Personal data processing policy

The controller of personal data is Mind for Soul SRL, with its registered office in Bucharest, str. Dr. Iacob Felix no. 21, room 4, registered with the Trade Register under no. J2017001500033, tax ID (CUI) 37807558 (“Mind for Soul SRL” or “we”).

For any question or request regarding your personal data, contact us at contact@mindforsoul.ro or on 0747 277 727.

This policy is drawn up in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation – “GDPR”) and applicable Romanian law.

The policy applies to the personal data of:

• visitors to the mindforsoul.ro website;
• people who contact us through the form on the site, by e-mail, by phone or via WhatsApp;
• patients who use the patient management service;
• family members who contact us on behalf of an adult patient.

3.1. Identification and contact data: first and last name, phone number, e-mail address.

3.2. Health data: the description of the medical situation, information about an existing diagnosis, the medical service sought, attached medical documents (test results, medical letters, discharge notes, etc.), as well as medical information shared during the service. This data belongs to the special categories set out in Article 9 GDPR and receives a higher level of protection.

3.3. Billing and payment data: the name and, where applicable, the address needed to issue the invoice, and information about the payment made (amount, date, payment method). We have no access to your card details.

3.4. Correspondence: the content of messages exchanged with us by e-mail, WhatsApp or other channels.

3.5. Technical data: information collected through cookies and similar technologies, described in the Cookie policy.

4.1. Reviewing your request and the initial assessment discussion. Basis: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR) and, for health data, your explicit consent (Article 9(2)(a) GDPR), given by ticking the dedicated box in the form.

4.2. Providing the patient management service, including guidance to doctors and medical units and support in organising the medical journey. Basis: performance of the contract (Article 6(1)(b) GDPR) and explicit consent for health data (Article 9(2)(a) GDPR).

4.3. Sharing data with the doctors and medical units the patient is guided to. Basis: explicit consent (Article 9(2)(a) GDPR).

4.4. Invoicing and meeting tax and accounting obligations, including reporting invoices in the RO e-Factura system. Basis: legal obligation (Article 6(1)(c) GDPR).

4.5. Communications about the service (replies to requests, appointments, case-related updates). Basis: performance of the contract (Article 6(1)(b) GDPR).

4.6. Establishing, exercising or defending legal claims. Basis: our legitimate interest (Article 6(1)(f) GDPR) and, for health data, Article 9(2)(f) GDPR.

4.7. We do not use your data for marketing purposes and we do not take decisions based solely on automated processing, including profiling.

Providing data is voluntary. Without contact details and information about the medical situation we cannot review the request or provide the service. Billing data is required to meet legal obligations.

Data is accessed only by Mind for Soul SRL staff involved in providing the service, who are under contractual confidentiality obligations. Data may be shared, strictly as necessary, with:

• the doctors and medical units the patient is guided to, in order to provide the service;
• technical service providers: the website hosting provider (Vercel Inc.) and the e-mail service provider (Microsoft Ireland Operations Limited – Microsoft 365);
• banking institutions (ING Bank N.V. Amsterdam – Bucharest Branch and Revolut Bank UAB), for payment processing;
• the accounting services provider, for financial and accounting records;
• public authorities (for example ANAF), where the law requires it.

Providers processing data on our behalf do so only on our instructions and under a contract imposing confidentiality and security obligations, in line with Article 28 GDPR. We do not sell or rent personal data.

7.1. Some of our technical providers may process data outside the European Economic Area (for example, in the United States). In such cases the transfer takes place only under the safeguards provided by the GDPR, such as European Commission adequacy decisions or standard contractual clauses.

7.2. For second medical opinion services, patient data may be sent to doctors and medical units in European Union member states or outside the Union. Transfers to states outside the European Economic Area take place only with the patient's explicit consent, after they have been informed that the state in question may not offer a level of data protection equivalent to that in the European Union (Article 49(1)(a) GDPR).

• Requests that do not result in the purchase of the service: 6 months from the last communication.
• Data on cases taken on (including health data and correspondence): for the duration of the service and 3 years after the case closes.
• Invoices and financial-accounting documents: for the period required by financial, accounting and tax legislation.

Once these periods expire, data is deleted or anonymised, unless the law requires it to be kept longer or it is needed to defend legal claims. You can ask for your data to be deleted earlier, under section 9 of this policy.

Under the GDPR, you have the following rights:

• the right of access to the data processed;
• the right to rectification of inaccurate or incomplete data;
• the right to erasure (“the right to be forgotten”);
• the right to restriction of processing;
• the right to data portability;
• the right to object to processing based on legitimate interest;
• the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal. Withdrawing consent may make it impossible to continue the service;
• the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral Gheorghe Magheru no. 28–30, sector 1, Bucharest, www.dataprotection.ro.

To exercise your rights, write to us at contact@mindforsoul.ro. We will reply within one month of receiving the request; this period may be extended by a further two months under Article 12 GDPR, in which case we will inform you. To protect your data, we may ask for additional information to confirm your identity.

We apply appropriate technical and organisational measures to protect data against unauthorised access, loss or disclosure, including: transmitting data over a secure connection (HTTPS), restricting access to authorised staff only, password-protected accounts, and confidentiality obligations for staff and collaborators.

WhatsApp is a third-party service and is subject to its own privacy terms. We recommend that you do not send medical documents via WhatsApp and that you use the form on the site or the e-mail address contact@mindforsoul.ro instead.

If you send us data about another adult (for example, a family member), you confirm that you have their agreement or are their legal representative, and that you have informed them about this policy.

Mind for Soul SRL's services are intended exclusively for adults. We do not knowingly process data about minors. If we learn that we have received such data, we will delete it.

Information about the use of cookies on the site is available in the Cookie policy, published on the site.

We may update this policy. The version in force is published on the site and states the date of the latest update. In the case of significant changes, we will inform you through the available communication channels.

For any questions about the processing of personal data, contact us at contact@mindforsoul.ro or on 0747 277 727.