EMBRYOS FERTILITY CLINIC S.R.L., a Romanian legal entity, headquartered in BUCHAREST, str. DAMBOVICIOAREI nr. 17 et. 2 ap. 8, Sector 2, registered with the Trade Register Office attached to the Bucharest Tribunal under no. J40/14015/2018, CUI 39936770, European Unique Identifier ROONRC. J40/14015/2018, in the capacity as a Personal Data Controller, processes your personal data in good faith and in pursuit of the purposes referred to in this Privacy Policy, in accordance with the provisions of EU Regulation no. 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC, called the “General Data Protection Regulation” or, for short, the “GDPR”.

This Privacy Policy describes the way EMBRYOS FERTILITY CLINIC uses the information collected and is meant to ensure that our company processes your personal data in good faith, in a transparent manner and in compliance with the European and national legislation in force in the field of personal data protection.

Definition of specific terms

1. “personal data” means any information relating to an identified or identifiable natural person (‘data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
2. “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
3. “controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of processing are determined by the Union or Member State law, the controller or the specific criteria for its nomination may be provided for by the Union or Member State law;
4. “processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
5. “recipient” means a natural or legal person, public authority, agency or other body to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data may be communicated in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of such data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;
6. “genetic data” means personal data relating to the inherited or acquired genetic characteristics of a natural person which provide unique information about that natural person’s physiology or health and which result, in particular, from an analysis of a biological sample taken from the natural person in question;
7. “biometric data” means personal data resulting from specific technical processing relating to the physical, physiological or behavioral characteristics of a natural person which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data. As of the date this policy has been drafted, EMBRYOS FERTILITY CLINIC SRL does not process biometric data;
8. “data concerning health” means personal data relating to the physical or mental health of a natural person, including the provision of healthcare services, which reveal information about his or her health status;
9. “referring physician” means the doctor who recommended, by medical referral letter, the performance of certain medical tests, investigations, examinations, etc.
10. “patient” means the patient who comes to the Clinic either as a direct payer, for requested medical services, or the patient requesting medical services reimbursed by the Insurance Fund by virtue of their status as a subscriber to the social health insurance system, or the patient requesting medical services based on contracts concluded between the Clinic and various collaborators/partners, contracts having as an object the provision of either occupational health services or of medical services by virtue of the patient’s status as a subscriber of a private health insurance;
11. “visitor” means the person who visits (as a carer or a legal representative of a patient, as a services provider, etc.) one of the premises of EMBRYOS FERTILITY CLINIC (including sample collection points and the headquarters of the Department of Occupational Medicine), or accesses or uses the Clinic Website.
12. “data subject” means the person whose personal data are processed.

Personal data processed, purposes and grounds of processing

The personal data we process differ in relation to the established purpose.

Based on your request to undergo a medical act in EMBRYOS FERTILITY CLINIC, you consent to your data being taken over/processed and stored according to the specific legal provisions in the field of health, while in their absence the requested medical act cannot be performed.

EMBRYOS FERTILITY CLINIC shall only process the personal data required to fulfill the purposes shown above and shall not transfer access to them to unauthorized third parties. Processing of personal data by our Clinic shall be conducted only for the purpose for which they have been collected, that of providing the medical services, and shall not be further processed for another purpose that is either not communicated or incompatible with the main purpose for which your data have been initially collected. If, however, there emerges a requirement to process your data for purposes other than those mentioned in this Policy, we shall notify you in advance.

We make sure that the data collected are adequate, relevant and limited to what is strictly necessary for the performance of the medical act/for the provision of the medical service by EMBRYOS FERTILITY CLINIC.

• Purpose and data collected

If you are an EMBRYOS patient:

General information (identification data): name, surname, date of birth, sex, nationality, age, CNP, home or residence address, e-mail, telephone, patient ID, copy of Identification Card, signature, bank details to verify payments by payment orders, and if you are going to be admitted to hospital, identification data of the caregiver (name, surname, degree of kinship, telephone) identity card/passport, insurance card number, insurance code, signature, marital status, citizenship, occupation, capacity as an employee, health data, genetic data, biometric data, medical history, capacity as an insurance subscriber to the state social insurance system or to a private system, sex, age, weight, height, telephone number, e-mail address, profession, bank account, etc. The processing is based on the enforcement of a legal obligation, as well as on the performance of the contract between the parties.

