Privacy policy
Privacy policy
How the Cerebro-Spinal Clinic processes personal data used by the website and appointment-request form.
Last updated: October 1, 2026
This policy describes the processing of personal data through the Cerebro-Spinal Clinic website. It covers online appointment requests and website use, not the clinic's medical-record archive.
Data controller
The controller is CEREBRO-SPINAL S.R.L., Romanian tax identification number (CUI) 49824471. The clinic's public location is Strada București no. 33, Călărași, Romania. You can contact us at office@clinica-cerebro-spinal.ro or 0722 349 710.
Privacy and data-rights contact
For questions or to exercise your personal-data rights, email office@clinica-cerebro-spinal.ro. The clinic has not confirmed a Data Protection Officer (DPO) for publication on this website; the stated address is the operational contact channel for these requests.
Data we may process
The form may collect your name, phone number, email address, requested specialty, preferred doctor, preferred date and time, form language and evidence of consent. Choosing a specialty may indirectly indicate an area of medical interest, but the form does not request a diagnosis, medical history, documents or files. Technical data such as an IP address and a cryptographic request identifier may be processed temporarily for security and abuse prevention.
Purposes and legal bases
Data is used to receive, route and manage the request and to contact the person for confirmation. Submitting the form does not confirm an appointment. Processing may be necessary to take steps at the person's request before providing a service, based on consent where applicable and, for website security and abuse prevention, on legitimate interests. We do not use this form for marketing or automated decision-making.
Recipients and technical providers
Data is available to authorized clinic staff to the extent necessary to manage the request. The website uses Supabase for the database and administrative authentication and Vercel for hosting and operation. If transactional email is enabled, the technical email provider may process the address and content strictly necessary to deliver operational messages. Providers process data according to their applicable role and terms.
Retention of online requests
Operational data and the history of a website appointment request are retained for up to 6 months, then deleted or anonymized as appropriate under the storage-limitation principle. Retention may be extended only where necessary to comply with a legal obligation or to establish, exercise or defend a legal claim. This is the operational policy for website requests and does not apply to medical documents or records.
Your GDPR rights
Subject to the GDPR and depending on the legal basis and specific circumstances, you may request information, access, rectification, erasure, restriction, portability or object to processing. Where processing relies on consent, it may be withdrawn for the future. We may request reasonable information to verify identity. You have the right to lodge a complaint with Romania's National Supervisory Authority for Personal Data Processing (ANSPDCP) and to seek a judicial remedy.
Language preference
The website uses the first-party functional cookie NEXT_LOCALE only to remember the selected language (Romanian or English). This cookie is necessary to preserve that preference, is not used for advertising or behavioral tracking, and does not require a consent banner under the current configuration.
Google Maps
On the Contact page, Google Maps content is not loaded before the explicit “Load Google Map” action. After that action, the browser connects to Google, which may receive technical data such as the IP address, device/browser information and the website origin under its own policy. The external Google Maps link opens Google's service directly.
Vercel Web Analytics
The website uses Vercel Web Analytics in its standard configuration for aggregated statistics about page views and general website use. According to Vercel's documentation, the service does not use cookies and does not provide the clinic with identifiers that allow visitors to be identified or reidentified. No custom events are configured, and appointment-form fields are not sent to Analytics.
Cloudflare Turnstile
The appointment form uses Cloudflare Turnstile for security and to prevent abusive automated submissions. During verification, Cloudflare may receive strictly necessary technical data such as the IP address, browser information and the verification result. The clinic does not use this data for marketing.
Request-related communications
The clinic may send operational messages about receiving and managing the request by phone or email. An acknowledgement message confirms only that the request was received, not that an appointment was confirmed. Data from this form is not used for marketing communications.
Security
We apply reasonable technical and organizational measures, including server-side validation, request limiting, administrative access control and database-level restrictions. No internet-connected system can guarantee absolute security.
Policy updates
This policy may be updated to reflect changes to the website, providers or applicable requirements. The version published on this page and the latest-update date indicate the current version.
This policy concerns the website and online appointment requests; medical records are managed separately under the rules applicable to medical services.