Policy policy.

The controller of personal data is Implantološki centar Smile, with its registered address at:

• Trg Stanka Vraza 1, 43000 Bjelovar, Republic of Croatia
• Phone: +385 95 873 5523 · +385 95 381 7798
• E-mail: implantoloski.centar.smile@gmail.com
• Web: implantoloski-centar-smile.hr

Contact person for data protection enquiries: implantoloski.centar.smile@gmail.com (with the note "Personal Data Protection" in the subject line).

The Centre is not currently required to appoint a Data Protection Officer (DPO) within the meaning of Article 37 GDPR, as its core activities do not involve large-scale, regular and systematic processing. Nevertheless, all enquiries may be directed to the contact address above.

We collect various categories of data depending on the stage at which you interact with us:

a) Via the online booking form:

• Identification: first and last name;
• Contact: phone number, e-mail address;
• Communication content: message, preferred appointment time;
• Consent: explicit indication of consent to this Policy.

b) During clinical consultation and treatment:

• Identification: OIB (personal identification number), date of birth, gender;
• Health data (special category — Art. 9 GDPR): medical history, allergies, current therapy, diagnoses, dental status, X-ray/CBCT images, intraoral scans, clinical photography;
• Companion / emergency contact details: in the case of minors and persons under guardianship;
• Billing information: CHIF number (if statutory insurance is used for part of the services), invoicing details.

c) Technical data (website):

• IP address, browser type and language, date and time of visit;
• cookies (see section 09);
• anonymous aggregated website usage statistics — containing no personal data.

• Consultation scheduling and contact — consent, Art. 6(1)(a) and pre-contractual measures, Art. 6(1)(b) GDPR.
• Provision of healthcare services and maintenance of medical records — statutory obligation, Art. 6(1)(c) and protection of the vital interests of the patient, Art. 9(2)(h) GDPR.
• Invoicing and tax obligations — statutory obligation under tax regulations.
• Communication with the dental laboratory for the fabrication of crowns / bridges / dentures — necessary for the performance of the contract with the patient.
• Clinical before/after photography and publication for marketing purposes — exclusively with your separate and explicit written consent, which you may withdraw at any time.
• Marketing communication (newsletter, promotions) — subject to your consent (opt-in).
• Website security and prevention of misuse — legitimate interest, Art. 6(1)(f).

We do not sell your data. Access is granted exclusively to:

• Authorised healthcare professionals of the Centre (doctors of dental medicine, dental assistants) bound by professional secrecy under the HKDM Code of Ethics;
• Dental technology laboratory with which the Centre collaborates — as a data processor, under a Data Processing Agreement (DPA). Only digital scans / impressions and a case code are forwarded to the laboratory, without any direct patient identification data;
• IT and hosting providers: hosting service provider; database provider — as data processors, subject to a DPA and EU Standard Contractual Clauses (SCC) for transfers to third countries;
• Accounting service — exclusively data appearing on invoices (name, OIB, amount);
• Competent state authorities (HZZO, Tax Administration, courts, AZOP) — where required by law.

Google (Enhanced Conversions for Ads): exclusively with your explicit marketing consentfor the purpose of measuring the effectiveness of Google Ads campaigns, we forward to Google your e-mail address and/or phone number in a hashed (SHA-256), pseudonymised form. We do not transmit the content of your message, the type of procedure, or any health-related data. Without marketing consent, nothing is forwarded to Google. You may withdraw your consent at any time via the cookie settings.

Patient health and personal data are stored and processed exclusively within the Republic of Croatia / the European Union. In the event that services with servers outside the EU/EEA are used, the transfer is secured standard contractual clauses of the European Commission (SCC) in accordance with Art. 46 GDPR.

• Web enquiries (booking form): up to 24 months from the last contact, after which they are anonymised.
• Medical documentation: permanently (pursuant to the Ordinance on the Content and Form of Medical Documentation in Dental Medicine and the Healthcare Act — a minimum of 10 years from the last visit of an adult patient, or until the age of 18 + 10 years for minors).
• X-ray and CBCT scans: a minimum of 10 years (in accordance with ionising radiation regulations).
• Accounting documents: 11 years (in accordance with the tax regulations of the Republic of Croatia).
• Clinical photography for marketing: until the withdrawal of your consent; at that point it is permanently deleted from active channels (with possible retention in archival copies for up to 12 months).
• Technical logs: 12 months.

In accordance with the GDPR, you have the following rights at all times:

• Right to access — find out what data we hold about you and request a copy thereof;
• Right to rectification inaccurate or incomplete data;
• Right to erasure ("right to be forgotten") — with the exception of medical records, the retention of which is a statutory obligation;
• Right to restriction of processing;
• Right to data portability — receive your data in a commonly used, structured format;
• Right to object processing based on legitimate interest or direct marketing;
• Withdrawal of consent at any time, without affecting the lawfulness of prior processing.

You may submit your request in writing to implantoloski.centar.smile@gmail.com or by post to the registered address stated in item 01. We will provide a response no later than within 30 days of receiving the request (with the possibility of extension up to 60 days for complex requests, of which you will be notified).

Clinical photography before/after a procedure is carried out exclusively with your explicit and specific written consent on a separate form prior to the procedure. That consent covers:

• the creation of photographs and video recordings for the purpose of medical documentation;
• (optional, at your discretion) their use for educational and marketing purposes — with facial anonymisation if so indicated in the consent form.

You may withdraw your consent withdraw at any time without any negative consequences for future treatments. In such a case, the Centre is obliged to remove the materials from active digital and print channels within 30 days.

This website uses necessary cookies (storing your privacy decision, working sessions) and, with your consent, analytical cookies. You may change your settings at any time via the control panel displayed on your first visit or by clearing your browser storage.

Categories:

• Nužni — always active; without them, the website does not function properly;
• Analytical — anonymously measure website usage; enabled only with explicit consent (opt-in).

We currently do not use third-party marketing cookies (Facebook Pixel, Google Ads remarketing, etc.). Should these be introduced, the Policy will be updated and your explicit consent will be sought.

In-clinic services are provided to minor patients exclusively in the presence of, and with the written consent of, a parent or legal guardian, in accordance with Art. 8 of the GDPR and Croatian regulations. The web booking form is not intended for persons under the age of 16, and we do not knowingly collect their data; should we identify that data has been submitted by a child without guardian consent, we will permanently delete it.

If you believe that the processing of your data violates the GDPR, you have the right to lodge a complaint with the supervisory authority — Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr, e-mail azop@azop.hr, tel. +385 1 4609 000.

Recommendation: before contacting AZOP, please reach out to us directly — most matters can be resolved by mutual agreement in a shorter timeframe.

The Centre implements reasonable and appropriate technical and organisational security measures, including:

• encryption in transit (HTTPS/TLS) and at rest for sensitive records;
• access control via passwords, two-factor authentication and limited-duration tokens;
• access restricted to authorised personnel only, on the principle of "least necessary privileges";
• regular security backups of medical records;
• training of staff on personal data protection.

Despite this, no system is entirely secure. In the event of a personal data breach that poses a risk to the rights and freedoms of data subjects, the Centre will notify AZOP within 72 hours and, where necessary, directly inform the affected individuals.

We may amend this Policy from time to time in order to comply with applicable law or business practice. All amendments are published on this page along with the date of the most recent update. Material changes are additionally announced via a notice on the homepage at least 15 days prior to taking effect.