DrAtlas Privacy Policy
Version 28.09.2026 — revizia 2 · In force from 28.09.2026
This is Part V of the unified DrAtlas document. It explains what data we process, why, on what basis, with whom we share it, how long we keep it and what rights you have, under Regulation (EU) 2016/679 ("GDPR") and Romanian law. The rest of the document is in the Terms of Use, and the agreement with doctors in the Data Processing Agreement (DPA). This is a translation; the Romanian version prevails.
37. Controller and contact
ALTANET S.R.L., tax ID 15748710, J2003001373160, registered office Str. Amilcar Sandulescu 11 Bl. A32 Sc. 1 Ap. 13 Cod 200689 is the controller for managing accounts, running and securing the Platform, doctors' subscriptions, reviews and its own obligations.
Data contact: hello@medi-max.ro
The data protection officer (DPO) is being appointed; until then, data requests go to the address above.
A data protection impact assessment (DPIA) has been carried out for the processing of health data.
For medical records and patient care, the doctor/practice is the controller. ALTANET acts as a processor for hosting and running the tools used by the doctor, under Annex 1.
38. Data we process
Depending on the account and features, we process:
- name, e-mail, phone, address, hashed password, date of birth, sex and an optional photo;
- data about family members and representation (name, phone, e-mail, date of birth, sex);
- the doctor, specialty, service, location, date/time and status of the appointment, and the notes you add;
- cancellations, rescheduling and no-shows;
- messages, documents and transmission metadata;
- health data entered by the patient or the doctor;
- reviews, the rating and the link to the appointment;
- the documents accepted and their version (terms, policy, DPA, payment mandate) and the date of consent for health data;
- professional data, verification documents, practice, services, prices and schedule;
- the doctor's plan, the status and technical identifiers of Stripe payments, and the card brand, last four digits and expiry month/year;
- an identifier cryptographically derived from the phone number, used to prevent repeated use of the free trial;
- IP, device, sessions, sign-in events and security logs;
- the push token and the delivery status of e-mails/SMS;
- approximate location, used to order results by distance, only if you grant permission; we do not save it to your account.
We do not receive or store the full card number or the CVC.
You can search for doctors and view their profiles without an account. In that case we create no profile: we only process what is needed to show you the results (your IP address, your search criteria and, if you allow it, your approximate location) and do not store them.
39. Sources of data
Data comes from the user, the representative, the doctor/practice, the device, the chosen sign-in provider (Google or Apple), Stripe for payment status and communications providers for delivery. Professional data may be checked in registers or with competent bodies.
40. Purposes and legal bases
| Purpose | Main legal basis |
|---|---|
| Account, sign-in and support | Performance of the contract |
| Search and appointments | Performance of the contract |
| Sending messages/documents | Performance of the contract; for medical content the relevant condition in Art. 9 GDPR also applies |
| Medical records and care | Set by the doctor; usually Art. 9(2)(h) GDPR; ALTANET processes under instructions and Annex 1 |
| Health data processed by ALTANET in the app (appointments, own documents, family members) | Explicit consent — Art. 6(1)(a) and Art. 9(2)(a) |
| Verifying doctors | Legitimate interest and applicable obligations |
| Subscription, payments and invoicing | Contract and legal obligation |
| Security, fraud prevention and logs | Legitimate interest and legal obligations |
| Reviews and moderation | Providing the feature and legitimate interest; reviews must not include clinical details, and the name appears only as first name and initial |
| Account/appointment notifications | Contract and legitimate interest, by type |
| Marketing | We do not currently send any; if we do, based on consent |
| Authorities and disputes | Legal obligation and defence of rights |
Consent can be withdrawn without affecting earlier processing. Withdrawing it may stop the feature that needs that data.
41. Recipients and providers
Data is shared only as far as needed with:
- the recipient doctor;
- the practice/clinic staff to whom the doctor has granted the necessary permissions;
- authorities, courts and advisers bound by confidentiality, where necessary.
Current technical providers:
| Provider | Role | Data | Where |
|---|---|---|---|
| ALTANET (own infrastructure) | Hosting of servers, database, files, e-mail | All Platform data | Romania |
| Twilio Inc. | Processor — SMS (codes, confirmations, reminders) | Phone number, SMS text | USA |
| Expo (650 Industries, Inc.) | Processor — push notification delivery | Push token, notification text | USA |
| Apple Inc. (APNs) / Google LLC (FCM) | Push notification delivery on iOS / Android | Push token, notification text | USA |
| Google LLC / Apple Inc. | Sign-in, only if you choose it | E-mail, name, identifier | USA |
| Stripe | Doctors' subscription payments (independent controller for payment data) | Doctor's billing and payment data | EU (Ireland), with access from the USA |
| OpenStreetMap Foundation | Maps and address search | IP address, search text (not account data) | United Kingdom |
The list is updated before a new provider is added; doctors are notified at least 30 days in advance (Annex 1, A6).
We do not sell data, use behavioural advertising, or third-party analytics or crash reporting, and we do not use medical content to train AI models.