Health data or data related to medical services provision:

General data: weight, height, smoker or non-smoker status, blood group, RH, medical history, discharge summary, allergies, symptoms, diagnosis, medical history (heredo-collateral, physiological and pathological), type of intervention, documents related to the medical activity, such as: referral by the family doctor or by the specialist doctor, medical report, diagnostic code, patient’s signature, quality as a CNAS insurance subscriber or as a subscriber to a private system (in the instance of private health insurance companies), referral note, patient chart, reimbursement of expenses and medical documents during hospitalization (according to case), investigations performed, day and time of admission, patient private room and bed (if hospitalized), discharge summary, time and day of discharge, day/hour/location of sampling, presumptive diagnosis, information on health evolution, allergies, medication prescribed for various pathologies, medical information after the examination, pension slip (if applicable).

Data required to make appointments and to confirm appointments: the Controller may process the following personal data including, but not limited to: name and surname, date of birth, CNP, telephone number, health data (if applicable), e-mail address. Processing is based on the performance of the contract between the parties, but also on your consent.

Data required to carry out preliminary medical examinations or evaluations, remotely, through the ZOOM digital platform, the Privacy Policy of which you can read on the following link; https://zoom.us/privacy. ZOOM digital platform is used by the EMBRYOS Clinic doctors, whenever there is a case of force majeure or in emergency situations, and face-to-face examinations or assessments cannot be performed. Please note that discussions conducted through the ZOOM platform shall NOT be audio or video recorded.

Hospitalization data: referral note, patient chart, reimbursement of expenses and medical documents issued during hospitalization, investigations performed, day and time of admission, patient private room and bed, doctor remarks on visits, evolution of the patient during hospitalization, discharge summary, time and day of discharge, presumptive diagnosis, allergies, medication prescribed for various pathologies, medical information following examination, name, surname and specialty of attending physician (if applicable), name, surname, degree of kinship and telephone of caregiver.

Data required for non-invasive prenatal medical testing: age, race, previous pregnancies, weight, height, smoker or non-smoker status.

Data on medical tests: appointment date and time, data on medical examinations and tests, date, time and location of sampling, sample code, tests results.

Data required for payment documents issuing: in order to establish fiscal documents, we may process data such as, but not limited to: name and surname, domicile, date of birth, CNP, series and number of identity card/passport, telephone number, e-mail address, capacity as an insurance subscriber to the social insurance system or to a private system, profession, bank account. This processing is based on the performance of a legal obligation, as well as on the implementation of the contract between the parties.

Data required to take cognizance of any suggestions or claims, as well as to settle applications/claims: we shall process the following personal data: name, surname, domicile/residence, CNP, telephone, e-mail, health-related data.

If you want to be part of the EMBRYOS team:

Data regarding the recruitment process: name, surname, age, sex, nationality, home or residence address, CV data, work record (as the case may be), level and specialization of studies required in the job description; supporting documents that also include sensitive data, such as criminal record, characterization from the previous job (if applicable), psychological examination certificate (if applicable);

If you access the EMBRYOS website: Data relating to the profiling of EMBRYOS website users, according to the Cookies Policy that you can access here: age, gender, IP, traffic data, geo-location data, device used, operating system, keywords searched by the user according to their concerns.

Data you transmitted through the e-mail address info@embryos.ro name, surname, subject of the request for information and the e-mail address you will use to send the message, telephone number, gender.

Data collected through the Online Appointment form: name, surname, e-mail, phone number, message content.

If you are a visitor of the premises of EMBRYOS FERTILITY CLINIC, processing of your personal data may occur, including, but not limited to: name and surname, domicile, date of birth, CNP, image. 

