In this information note we explain how your personal data is processed by MEDICAL EXPRESS SRL. We assure you that your personal data is processed responsibly and in accordance with the legislation on personal data protection applicable at European and national level.
For the purposes of this information note, MEDICAL EXPRESS SRL is the personal data controller. You can find information about our identity and contact details below. You can also find the contact details of the data protection officer of MEDICAL EXPRESS SRL below.

We, the employees of MEDICAL EXPRESS SRL, and our partners take the respect for your data very seriously. Compliance with the legislation on the protection of personal data and good practices in the field, as well as ensuring a climate of transparency, safety and trust for our patients is a priority for us, for which our employees, collaborators, partners and management firmly declare their support.

We encourage you to take the time to read it in its entirety and carefully and to ensure that you fully understand it. To facilitate the reading of the document, we have included a glossary at the end of this note that explains the main concepts used (e.g. “personal data”, “processing”, etc.). Do not hesitate to communicate any concerns you may have to the dedicated e-mail address dpo@medicalexpress.ro. The content of this information note is purely informative and does not affect the rights granted to you by law.

Medical Express SRL is a distributor of medical devices and assistive technologies and devices and access technologies, with national coverage, in contractual relations with all County Health Insurance Houses and with the National Agency for Persons with Disabilities.

Our contact details:
Full name: MEDICAL EXPRESS SRL
Registered office address: 16 Drumul Taberei Street, block A1, apartment 4, Sector 6, Bucharest, postal code 061384
Administrative headquarters (correspondence/office address): Doctor Lister Street, no. 17, Sector 5, Bucharest
Phone number: 021 410.93.23, Fax: 021.410.55.83, e-mail: office@medicalexpress.ro
Data Protection Officer phone number: 021.410.93.23, e-mail: dpo@medicalexpress.ro

The personal data relating to you that we will process is data obtained directly from you and includes the following categories of data:

Medical data (sensitive personal data): diagnosed medical condition, medical device used, medical recommendations;

Personal details : name/surname, gender, date of birth/age, citizenship, personal identification number (CNP), date of issue of the identity card, date of expiry of the identity card, signature. If you visit us at the workplace, we will process your image taken by CCTV video surveillance cameras (where available, these are indicated by visible signs);

Contact and delivery details : home/residence address, mobile/landline phone number, fax number, email address.

Payment details : billing address, bank account or bank card number/IBAN code, name and surname of the bank account or bank card holder (who may be a natural person other than you, if they have paid an invoice in your name and for you), date from which the bank card is valid, date of expiry of the bank card.

Insurance details : insured/uninsured status, CASJ with which you are insured.

Data relating to purchases and interaction with us : records of your interactions with us; details relating to the history of your purchases from us.

As indicated in the list above, you may provide us with information about other individuals – for example, the medical condition and medical device used by your relative or the person you represent. When this relates to identified or identifiable individuals, we will treat this information as personal data of those individuals and will also provide them with the necessary protection.

For the delivery of settled medical devices:

At the time of submitting the decision to procure medical devices issued by CASJ and the medical recommendation or during our collaboration, you will provide us with data for:
• Your identification;
• Taking orders;
• Preparing settlement invoices to CASJ.
The data includes: name, surname, home and delivery address, CNP, signature, medical condition, device recommended by the prescribing physician, and physician data (name, surname, specialization, hospital, initial number).

For devices ordered from the online store www.medicalexpress.ro:
Data required for issuing the invoice and delivering the devices: (last name, first name, delivery address, CNP, email address, contact phone number.)

For medical professionals enrolling in courses:
The data provided includes: name, surname, employer, specialization.

For collaborators (concluding service or purchase contracts):
The data provided includes: name, surname, CNP, delivery address, telephone number, email address.

Data collection and processing
Data may be collected through (recorded) telephone calls, forms on the website www.medicalexpress.ro for placing orders, personalized advice on www.stomaterapie.ro, and registration in the Facebook support group ("Stomaterapie Support Group") with your freely expressed consent.

Given the specific nature of our activity (marketing and delivery of medical devices to you), it is necessary for us to collect or process your personal data.

