long as justified. Backups must be managed through a limited retention cycle and must not be used to reintroduce deleted data into active use.

    8. Cookies and Fonts

    Information about cookies is provided in the Cookie Policy.

    Fonts managed by Elementor are configured to load locally from the website’s infrastructure.

    9. Third-Party Services and International Transfers

    Links to social media, app stores and other external websites lead to services with their own privacy policies.

    Connections to external service providers must also be assessed for potential transfers of data outside the European Economic Area. This policy does not state that all data remains exclusively in Romania or the European Union.

    10. Your Rights

    Subject to the conditions of the GDPR, you may request access, rectification, erasure, restriction of processing and, where applicable, data portability.

    You may object to processing based on legitimate interests on grounds relating to your particular situation. You may object to direct marketing at any time.

    Where processing is based on consent, you can withdraw that consent without affecting the lawfulness of processing carried out before withdrawal.

    Send your request to contact@dr-online.ro. We may ask only for further information necessary to verify your identity. We generally respond within one month; any extension permitted by law will be communicated and explained.

    You may lodge a complaint with Romania’s National Supervisory Authority for Personal Data Processing: www.dataprotection.ro.

    11. Providing Personal Data

    Mandatory fields are marked in the form. If you do not provide the details necessary to contact you, we may be unable to respond or arrange a demonstration. Please limit message content to what is necessary for the request.

    12. Updates

    We update this policy when the activities described or services used change. Significant changes will be communicated appropriately to affected individuals.

    Draft version dated 4 November 2026.