Privacy policy

Draft. Draft, to be reviewed and approved by the clinic before final publication.

This policy explains what personal data Diamanti Elite Dental Clinic receives through this website, why, and what your rights are. We collect as little as possible: the site has no database of requests, no analytics and no advertising trackers.

Who is responsible for your data

The data controller is [LEGAL NAME] (NIPT [NIPT]), operating as Diamanti Elite Dental Clinic, Rruga Nikolla Jorga 9, Tiranë 1001, Albania.

For any privacy question or request, please contact us by phone at +355 69 570 7141 or by email at [email protected].

Which laws apply

We process personal data in line with Albania’s Law No. 124/2024 “On personal data protection” and, for visitors in the European Union, the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”).

What we receive through the booking and photo-assessment form

When you send a booking, consultation or photo-assessment request, we receive only the information you enter. The form is meant for adults; if the request concerns a child, a parent or legal guardian should fill it in. Depending on what you fill in, this includes:

• your first and last name;
• your phone or WhatsApp number, and whether you prefer to be contacted on WhatsApp;
• your email address, if you choose to give it (it is optional and used to send you a confirmation);
• the treatment you are interested in, and a preferred date and time of day;
• whether you are coming from abroad and, if so, your country and approximate travel dates;
• any photos of your smile or panoramic X-ray you choose to attach, and your message;
• your consent to this policy and, separately, whether you agreed to receive news from the clinic.

Photos, X-rays and health information

Photos of your teeth, X-rays and anything you tell us about your dental health are health data, a special category of personal data. We process them only on the basis of your explicit consent, which you give by ticking the consent box before sending the form, and only to assess your request and prepare a personalised plan.

Attaching photos is always optional. You can withdraw your consent at any time by contacting us; this does not affect processing carried out before you withdrew it.

How your request is handled

The website does not keep a database of requests. When you send the form, its content is turned into an email and delivered to the clinic’s inbox through Resend, an email delivery service acting as our processor. If you gave an email address, you also receive a confirmation email.

Uploaded files are processed in memory only. They are never written to the server’s disk and exist only as attachments to the email sent to the clinic. They are not sent back to you in the confirmation.

During the pre-launch (demo) phase of this website, messages may be received by the website provider, Radari, acting as processor on behalf of the clinic, and passed on to the clinic.

Diamanti AI chat

Diamanti AI is an automated assistant that gives general information about the clinic and its treatments. It is not a doctor and does not replace a consultation.

To generate each answer, your messages and the recent part of the conversation are sent to Google through the Gemini API. The conversation is stored only in your own browser (sessionStorage) and is deleted when you close the tab or press “Clear chat”. Our server does not log the content of your messages; it only keeps an anonymous count of messages per day in memory.

Please do not share sensitive health information, identity numbers or other sensitive data in the chat. If you would like the clinic to review your case, please use the booking form instead.

Technical data and security

As with any website, our hosting provider, Railway, may record technical data such as your IP address, browser type and the time of the request in server logs, to keep the service running and secure.

To protect the forms and the chat from abuse, the server temporarily keeps your IP address in memory to limit the number of requests. This information is not stored in any database and disappears after a short time or when the server restarts.

Cookies and storage on your device

We use a single first-party cookie, “lang”, which remembers the language you chose for one year. In addition, your browser’s sessionStorage keeps a few items for the current visit only: whether the opening animation has already been shown, your conversation with Diamanti AI and any unsent text in the form.

We do not use analytics, advertising pixels or third-party cookies. Fonts, photos and videos are served from our own website, and the map is a static image, so Google Maps is not loaded. Details are in our cookie policy.

Why we may process your data (legal bases)

We process your data on the following legal bases under the GDPR and the corresponding provisions of Law No. 124/2024:

• handling your request and preparing a consultation or treatment plan: steps taken at your request before a possible treatment agreement (Art. 6(1)(b) GDPR);
• photos, X-rays and other health information: your explicit consent (Art. 9(2)(a) GDPR);
• news and offers from the clinic: your consent, given through a separate box that is never ticked in advance (Art. 6(1)(a) GDPR); you can withdraw it at any time without any effect on your request or your treatment;
• security, spam prevention and rate limiting: our legitimate interest in protecting the website (Art. 6(1)(f) GDPR).

Who receives your data and transfers abroad

Your data is seen only by the clinic and, where needed, by the service providers listed below, who act on our behalf. We do not sell your data or share it for advertising.

The clinic is based in Albania. If you write to us from the EU, your data is transferred to Albania because you ask us to handle your request there. Some providers are based in the USA; in those cases the transfer relies on safeguards such as the EU Standard Contractual Clauses or the EU–U.S. Data Privacy Framework, where applicable.

Links to Instagram, Google and WhatsApp open those services, which apply their own privacy policies.

• Resend (email delivery, USA): delivers the form emails;
• Google (Gemini API): generates the chat answers;
• Railway (website hosting);
• Radari (website provider), only during the pre-launch phase described above.

How long we keep data

We keep data only for as long as necessary:

• form emails: in the clinic’s inbox for as long as needed to handle your request and, if you become a patient, for the duration of the care relationship and any legal obligations on medical records; afterwards they are deleted in line with the clinic’s internal policy;
• chat: only in your browser, until you close the tab or clear the chat;
• rate-limiting data: in memory only, for a short time;
• hosting logs: for the limited period set by the hosting provider.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, to data portability, and to withdraw your consent at any time. To exercise these rights, contact us at [email protected] or +355 69 570 7141. We may ask you to confirm your identity and will reply within one month.

If you believe your data has been handled unlawfully, you can complain to Albania’s Information and Data Protection Commissioner (Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale, IDP). If you live in the EU, you can also contact your local supervisory authority, for example the Garante per la protezione dei dati personali in Italy.

We may update this policy when the website or the law changes. The date at the top shows the latest version.