We will carry out this processing based on the following legal grounds:

Scope	Personal data	Legal basis
Delivery of settled medical devices	Name, surname, home address, delivery address, CNP, signature, medical condition, recommended medical device, prescribing physician details	Execution of a contract (Art. 6 para. 1 lit. b), Legal obligation (Art. 6 para. 1 lit. c)
Issuing invoices and delivering devices ordered online	Name, surname, delivery address, CNP, email address, contact phone number	Execution of a contract (Art. 6 para. 1 lit. b)
Marketing communications	Name, surname, email address, telephone, marketing consent	Consent (Art. 6 para. 1 lit. a)
Registration of professionals for medical courses/congresses	Name, surname, employer, specialization	Execution of a contract (Art. 6 para. 1 lit. b)
Managing internal schedules and records	Name, surname, appointment details, contact details	Legitimate interest (Art. 6 para. 1 letter f)
Managing routine correspondence	Name, surname, contact information	Legitimate interest (Art. 6 para. 1 letter f)
Resolving complaints and requests	Name, surname, contact information, request details	Legitimate interest (Art. 6 para. 1 letter f)
Conclusion of service or purchase contracts	Name, surname, CNP, delivery address, phone number, email address	Execution of a contract (Art. 6 para. 1 lit. b)
Video surveillance for the safety of goods and people (for deliveries from work points)	Name, surname, CCTV image	Legitimate interest (Art. 6 para. 1 letter f)
Representation in court and before authorities	Name, surname, contact details, details about the legal dispute	Legitimate interest (Art. 6 para. 1 letter f)
Debt recovery	Name, surname, contact details, details about the claim	Legitimate interest (Art. 6 para. 1 letter f)
Data processing in urgent cases in the field of public health	Name, surname, medical condition, recommended medical device, prescribing physician details	Public interest in the field of public health (Art. 6 para. 1 letter e), Processing of sensitive data (Art. 9 para. 2 letter h)
Improving our website and user experience.	Device location, IP address, Correspondence between us and you	Before using cookies to collect this data, we will ask for your consent via the cookie banner.
Online social media interaction. This may include providing information about our products, participating in contests, receiving promotional codes or free products, and communicating with us. You can also receive private messages to answer your questions or to chat privately.	You decide what data you share with us, depending on your privacy settings. You sign up to receive information from us on Facebook by pressing the Like button. Social networks allow different interactions with your personal data, depending on what information you choose to provide us (e.g. name, contact details, profile). Personal data collected on Facebook: · First and last name from your Facebook account · Messages sent to our Facebook page Comments on our posts	By clicking the Like button on social media, you have given your consent for us to use your data. We also have a legitimate interest (business development and marketing strategy analysis) because you have made your data public and shown your interest in our products.

The main goals are:

• Delivery of medical devices to you, as well as recording of medical services provided;

• Identifying you and the services provided. Informing you, as our client, about the legislation in the field of medical devices and the formalities of the Health Insurance Houses in order to receive free medical device settlements to which you are entitled;

• Marketing communications . Communicating with you by email, mobile or landline phone, telephone messages (SMS), messages sent on social media platforms) news regarding medical devices used, newsletter subscription or providing other information that may interest you;

• Managing our communications and IT (information technology) systems . Managing our communications systems; managing our IT security; conducting security audits of our IT networks, issuing reports to competent institutions or repairing system errors;

• Financial management . Issuing vouchers, invoices and receipts to you; receiving payments from you including recording payments made by another person on your behalf; recovering debts from you (including through companies specialized in debt recovery - details below, in the section on the transmission of data about you); returning sums of money to you; sending notifications; preparing financial/operational reports, activity reports and issuing financial/contract statements;

• Dispute resolution . Formulation of claims and defenses before public authorities and other entities that resolve disputes;
• Surveys. Conducting surveys and asking you questions to obtain your opinion on our products;
• Improving products and services . Identifying potential problems with our existing products in order to improve them (including by conducting audits) or to resolve your complaints;

• Surveillance of MEDICAL E XPRESS SRL locations according to legal provisions. CCTV systems installed for surveillance of workplace spaces.

