What is GDPR?

The General Data Protection Regulation (GDPR) is Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). It has been applicable since 25 May 2018.

GDPR establishes a single set of rules for the protection of personal data, applicable to all European Union member states.

Definitions Used by GDPR

Personal Data: Any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is someone who can be identified, directly or indirectly, by reference to one or more identifiers specific to their physical, physiological, genetic, mental, economic, cultural, or social identity.

General Personal Data: Examples include name, date and place of birth, address, phone number, email address.

Special Categories of Personal Data: Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, health data, sexual life, or sexual orientation.

Processing of Personal Data: Any operation performed on personal data, including collection, recording, organization, structuring, storage, adaptation or modification, extraction, consultation, use, disclosure, alignment or combination, restriction, erasure, or destruction.

Collection: Gathering or receiving personal data from data subjects.
Recording: Entering personal data into an automated or manual record system.
Organization: Structuring personal data according to predefined criteria to optimize processing activities.
Storage: Keeping personal data on any medium, including backup copies.
Adaptation: Transforming personal data for specific purposes.
Modification: Updating, correcting, or completing personal data.
Extraction: Retrieving a subset of personal data for separate use.
Consultation: Reviewing or examining personal data for subsequent processing.
Use: Utilizing personal data internally or by authorized parties.
Disclosure: Making personal data available to third parties.
Addition: Appending new data to existing personal data.
Combination: Merging separate personal data into a new form.
Restriction: Limiting access to personal data for a defined purpose.
Erasure: Removing personal data in whole or part from records.
Transformation: Anonymizing or using personal data for statistical purposes.
Destruction: Permanently destroying physical media containing personal data.

Identifiable Person: A person who can be identified, directly or indirectly, e.g., by name, ID number, location data, online identifier, or one or more specific elements of physical, physiological, genetic, mental, economic, cultural, or social identity.

Pseudonymized Data: Personal data processed so it cannot be attributed to a specific individual without additional information. These data remain subject to GDPR.

Principles of Personal Data Processing

  1. Lawfulness, Fairness, and Transparency: Data must be processed legally, fairly, and transparently.

  2. Purpose Limitation: Data must be collected for explicit, legitimate purposes and not further processed incompatibly.

  3. Data Minimization: Data should be adequate, relevant, and limited to what is necessary.

  4. Accuracy: Data must be accurate and updated if necessary.

  5. Storage Limitation: Data should be kept only as long as needed for processing purposes.

  6. Integrity and Confidentiality: Data must be processed securely to prevent unauthorized processing, loss, destruction, or damage.

  7. Accountability: The data controller is responsible for compliance and must demonstrate it.

Who Does GDPR Apply To?

GDPR applies to organizations of any size and sector that:

  • Provide goods or services to individuals in EU member states;

  • Monitor the behavior of individuals in EU member states;

  • Employ people in EU member states.

How XVISION-RX Complies with GDPR

XVISION-RX manages personal data securely in accordance with GDPR and related laws. Data collected is used only for the purposes described in this policy:

  • Website Visitors: Data collected through forms for online appointments (name, phone number, email) to contact patients regarding scheduling.

  • Feedback: Patient satisfaction surveys are processed anonymously, only if consent is given.

  • Complaints: Data is processed to handle complaints and improve services.

XVISION-RX ensures confidentiality and security of personal data for website users, patients, and potential patients.

Behavioral Marketing and Remarketing

The xvision-rx.ro website uses online marketing technologies through Google and Facebook, based on visitor behavior.

How It Works

  1. When you are interested in a topic (e.g., dental X-rays) and browse the internet, the websites you visit may contain codes from Google and Facebook that track your interest.

  2. These codes may be accompanied by cookies from partners in their marketing networks. Partnerships are dynamic, so it is not possible to predict exactly which cookies will be sent at any given time.

  3. Google and Facebook use this information anonymously to display personalized ads, including on other websites.

Important: If you do not accept marketing cookies, your visit will not be used for remarketing. However, visiting other websites that do not comply with GDPR or where you accept marketing cookies may still include you in such interest-based databases.

Xvision-Rx processes marketing cookies only with visitor consent and for educational purposes to promote public health.

How to Stop Personalized Ads

  • Periodically delete cookies from your browser.

  • Opt-out of preference tracking from Google or Facebook databases.

Cookie Management / Disabling

You can control cookies directly in your browser:

  • Google Chrome: Settings → Advanced → Content Settings → Cookies → Allow / Block

  • Mozilla Firefox: Options → Privacy & Security → Block cookies and site data

  • Internet Explorer 11: Internet Options → Privacy → Advanced Settings → Allow / Block cookies

  • Safari: Preferences → Privacy → Allow cookies from websites visited

  • Opera: Settings → Preferences → Advanced → Cookies → Accept / Do not accept / Manage

Disabling cookies may limit some website functionalities.

Personal Data Processing at X VISION

Before receiving our services, you will complete a Personal Data Processing Agreement, including information such as: name, ID number (CNP), contact details, gender, weight, height, address, and email.

Who Can Access Your Data

  • Ministry of Health and subordinate agencies

  • National Health Insurance House and regional offices

  • Authorities in public order, security, and justice

  • Romanian College of Dentists and territorial branches

Data disclosure is in accordance with legislation: HG 1255/2016, Law 95/2006, HG 589/2007.

Purpose of Processing

  • Managing medical services and legal reporting

  • Sending X-ray images to the referring doctor (with consent)

  • Ensuring IT security and system functionality

Data Collected from Website Visitors

Through cookies and logs, the following data are collected: IP address, location, browser settings, visit duration, operating system, visited pages.

  • Purpose: improving website functionality and security.

Data Retention Period

Data Category Purpose Legal Basis Retention Period
Name, email, phone, IP Direct marketing Consent 5 years
Financial data (payments) Patient administration Contract execution 11 years
Health information Patient administration Contract execution 5 years from last treatment
CCTV recordings Monitoring Legitimate interest 30 days

Data Subject Rights

  • Right to be informed and access data

  • Right to rectification and deletion

  • Right to object to direct marketing

  • Right to data portability

  • Right to file a complaint with ANSPDCP (www.dataprotection.ro)

Exercising Rights: Submit a written, dated, and signed request to VLAD VISION SRL, Bd Republicii nr. 2, Baia Mare or via email: office@xvision-rx.ro