Dental Chic
Back to the page
Privacy notice for international patient enquiries
Last updated: 21 July 2026
This notice explains what happens to the information you send us through the enquiry form or WhatsApp on our international patient page. It covers this page specifically. Other parts of dentalchic.ro may be covered by a separate notice.
Who is responsible for your data
Dental Chic, a dental clinic established in Cluj-Napoca, Romania, is the data controller. Romania is an EU member state, so your data is processed under the General Data Protection Regulation (GDPR) throughout.
Contact for privacy questions:
WhatsApp: +40 743 444 333
Or through the clinic contact page.
What we collect, and why
| Data | Why | Legal basis |
|---|---|---|
| Name | To address you correctly | Your consent |
| Phone or WhatsApp number | To reply to your enquiry | Your consent |
| Email address | To send you a treatment plan or quote | Your consent |
| Country | To assign a coordinator who speaks your language and to advise on travel | Your consent |
| Treatment you are interested in, and anything you write in the message field | To prepare a relevant response | Your explicit consent |
About health information. The treatment field, and anything you choose to write in the free-text message, may say something about your dental health. Under the GDPR this is a special category of personal data and needs your explicit consent, which is why the form asks you to tick a box before sending. You do not have to give any clinical detail to contact us. A name and a phone number are enough, and you can discuss the rest by voice with a coordinator.
Who else sees it
- Our CRM provider holds your enquiry so a coordinator can respond and follow up. It processes the data on our instructions only.
- WhatsApp (Meta), if you choose to contact us that way. What you send over WhatsApp is also handled under Meta's own terms.
- Google Analytics, for statistics about how the page is used. It does not receive your name, phone, email, treatment or message, and we send no health information to any analytics or advertising system from this page. It does assign your browser a random identifier and derives an approximate location from your IP address, so this is personal data rather than anonymous statistics.
We do not sell your data and we do not share it with other clinics or intermediaries.
Where your data goes
Some of the services above are operated by companies based outside the European Economic Area, principally in the United States. That applies to WhatsApp (Meta), to Google Analytics, and to our CRM provider. Where data reaches them, the transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on Standard Contractual Clauses approved by the Commission. You can ask us which mechanism applies to a given provider.
How long we keep it
Enquiries that do not become treatment are kept for up to two years, so we can pick up the conversation if you come back to us, then deleted. If you become a patient, your clinical record is kept for the period Romanian medical law requires, which is longer and separate from this notice. You can ask us to delete an enquiry sooner at any time.
Your rights
Under the GDPR you can ask us to:
- show you what we hold about you
- correct anything wrong
- delete it
- stop or limit how we use it
- send it to you or another provider in a portable format
- object to a particular use
Where we rely on your consent, you can withdraw it at any time. That does not affect anything done before you withdrew it. Just tell your coordinator, or write to us on the contact above.
If you think we have handled your data badly, you can complain to the Romanian supervisory authority, ANSPDCP, or to the data protection authority in your own country.
Cookies
The page sets one small cookie, dc_country, holding a two-letter country code such as DE. It exists so the page can show prices and flight routes relevant to where you are. It contains nothing personal, expires after 30 minutes, and is strictly necessary for the page to work as described, so it does not require your consent.
Google Analytics sets its own cookies, which are not strictly necessary. Under the ePrivacy rules these require your consent before they are set.
Automated decisions
We do not make any automated decision about you, and we do not profile you. A person reads every enquiry.