Generally, we do not disclose your data to other companies, organizations or individuals. However, in certain situations, we may disclose personal data to:

Public authorities. From Romania or abroad, especially health authorities (National Health Insurance House, County Health Insurance Houses, Ministry of Health, etc.), upon request or on our initiative, in accordance with the legislation.

Professional consultants. Accountants, auditors, lawyers and other external professionals, required by law or contract to maintain the confidentiality of your data.

Persons authorized by us. Natural or legal persons who provide services for Medical Express SRL (e.g. payment services, debt recovery, archiving or document destruction), with a contractual obligation to comply with data protection legislation.

Acquirers or potential acquirers. In the event of a sale or transfer of our business, shares or assets, they will be required to maintain the confidentiality of data.

Contractual partners. Marketing service providers or home care companies with whom we have contractual relationships.

Processors. When we use natural or legal persons to process data on our behalf, we ensure that they:
Process data only according to our written instructions.
Implement effective measures to protect data confidentiality and security.
Comply with all legal obligations regarding data protection.
They will enter into a contract with us, in accordance with legal data protection requirements.

At this time we do not transfer and do not intend to transfer your personal data or part of it to other companies, organizations or individuals in third countries or to international organizations.

If it is necessary for us to transfer your data to any of the above destinations, we will send you a new information note regarding this in advance.

Unless you object to the processing of your personal data by us and/or request the deletion of your personal data, the following retention periods apply, in accordance with our data retention policy, for the following categories of personal data:

Your data that is necessary for the execution of the contract for the supply or sale of medical devices, the provision of medical services or of another nature, will be stored for the period of time necessary to fulfill the legal obligations provided for by applicable law.

In the case of marketing communications, the minimum data will be stored for a period of 3 years or until the withdrawal of Consent.

For fiscal activities (invoice operations) and for internal statistical activities, we will retain your data for a period of 10 years.

The data resulting from video surveillance and telephone call recording will be stored for a period of 30 calendar days, in accordance with the grounds provided for by the legislation in force;

In order to comply with the principle of data minimization, we are firmly committed to not collecting more data than is strictly necessary to fulfill our common purposes and also not to store your personal data for a longer period than is strictly necessary.

We are always concerned about protecting our servers and the data of our customers and others from unauthorized access, modification, disclosure or destruction. To ensure data security, we have implemented the following measures:

Security Policies . We adopt and constantly review data protection policies, implementing physical and electronic measures to prevent unauthorized access. We monitor the application of these policies and compliance with data protection legislation.

Data minimization. We only process data that is necessary, adequate and relevant for our purposes.

Restricted access. Access to personal data is only permitted to employees and collaborators who have a strict need to know. All of them have strict confidentiality obligations.

Staff training . We constantly provide training to employees and collaborators on data protection legislation and best practices.

Data anonymization. We anonymize or pseudo-anonymize data, where possible, to prevent identification of individuals.

Supplier Control. We include data protection clauses in contracts with suppliers who process data for us. Although we take all reasonable steps to ensure the security of your data, MEDICAL EXPRESS SRL cannot guarantee the absence of any security breach or the impossibility of penetrating security systems. In the unfortunate and unlikely event that such a breach occurs, we will follow legal procedures to limit the effects and inform the data subjects.

• Right of access to data . You have the right to obtain access to your data that we process or copies thereof; you also have the right to obtain from us information regarding the nature, processing and disclosure of such data.
• Right to rectification of data . You have the right to obtain rectification of inaccuracies in your data that we process.
• Right to erasure (“right to be forgotten”). You have the right to obtain from us the erasure of your data that we process.
• Right to restriction of data processing . You have the right to request restriction of the processing of your data.
• Right to object . You have the right to object to the processing of your data by us or on our behalf.
• Right to data portability . You have the right to obtain the transfer of the data we process about you to another controller.
• Right to withdraw consent . Where we process your data on the basis of your consent, you have the right to withdraw your consent; you can do so at any time, at least as easily as you initially gave us your consent; withdrawal of consent will not affect the lawfulness of the processing of your data that we carried out before the withdrawal.
• Right to lodge a complaint with the supervisory authority . You have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing, with headquarters at Bulevardul General Gheorghe Magheru 28-30, Bucharest, regarding the processing of your data by us or on our behalf. However, we ask you to contact us beforehand to resolve any misunderstanding or dissatisfaction, amicably. We remain at your disposal with all due care.