• Grounds for processing

The conclusion and performance of the contract between you and us; data processing shall be done for the following purposes: in order for EMBRYOS FERTILITY CLINIC to provide the requested medical services: admission/discharge procedures, laboratory tests, investigations, medical examinations and checks, prevention, treatments, provision of medical assistance, provision of services, such as making appointments, reconfirmations or rescheduling, sampling, establishing laboratory tests reports and tests requested by patients, the necessary counseling/consultations before and/or after medical testing (according to case), as well as communicating the results of the medical tests performed, through the communication channels consented by you;

In order to fulfill a legal obligation incumbent on EMBRYOS FERTILITY CLINIC, respectively, by way of example: for the purpose of reporting and reckoning up services to: the Ministry of Family, Health Insurance Funds, the Public Health Directorate, the National School of Public Health, Management and Professional Development in Health, the NTA (National Transplant Agency), the RNT (National Transplant Registry) and the ASSMB (Bucharest Hospitals and Medical Services Administration).

In order to protect the legitimate interest of EMBRYOS FERTILITY CLINIC: organizing appointments or other telephone/e-mail requests of the data subject; guarding and protecting the location by installing video surveillance systems in the inner perimeter of the premises, the storage duration of the images being 30 days; management of suggestions, claims, settling requests/claims; providing for the maintenance and security of the website.

Services promotion using images (photos and/or videos) of doctors or collaborators (on the website, Facebook, Instagram or other means of online communication), if applicable;

Purposes related to marketing, promotion and sale of services offered by EMBRYOS, at events organized by EMBRYOS, or to which EMBRYOS participates;

Based on your consent: your consent to be contacted, to have appointments made and confirmed;

For the submission of the file for the “Social Program of National Interest to Support Couples and Single People, to Increase Birth Rate”;

Reporting by regular mail or e-mail to the Health Care Associated Infection Prevention Service (SPIAAM) and to the Directorate of Public Health (DSP), in order to detect certain infections of patients;

In order to ascertain, exercise or defend a right of EMBRYOS FERTILITY CLINIC in court: recovery of debts registered with the Clinic; defending the rights of the Clinic or of its employees or collaborators.

Processing is necessary for statistical reasons: transmission of legal data to public institutions competent in this field.

Where do we obtain personal data from?

As a rule, the personal data we process are obtained directly from you, upon making appointments or providing the requested medical services.

Place and period of personal data processing

All data collected and processed by EMBRYOS Clinic shall be stored on the Clinic’s own servers, located in Bucharest, Romania. Access to your personal data is restricted, and shall exclusively be granted to your doctor and medical staff with specific responsibilities for processing such data and only restrictedly, respectively only to certain data.

For purposes related to the activity of EMBRYOS, your personal data shall be stored for a limited period of time, in a secure place and in accordance with the applicable conditions and legal provisions, as follows:

∙ Your data required for medical services purposes shall be stored for the duration of the contract for the provision of medical services, respectively for a reasonable period of time, after termination of contracts, including the period of time necessary to fulfill legal obligations under applicable law, consisting of a general period of 50 years, unless longer or shorter storage periods of time are ruled for certain necessary medical documents;

∙ Data processed for accounting purposes, especially those related to invoicing and payments, shall be stored for a period of 10 years, starting with January 1^st of the year following the end of the financial year during which they were drawn up, according to the provisions of the Accounting Law no. 82/1991, as subsequently amended and completed, including based on Law no. 163/2018;

∙ Data on the recruitment process shall be kept for a period of 6 months as of the completion of the recruitment/selection process for the vacancy you applied for;

∙ In case you decide to withdraw your consent to the processing of your data, your personal data shall no longer be processed for this purpose, as of the date of the consent withdrawal, without affecting the validity of data processing carried out before this date;

∙ Your personal data shall also be processed for the duration of the legal obligations to keep certain categories of data or supporting documents, depending on the regulations in force, especially in the field of public health or taxation.

To which entities we shall disclose your personal data?

Under certain specifically regulated conditions, your personal data may be processed by EMBRYOS, through Processors or jointly with other companies, in the latter case, this being a joint controllers type relationship, which shall jointly set the purposes and means of processing, according to the provisions of Article 26 of the GDPR.