42. Transfers outside the EEA
Platform data is stored in Romania. It leaves the European Economic Area only through the providers above that operate outside it:
- USA — Twilio, Expo, Apple, Google and Stripe's access: based on the EU–US Data Privacy Framework adequacy decision for certified providers, otherwise on the European Commission's standard contractual clauses in these providers' contracts;
- United Kingdom — OpenStreetMap: based on the European Commission's adequacy decision for the United Kingdom.
Only the data strictly needed for the feature leaves through these providers (for example a phone number and the text of an SMS); medical records, documents and messages stay in Romania.
43. Cookies and similar technologies
DrAtlas does not use analytics, advertising or profiling cookies and does not use third-party crash reporting. We use only strictly necessary elements, which do not require consent:
| Element | Where | Purpose | Duration |
|---|---|---|---|
| Session cookie (dratlas-session) | Website and web panel | Keeping the session and sign-in | Until sign-out or after 120 minutes of inactivity |
| XSRF-TOKEN | Website and web panel | Protection against forged requests | As long as the session |
| remember_web_* | Web panel | "Remember me", only if you tick it | Until sign-out |
| Secure storage on the phone (Keychain / Keystore) | Mobile app | Session, chosen language, events added to the calendar | Until sign-out or uninstall |
If non-essential technologies are introduced, we will ask for the corresponding choice before activating them.
44. Notifications and confidentiality
E-mail, SMS and push carry only the minimum information needed. Medical content is accessed after signing in to the Platform and is not included by default in lock-screen notifications: by default, push notifications only say "You have a new notification", and details can be turned on in the profile.
Users can configure the available channels. Mandatory security or contractual messages may be sent regardless of preferences.
45. Retention periods
| Data | Period |
|---|---|
| Account and profile | Life of the account; then deletion or anonymisation from active systems (section 52) |
| Unused accounts | After 3 years without any sign-in you receive a warning e-mail; if you do not sign in within 30 days, the account is deleted |
| Future appointments | Until they take place or are cancelled; on account closure they are cancelled and participants informed |
| Appointment history in the Platform | As long as the account exists; on deletion it is anonymised, separately from the records the doctor keeps by law |
| Administrative messages | As long as the account and conversation exist; deleted when the account is deleted |
| Clinical messages/medical records | Period set by the doctor and the law; ALTANET only under Annex 1. After a doctor's account closes: 90 days for handover, then deletion |
| Personal documents | Until you delete them or the account is deleted; the doctor's copy is separate |
| Professional verification documents | For the life of the doctor account; deleted when it closes |
| Anti-abuse identifier derived from the phone | 3 years from the use of the free trial, to prevent its repeated use; then deleted automatically |
| Invoices/supporting documents | Usually 5 years, calculated under accounting law, with applicable exceptions |
| Security logs | 12 months (see below) |
| Reports/challenges | While being resolved and at most 12 months afterwards, if necessary |
| Verification codes | Expire after 15 minutes; deleted when used, when a new code is issued or after expiry |
| E-mail/SMS delivery records | 12 months; also deleted when the account is deleted |
| Push token | Until revoked, sign-out or account deletion |
| Backups | At most 30 days from deletion in the active system (daily backup, overwritten after 30 days) |
| Proof of acceptance and payments | Life of the contract and the period needed to defend legal rights/obligations |
Backups are isolated copies used to restore the service after an incident. Data deleted from the active system may remain temporarily in a backup until it is overwritten, without being used; if a backup is restored, deletions made in the meantime are re-applied before the service goes back online.
Security logs record admin panel sign-ins (successful and failed, with IP and browser), temporary lockouts after wrong passwords, administrative actions and e-mail/SMS delivery. Only DrAtlas administrators can see them, and they are extracted only to investigate incidents or at the lawful request of an authority. They are kept for 12 months.
46. Security
We apply measures appropriate to the risk, including encryption in transit (HTTPS), private storage of documents reachable through temporary links, role-based access, hashed passwords, temporary account lockout after wrong passwords, two-factor authentication for the admin panel, logging of administrative access, checking the type and size of uploaded files, backups and an incident procedure.
Messages are intended only for the participants, but we do not describe the service as end-to-end encrypted without a technical audit (Terms, section 32).
47. Automated decisions
We do not make automated diagnoses, recommendations or medical decisions. There are no automated medical questionnaires.
The system may detect failed payments, spam, security risks or repeated cancellations. A limit on bookings after repeated cancellations or no-shows is applied only after human review; any significant limitation can be challenged.
48. Your rights
Under the GDPR you have the right to information, access, rectification, erasure, restriction, objection, portability, withdrawal of consent and protection against certain automated decisions.
You can correct most data directly in the app and download a copy of your data in Profile → Download my data. Other requests go to hello@medi-max.ro. We may verify identity proportionately. We usually reply within one month.
For records controlled by the doctor, the request is addressed to the doctor/practice. If we receive it, we forward it securely and assist under Annex 1.
You can complain to ANSPDCP, dataprotection.ro, and go to court.
49. Minors
The account is intended for persons aged at least 18. A parent/representative may manage a minor's appointment and must provide only the data needed. The doctor sets the conditions for consent to the medical act.
50. Impact assessment and data protection officer
Given the nature, scale and systematic character of processing health data, messages and documents, ALTANET assessed the need for a data protection impact assessment and carried it out before launch. The data protection officer is being appointed; their contact details will be published here.