To exercise one or more of these rights (including the right to withdraw your consent, where we process your data on the basis of it) or to ask any questions about any of these rights or any provision of this information notice or about any other aspects of our processing of your data, please use the contact details in section 2 above (Our Contact Details) at any time.

We will try to respond as quickly and completely as possible to all your questions and concerns and to facilitate the exercise of your rights.

If you do not wish to provide us with the data mentioned in this information, it will not be possible for us to provide you with the services you request (purchase in the case of medical devices purchased over the counter, free delivery and settlement of medical devices to CASJ).

We may periodically modify this information note. We will inform you in advance about this and guarantee that future documents will also be drawn up in strict compliance with the requirements of the law. We will also post this information note on our website www.medicalexpress.ro , in the GDPR section.

Personal Data Processing Supervisory Authority: Independent public authority that supervises compliance with data protection legislation. In Romania, this authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP).

Special categories of personal data (sensitive data): Data revealing racial/ethnic origin, political opinions, religion, philosophical beliefs, trade union membership, genetic data, biometric data (for identification), data about health, sex life or sexual orientation.

Collaborators: People with medical degrees (excluding doctors) who have a collaboration contract with us and train clients.

Personal data: Information about an identified or identifiable natural person (e.g. name, CNP, address, email, telephone, diagnosis, genetic, biometric, location data).

Controller: The person or entity that decides why and how personal data is processed. In our relationship with you, we are the controller and you are the data subject.

Processor: The person or entity that processes personal data on behalf of the controller, other than the controller's employees.

Data subject: The natural person whose personal data are processed. In our relationship with you, you are the data subject.

Processing of personal data: Any operation performed on personal data, such as collection, storage, modification, use, deletion, etc., whether manually or automatically.

Third country: A country outside the European Union and the European Economic Area.

GROUP PURPOSE

The purpose of this group is to provide general advice regarding the use of certain medical devices, nutrition specific to certain conditions, or social integration. We do not provide specialized medical advice, as we are not authorized to do so. Members are encouraged to consult qualified medical professionals for specific recommendations.

CONSENT AND PROCESSING OF PERSONAL DATA

By joining this group, you express your explicit consent to the processing of your personal data, including sensitive data (health data), in accordance with Regulation (EU) 2016/679 (GDPR). Access to the group and interaction with other members implies that your data and posts can be seen by all members of the group.

If you do not agree to this policy, please do not request to join the group.

CONFIDENTIALITY AND DATA PROTECTION

Post accessibility: All posts made within the group are visible to group members. We recommend that you do not post sensitive personal information that you do not want to disclose to other members.

Privacy Settings: If you would like to remain a member of the group but limit other members' access to your account information, we encourage you to set your profile to "privacy" mode according to Facebook's instructions available here .

Representing Others: If you are posting on behalf of a person you represent (e.g. legal guardian, custodian), ensure that the data provided does not allow that person to be identified (e.g. name, address, relationship, contact details).

Limitation of data disclosure: Do not disclose personal contact data (e.g. phone number, email address) of yourself or the persons you represent to other group members, other than group administrators, and only with sufficient protection guarantees.

DELETING DATA AND POSTS

Individual deletion: You have the right to delete your own posts at any time. Alternatively, you can ask the group admins to delete them on your behalf, specifying the exact posts in question.

Unsubscribe: If you choose to leave the group, your account data will no longer be visible to other members, but any remaining posts will persist for 3 years unless you request their deletion before or after unsubscribing.

RESPONSIBILITY FOR DATA USE

Data transfer and use: Personal data collected within the group will not be transferred or used for purposes other than those mentioned (general advice). We will not contact members for marketing purposes and the data will not be shared with third parties.