In some instances, services providers, such as, but not limited to: IT services and systems providers, various contractual partners, such as: courier companies, may have access to your personal data. Your data may also be transmitted to lawyers, accountants, auditors or other professionals who have the duty of professional secrecy.

In order to ensure provision of complete medical services, your data shall be made available to collaborating doctors or partner clinics and laboratories, with which confidentiality agreements have been concluded.

For the purpose of reporting to state authorities, according to the legal obligations in force, the transmission of your personal data to various public institutions shall be required.

How and when is the transfer of your personal data to third countries made?

If your data are transferred to other companies in other countries, in order to launch, conclude and perform contracts and/or projects with such entities, you shall be informed and the guarantees shall apply accordingly.

What are your rights in relation to personal data processing?

Regarding the processing of your personal data, pursuant to Art. 15-22 GDPR, you are guaranteed a series of rights:

∙ the right of access to data – involves the possibility of filing an application through which you can obtain confirmation as to whether or not data concerning you are being processed and, where that is the case, gain access to the categories of processed data and to additional information regarding the processing carried out or, according to case, you can request a copy of the personal data undergoing processing;

∙ the right to rectification – you have the right obtain, without undue delay, the correction (rectification) of inaccurate personal data concerning you which we are processing;

∙ the right to erasure (also called “the right to be forgotten” in the online environment) – involves the possibility of requesting and obtaining the erasure of your personal data, to the extent that the legal provisions in force allow it;

∙ the right to restriction of processing – you shall have the right to obtain restriction of processing, only in instances specifically provided by law;

∙ the right to data portability – you shall have the right to receive your personal data in a structured format, so that they can be transferred to another controller, by automated means;

∙ the right to object – implies that you shall have the right to object to the processing of your personal data in certain situations and only if the processing in question is based on the performance of a public interest charge or is based on the legitimate interest of the controller;

∙ automated individual decision-making – means that you shall have the right to request and obtain the withdrawal, annulment and reconsideration of any decision that produces legal effects impactive your rights, adopted exclusively on the basis of a personal data processing operation by automated means, for the purpose of assessing personality traits, such as your professional skills, credibility, behavior at work, interests, etc.

∙ Last but not least, please be informed that you shall have the right to turn to the National Supervisory Authority for Personal Data Processing (ANSPDCP) or to any court having jurisdiction in the field of personal data protection.

To enforce these rights, you may contact EMBRYOS based on a written, dated and signed application, sent to the attention of the EMBRYOS Data Protection Officer:

at mailing address: 58-60 Gheorghe Polizu Street, Bucharest, 011062

by e-mail at: info@embryos.ro

Your application shall be considered with the utmost care and a reply shall be sent to you within the legal term of 30 calendar days as of receipt of the application, according to the GDPR provisions. If your application involves a thorough investigation due to the complexity of the request, the one-month deadline may be extended by another month, but you shall be informed of the reasons grounding the need to extend the settlement deadline.

Security and integrity of personal data

We hereby undertake to protect personal data against threats to processing, so the security measures we have put in place are likely to ensure the protection of your personal data.

We take the necessary steps so that our staff is informed and trained to take responsibility for the secure personal data processing. We control access to the personal data we hold and we make sure that personal data is accessed exclusively by persons who have a right to access the personal data held. In this respect, we periodically organize training sessions for our own staff.

We make sure that unauthorized physical access to personal data is prevented and that we impede loss, destruction, damage and alteration of the personal data storage media.

Changes to the personal data processing policy

EMBRYOS, in its capacity as a personal data controller, may modify this policy on personal data processing, so that it may reflect changes in legislation, internal personal data processing practices and procedures, website features or technological advances emerging over a certain period of time. If we make changes that alter the way we process or use your personal data, they shall be published in the updated policy, and the date of entry into force of the policy thus modified shall be published at the beginning of the information note on the processing of updated personal data. Therefore, this information note on the processing of personal data needs to be periodically consulted, for you to be up to date on the latest policies and practices in this field.