Privacy Policy and GDPR

Updated on 11 November 2026. This policy explains the processing of personal data through the ProLife Medical® website and identifies the controllers responsible for medical services. Information and consent documents specific to medical care apply in addition to this policy.

1. Who processes data — identity of the controllers

ProLife Medical® is a brand under which services from separate companies are presented, not a separate legal entity. The controller of medical information depends on the centre where you request or receive a service:

To exercise your rights, contact the controller of the centre to which the data relate. General correspondence may also be sent to office@prolifemedical.ro, indicating the centre concerned. This contact is not presented as the separate address of a Data Protection Officer (DPO).

2. Categories of data and purposes of processing

• Contact and appointments: name, phone number, email address, service requested and preferred time, to respond to requests and arrange attendance.
• Medical information: documents, medical history, examinations, results and safety-related data necessary for the medical services provided.
• Laboratory requests: selected tests, contact information and, if home sample collection is requested, the locality; where the form is completed by a physician, the physician’s declared professional details and patient information necessary for the request.
• Website use: IP address, access date and time, pages visited, technical identifiers and other log data that may be recorded by the server for operation, security and troubleshooting.
• Medical and administrative obligations: records and information needed for medical documentation, invoicing, health insurance settlements, accounting and compliance with legal obligations.

3. Legal bases for processing

Depending on the particular processing activity, the following may apply: Article 6(1)(b) GDPR (steps before a contract and requested services), Article 6(1)(c) (legal obligations), Article 6(1)(f) (legitimate interests, such as protecting the website, following the applicable assessment), or Article 6(1)(a) (consent, where appropriate).

Health information is a special category of personal data. For healthcare, processing may rely on Article 9(2)(h) GDPR, in accordance with the law and professional confidentiality. Other uses may require a distinct condition, including explicit consent where applicable. Checking that you have read an online form notice does not constitute informed consent for a medical procedure.

4. What happens when you complete an online form?

Laboratory test requests

The test list and estimated cost can be viewed in your browser. When a laboratory request form is submitted, the completed details, selected tests and any observations are emailed to the reception contact configured by the centre. The form may collect name, telephone number, email address, preferred date, locality if home collection is requested, and additional professional information for physicians’ requests. Submission does not mean the appointment has been confirmed. Do not enter unnecessary medical information in free-text fields.

Medical history questionnaire for MRI and CT

The pre-examination questionnaire collects name, telephone number, optional email address, type of examination and answers concerning implants, devices, medical history, reactions to contrast agents and other safety-related circumstances. The message is sent via HTTPS to the website application and subsequently by email to reception at office@prolifemedical.ro, for review by the imaging centre team (AXA DESIGN SRL). This is not an automatic medical assessment, does not confirm an appointment and does not replace informed consent for the examination or contrast agent.

According to the implementation described in the Romanian policy, responses from these two forms are not retained as patient records in the WordPress database. Sent and received messages are, however, processed in email systems and may be subject to the controller’s retention rules. Sending an email does not guarantee end-to-end encryption across all email systems. Do not send additional sensitive information in unsolicited messages.

Patient satisfaction questionnaires

The questionnaires for Consultations, Laboratory and Imaging request only scores from 1 to 10 on eight questions. They do not request a name, email address, telephone number or medical information. Responses are recorded in a private WordPress database table and are accessible only to website administrators, including through statistical dashboards and CSV export. The configured reception team may also receive an email notification with the scores. Individual records are automatically deleted after 24 months. To limit automated or repeated submissions, the server temporarily (for up to 10 minutes) uses an identifier derived by hashing the IP address together with an application secret; this identifier is not included in the survey message. Normal server access logs may contain IP addresses, as explained in the security section. Responses are used to assess and improve service quality, not published as reviews.

ProLife Medical AI virtual assistant

The website includes an AI virtual assistant providing general information about consultations, laboratory tests, diagnostic examinations, preparation, locations, appointments and, if enabled by the administrator, prices. The dialogue is transmitted through a secure website service to the OpenAI API to generate responses. The conversation is temporarily held in the memory of the open page to support follow-up questions. The website does not store conversation histories in its database by default. Requests may be temporarily rate-limited through a technical identifier derived from the IP address, and technical server logs follow the general retention policy.

Do not enter your name, Romanian personal identification number (CNP), phone number, email address, individual test results, diagnoses or other sensitive information into the assistant. The system rejects some obvious personal-data patterns, but such a filter cannot guarantee detection of everything voluntarily entered. The assistant does not access medical records and does not replace medical staff. API data are not used by default to train OpenAI models. The provider may retain certain logs for abuse prevention under the contractual and retention terms in force, potentially for up to 30 days unless a different regime has been approved.

Optional voice conversation: the microphone is used only after the user expressly presses the start button and grants browser permission. During a session, audio is sent directly and securely via WebRTC to OpenAI to process speech and generate the spoken response. The WordPress server does not record audio files or transcripts by default. The API provider may process technical data and content under its processing and retention terms. You can stop the microphone with the stop button, by closing the window or switching tabs, or automatically after a maximum of eight minutes. Do not use this feature to transmit personal medical information or emergencies. Text chat and the centre’s reception remain available as alternatives.

Prices are retrieved through an internal function that selects only the service requested and only when price display is enabled. Complete private registers are not sent to the AI model. For privacy questions or to use services without AI, contact the centre’s reception directly.

5. Recipients, security and retention

Access is restricted to authorised personnel of the relevant controller, professionals bound by confidentiality and contracted technical suppliers (hosting, email and medical systems) to the extent necessary to provide the service. Data may be disclosed to institutions or other recipients when required by law or otherwise legally justified. Technical and organisational security measures appropriate to the risks are applied, including HTTPS for web forms and access controls for internal systems.

Retention periods vary. Medical, accounting and insurance-settlement documents are retained in accordance with the rules applicable to each category. Requests and emails are retained as necessary to resolve requests, document activities and meet legal obligations under the controller’s policy. Technical logs are retained for security and operation according to infrastructure administration rules. You may request information on the retention criteria applying to your data.

6. External websites and services

The medical results portal operates on a separate domain; login details are entered there, not on this page. Google Maps is loaded only after you explicitly choose to display a map; Google may then receive technical data and use storage mechanisms under its own policies. Use of external services may involve processing and possible international transfers in accordance with provider policies and applicable law. See the Cookie Policy.

7. Your rights under GDPR

Subject to Articles 12–22 GDPR, you have rights to information and access, rectification, erasure, restriction of processing, portability where applicable, objection and not to be subject to decisions based solely on automated processing producing legal or similarly significant effects. You may withdraw consent where it is the legal basis; withdrawal does not affect prior lawful processing. Some rights may be limited by medical record retention obligations and other legal provisions.

As a rule, the controller responds without undue delay and within one month; GDPR permits extensions in certain circumstances. To protect medical information, proportionate verification of identity may be requested. You may complain to the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) and use the remedies provided by law.

8. Contact for privacy requests

Send requests to the controller responsible for the service, at the postal addresses above, at the centre’s reception, or to office@prolifemedical.ro, indicating the centre and your contact details for a response. Avoid sending identity document copies or medical results before a secure communication method has been agreed.

Information on cookies and browser storage and the website terms of use is available separately. For the legal text, consult Regulation (EU) 2016/679.