Profiling: We do not perform automated profiling based on data collected in the group.

Posting Images: Before posting images that include other identifiable individuals, please obtain their consent. We recommend blurring/blurring faces to protect their identity.

Limitation of liability. Although we try to provide a secure and confidential platform for our members, we cannot guarantee absolute protection against the misuse of the data you post by third parties. Therefore, MEDICAL EXPRESS SRL does not assume liability for any improper use of personal data disclosed in the group. Please respect the group policy and report any abuse immediately.

Disclaimer: We do not provide medical advice.

The medical assistants present in the group provide general advice only and are not a substitute for professional consultations. MEDICAL EXPRESS SRL assumes no responsibility for any consequences of applying the advice received within the group. Members are advised to consult a specialist doctor for any health problem.

For more information or requests regarding your personal data, you can contact us by email at suport@stomaterapie.ro .

PURPOSES AND LEGAL GROUNDS OF DATA PROCESSING

Personal data collected and processed within the "Stoma Therapy Support Group" group are used exclusively for the following purposes:

Purpose of administering and managing the support group: We process data to administer the group, approve membership requests, and ensure safe and confidential interaction between members.

Legal basis: Explicit consent of the data subjects (Art. 6 para. (1) letter a) and Art. 9 para. (2) letter a) of the GDPR).

Purpose of general advice on the use of medical devices and specific nutrition: We process data about members' health and conditions to provide general advice and relevant information.

Legal basis: Explicit consent (Art. 6 para. (1) letter a) and Art. 9 para. (2) letter a) of the GDPR).

The purpose of improving the experience within the group : We may process feedback and other relevant information provided by members to improve how the group operates and to develop new functionalities or services.

Legal basis: Legitimate interest (Art. 6 para. (1) letter f) of the GDPR). We ensure that this interest does not override the fundamental rights and freedoms of the data subjects.

Purpose of ensuring compliance with the group's terms and conditions: We may process data to monitor compliance with the group's rules and to take action in case of violations (e.g. restricting access or deleting inappropriate content).

Legal basis: Legitimate interest (Art. 6 para. (1) letter f) of the GDPR), aiming to maintain the security and integrity of the group.

WITHDRAWAL OF CONSENT

Data subjects may withdraw their consent at any time by simply unsubscribing from the group. Unsubscribing will cease the processing of personal data within the group, but previously made posts will remain visible to other group members.

If you want to remove posts before you unsubscribe, you can delete them manually or ask the group admins to delete them on your behalf. If you are unable to delete them before leaving the group, please contact us to request their removal.

YOUR RIGHTS

According to Regulation (EU) 2016/679 (GDPR), you have the following rights with regard to the processing of your personal data:

Right of access: You have the right to request confirmation regarding the processing of your personal data and, where applicable, to receive a copy of this data and further information about how it is processed.

Right to rectification: You have the right to request the correction of inaccurate personal data or the completion of incomplete data we hold about you.

Right to erasure of data (“right to be forgotten”): In certain situations (e.g., if the data is no longer necessary in relation to the purpose for which it was collected), you can request the deletion of your personal data.

Right to restriction of processing: You have the right to request the restriction of the processing of your data in certain cases (e.g., when you contest the accuracy of the data or consider the processing to be unlawful).

Right to data portability: You have the right to receive the personal data you have provided to us, in a structured, commonly used and machine-readable format, and to request the transfer of this data to another data controller, where technically feasible.

Right to object to processing: You have the right to object to the processing of your personal data at any time, for reasons relating to your particular situation. If you object, we will cease processing, unless we have compelling legitimate grounds which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.

Right to lodge a complaint: If you consider that your rights under the GDPR have been violated, you have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing in Romania or with another relevant supervisory authority within the European Union.

To exercise these rights, you can contact us by e-mail at dpo@medicalexpress.ro. We will respond to your request as soon as possible, but no later than one month from receipt, in accordance with applicable law.

Dear customer,

We thank you for your loyalty and assure you that we will continue to do our best to offer you the best products, services and information to support your health!

