Privacy policy

01 Who controls the data

The controller is Specijalistička oralno-hirurška ordinacija Dr Orjen (Klinika ORJEN), Karađorđeva 22-24, lokal 4, 15300 Loznica, Srbija.

For any question or request about your data, write to office (at) drorjen (dot) com or call +381 62 837 3787. We reply within 30 days at the latest.

02 What we receive

The contact and booking form: your name and phone number and, if you wish, your email address, the treatment you are asking about and a message. With the enquiry we record the time it was sent, the page it came from and the IP address.

The enquiry is first written to our server and only then sent to our email address, so that it is not lost if email delivery fails.

To limit spam, the server keeps a counter of sent messages per IP address for one hour, under a one-way hashed name.

When you call us, email us or write on WhatsApp, we see your number or address and what you write, and we use it to answer you.

Like every web server, ours records each request: the IP address, the time, the page asked for and the browser type.

03 Health information

No field asks for health information. Please do not put diagnoses, findings or other health details into the message; we discuss those at the examination or by phone.

If you do tell us something about your health, that is special category data. We use it only to answer you and arrange an examination, on the basis of your consent and for the provision of health care, and only the practice staff who answer enquiries see it.

Clinical records created after an examination are kept separately from the website and under the rules governing medical records.

04 Why we collect it and on what basis

We use the form details to answer your enquiry and, if you want, to arrange an appointment. The basis is taking steps at your request before entering into a contract.

We use the IP address, the counter and the Cloudflare Turnstile check only to protect the form from abuse, and the server records only to keep the site running and secure. The basis is our legitimate interest.

We do not use the details for marketing messages, we do not build user profiles and we make no automated decisions.

05 Who else sees it

Our hosting and maintenance provider: the site's server is in Germany, in the EU. The enquiry record is kept on it and the enquiry leaves it as email.

Our email provider, which holds the mailbox enquiries arrive in.

Cloudflare delivers the site and protects it from abuse, so it briefly sees your IP address and browser type. When you start filling in the form, Cloudflare Turnstile also loads, a check that tells people apart from automated programs; it sees your IP address and browser and device details, but not what you type into the form.

Google: on the Booking page and some pages about the places we cover you can open a Google map. Only when you click Show map does your browser load it from Google's servers, and Google then sees your IP address and browser type; Google's privacy rules apply to the map.

WhatsApp, a service of Meta, carries the messages you send us on WhatsApp; that service's own terms and privacy rules apply to them.

We do not sell your details and do not pass them to third parties for marketing.

06 Transfers outside Europe

Cloudflare, Google and Meta are US companies and may process data there. For that they rely on the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.

07 How long it is kept

The enquiry record on our server: 12 months from receipt, then it is deleted automatically.

The anti-spam counter: 1 hour.

The enquiry email in our mailbox: for as long as we keep our mail. We delete it if you ask.

Server records: about 14 days, then deleted automatically.

08 Your rights

You may request access to your data, correction of anything inaccurate, erasure, restriction of processing and portability, and you may object to processing. You can withdraw any consent you gave at any time.

Send requests to office (at) drorjen (dot) com. We reply within 30 days at the latest.

If you believe your rights have been breached, you may complain to the Serbian data protection authority, the Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti, poverenik.rs. Visitors in the EU may also complain to the authority in their own country.

09 Children

This site is not aimed at children under 15. If the patient is a minor, the enquiry should be sent by a parent or guardian.

10 Security

The site is served over an encrypted connection (HTTPS). Access to the enquiry record on the server is restricted, and only the people in the practice who need it have access to the mailbox.

11 Changes

If the way we handle data changes, this page changes and the date below is updated.