Data privacy

1. Controller and contact details

The controller is A.V.Y. CLINIQUE S.R.L., with its registered office at 113 Alexandru Lăpușneanu Boulevard, floors 1 and 2, Constanța, Constanța County, Romania. Trade Register number: J13/4113/2023. Company registration number: 49269738. For personal data enquiries: aviclinique@gmail.com or +40 720 150 510.

2. Data received through the website

We receive the details you enter: name, surname where requested, phone number, optional email, message and, depending on the form, the selected service or clinician. We also store the request type, originating page, submission time, request identifier and a record of the privacy notice and choices. Campaign parameters from the address may be included only if you accept measurement, to identify the campaign that brought the enquiry. Authorised staff can update the request status. Data is stored in the Supabase database used by the clinic.

Required fields are marked on the form. Without the necessary contact details we cannot process an online request; you can still call us. The thank-you page confirms receipt of your request; reception confirms any appointment separately. Do not send diagnoses, test results or medical documents through the form.

When you access the website, the technical infrastructure receives information needed for the connection, such as your IP address and browser information. Form abuse protection uses cryptographically derived IP and phone identifiers; its records do not store the raw IP address. This does not mean hosting providers do not process IP addresses to operate and secure their services.

3. Purposes and legal bases

We handle appointment and service enquiries to take steps you request before entering a contract, under GDPR Article 6(1)(b). Answering other messages and organising enquiries relies on our legitimate interest in communicating with people who contact us; security and abuse prevention relies on our legitimate interest in protecting the website and data, under Article 6(1)(f). Medical and accounting records are subject to applicable legal obligations under Article 6(1)(c).

VIP registration relies on separate consent to campaign communications under GDPR Article 6(1)(a). You can withdraw it by emailing aviclinique@gmail.com, calling us or replying STOP to a campaign message; the clinic processes the request, with no automatic unsubscribe mechanism on this website. Without this consent we do not add you to the VIP communications list; the ordinary appointment form remains available without marketing. VIP consent is separate from enabling the Google map and advertising measurement. Acknowledging this notice does not give general consent to every use of your data.

4. Health data

A selected service or the contents of a message may reveal health information. Such data requires a condition under GDPR Article 9 as well as an Article 6 basis. For data necessary for medical care, Article 9(2)(h) is relevant, subject to the law and professional confidentiality. Information and documents required for medical care are provided separately by the clinic. Acknowledging the website notice or accepting cookies is not medical consent and does not authorise advertising based on health data.

5. Who may receive data

Requests are accessible to authorised clinic staff. Vercel hosts the published website, while Supabase provides the database and administration authentication. Medical providers, laboratories, accounting services or authorities may be involved in your relationship with the clinic where necessary and permitted by law. We do not publish form submissions.

Google receives technical data when you allow the map to load, and Meta receives the measurement data described below only after the corresponding consent. The WhatsApp link opens the WhatsApp service separately; displaying the button does not load a WhatsApp script. The providers' policies also apply to these services. For information about processing locations and, where applicable, countries and safeguards for transfers outside the European Economic Area, including how to obtain a copy of safeguards, contact aviclinique@gmail.com.

6. The map and optional measurement

The Google map loads only after consent to external content. Meta Pixel, identifier 857348034101658, is configured to measure visits and campaign results, but loads only after separate measurement consent under GDPR Article 6(1)(a). You can decline or withdraw each option through Cookie preferences. Ordinary forms and VIP registration also work if you decline measurement; consent to VIP communications remains separate.

After consent, the PageView event measures visits to public pages, including services, clinician profiles and the VIP List. Lead and CompleteRegistration additionally measure confirmed enquiries and registrations. Administration, APIs and unknown addresses are not measured. Technical checks can prevent a visit from being measured if its address or referring page contains unsupported parameters.

Meta may receive the address of the public page visited, accepted advertising parameters in the address, information about the visit's origin, the IP address, browser information and cookie identifiers. A service-page address may indicate the medical topic viewed. Form fields such as name, phone number, email, message and clinician or treatment selections are not added to events, and automatic data collection for matching is disabled by the integration. Measurement is not anonymous. Storage and withdrawal details are in the Cookies policy.

7. Retention and protection

How long a request is retained depends on the time needed to respond, follow-up discussions or appointments, closure of the request and any legal obligations or need to address a complaint. For the VIP list, the criteria are the campaign's purpose and duration and withdrawal of consent; withdrawal stops use for those communications. A minimal record of consent or withdrawal may be needed to demonstrate that your choice was respected. Form submissions currently have no fixed automatic deletion deadline.

Medical and accounting records have their own statutory retention periods, separate from browser storage. Technical abuse-limiting counters older than 48 hours are removed at the next new submission; this does not delete saved enquiries. Cookie and preference durations are described separately in the Cookies policy.

Access to requests is restricted, administration checks authentication, and the published website transmits data over HTTPS. Server access keys are not sent to the browser form. Requests about erasure, restriction or retention should be addressed to the clinic and assessed against the purpose and applicable obligations.

8. Your rights and requests

Subject to the GDPR, you have rights of access, rectification, erasure, restriction and portability. You may object to processing based on legitimate interests and to direct marketing at any time. You can withdraw consent without affecting the lawfulness of earlier processing. The website does not make solely automated decisions producing legal or similarly significant effects on you; the clinic confirms appointments.

Email aviclinique@gmail.com or call the clinic on +40 720 150 510. We may need to confirm your identity to protect your data. The usual response period is one month from receipt; in the circumstances allowed by the GDPR, it may be extended by up to two further months, with notice to you within the first month. You can complain to Romania's National Supervisory Authority for Personal Data Processing, ANSPDCP: ANSPDCP.

9. Updates

Notice updated on 20 October 2026, version 2026-10-20.3, based on the clinic's published details and the features of this version. Changes to purposes or optional services will be reflected in this notice and, where needed, a new consent request.