This form is drawn up under European legislation on the processing of personal data and aims to inform you of the rights you have in relation to the processing of such data, information to help you make an informed decision regarding your consent to the processing of certain personal data belonging to you ("Data") for the purposes and conditions set out below.

The processing of the Data that you will fill in this contact form will be done by the company MEDICAL EXPRESS SRL, with headquarters in Bucharest, Str. Drumul Taberei no. 16, bl. A1, ap. 4, Sector 6, registered with the Bucharest Trade Register under no. J40/ 640/1998, fiscal code R 10148463, having a working point (also chosen for correspondence) in Bucharest Str. Dr. Lister, no. 17, sector 5, e-mail address: dpo@medicalexpress.ro (used for complaints regarding your personal data), as operator.

LEGAL BASIS

We process your data pursuant to Article 6(1)(a) of Regulation (EU) 2016/679, based on your consent for commercial communications, and pursuant to Article 6(1)(f), based on our legitimate interest in promoting Medical Express products and services.

PURPOSES OF PROCESSING

The general purpose of Data processing is that of online services, advertising, marketing and publicity and consists of the following:

• "newsletter subscription" - the processing by Medical Express of the Data consisting of: your name, surname and e-mail address will be done for your subscription to the newsletter.
• “knowing preferences” – Medical Express will process the Data consisting of your name, surname, telephone number and e-mail address regarding Medical Express products according to the shopping history resulting from your transactions. This processing will be done for the purpose of preparing and sending commercial communications regarding personalized offers of products and services in accordance with your preferences and characteristics mentioned above (including but not limited to personalized offers of price discounts, discount vouchers, gifts on your birthday or name day), in accordance with the Medical Express policy.
• “Commercial Communications” – the processing by Medical Express of the Data consisting of your name, surname, telephone number and e-mail address will be done for the transmission of commercial communications regarding the offers, promotions, products offered by Medical Express (including articles, publications, brochures on various topics such as: health (medical, medical devices).

TRANSMISSION OF DATA TO THIRD PARTIES

We inform you that Medical Express collaborates with other companies authorized by Medical Express in the Data processing process, but only for the purposes and limits provided in this information and only prior to obtaining guarantees of compliance with the confidentiality and protection of your data and rights.

Your data is not transferred to third countries outside the European Union.

DATA RETENTION PERIOD

We retain your data until you withdraw your consent to receive the newsletter.

YOUR RIGHTS

We inform you that you have the following rights regarding Data in the relationship between you and Medical Express:

Access to your data that we process or copies thereof; you also have the right to obtain from us information regarding the nature, processing and disclosure of such data.

Right to rectification of data . You have the right to obtain rectification of inaccuracies in your data that we process.

Right to erasure (“right to be forgotten”). You have the right to obtain from us the erasure of your data that we process.

Right to restriction of data processing . You have the right to request restriction of the processing of your data.

Right to object . You have the right to object to the processing of your data by us or on our behalf.

Right to data portability . You have the right to obtain the transfer to another operator of your data that we process or control.

Right to withdraw consent . Where we process your data on the basis of your consent, you have the right to withdraw your consent; you can do so at any time, at least as easily as you initially gave us your consent; withdrawal of consent will not affect the lawfulness of the processing of your data that we carried out before the withdrawal.

Right to lodge a complaint with the supervisory authority . You have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing, with headquarters at Bulevardul General Gheorghe Magheru 28-30, Bucharest, regarding the processing of your data by us or on our behalf. However, we ask you to contact us beforehand to resolve any misunderstanding or dissatisfaction, amicably. We remain at your disposal with all due care.

To exercise the rights listed above and for details, you can contact Medical Express via the following methods:

• submitting a written application dated and signed at the lucrative headquarters of Medical Express in Bucharest, Str. Dr. Lister, no. 17, sector 5,
• at the e-mail address: dpo@medicalexpress.ro

** The Data Protection Officer may be contacted for any clarifications, information, as well as requests related to the exercise of the rights mentioned above at any of the contact details listed above.