Version 1.0 · Effective from 28 September 2026
This policy explains how ALBMEDICA handles personal data about the people who work for or represent our partner clinics: clinic owners, legal representatives, doctors, coordinators and other staff with a dashboard account.
It does not cover patient data. How patient data is handled is explained in our Patient Privacy Policy and in the Data Protection Agreement each clinic signs with us.
1. Who we are
The controller of your personal data is ALBMEDICA sh.p.k., NIPT [●], Riza Cerova, Tirana, Albania ("ALBMEDICA", "we", "us").
Privacy contact: privacy@albmedica.com
2. What data we collect
| Category | Examples |
|---|---|
| Account data | Name, work email, phone number, job role, clinic, password (stored only in encrypted form), two-factor authentication settings, language preference |
| Verification data | Professional licence numbers, registration with the relevant professional order, qualifications, copies of licences and certificates, the name of the clinic's legal representative |
| Public profile data | Doctors' names, photos, titles, specialties, languages spoken, short biographies |
| Usage data | Log-ins, IP address, browser and device type, actions taken in the dashboard (for example quotes sent, bookings confirmed), and access to patient files, which is recorded for security |
| Communication data | Emails, messages and support requests between you and us, and notes of phone calls about your account or billing |
| Billing contact data | Name, email and phone number of the person responsible for invoices |
| Marketing preferences | Whether you want to receive our news and tips for clinics |
3. Where we get it
Most of this data comes from you, or from a colleague who invites you to your clinic's account. We also check public registers, such as the National Business Center (QKB) and the registers of the relevant professional orders, to verify licences and registrations.
4. Why we use it and our legal basis
| Purpose | Legal basis |
|---|---|
| Creating and running clinic accounts, and providing the dashboard | Performance of our contract with your clinic |
| Verifying clinics and doctors before and during listing | Our legitimate interest in patient safety and in a trustworthy platform |
| Publishing doctor profiles on the website | Performance of the contract with your clinic; you can ask us to change or remove your profile at any time |
| Sending you inquiries, booking updates, reminders and service messages | Performance of the contract |
| Invoicing, accounting and tax | Legal obligation |
| Security, fraud prevention and access logs | Our legitimate interest in protecting the platform and patient data |
| Improving the platform (for example aggregated statistics on response times) | Our legitimate interest |
| News and tips for clinics by email | Our legitimate interest; you can unsubscribe at any time with the link in every email |
| Establishing, exercising or defending legal claims | Our legitimate interest |
We do not make decisions about you based solely on automated processing that produce legal effects or similarly significant effects for you.
5. What is public
The information in your clinic's public profile is visible to anyone who visits ALBMEDICA. This includes doctors' names, photos, qualifications and biographies. When you reply to an inquiry, the patient sees your name and role. Please don't add personal details to your profile that you don't want to be public.
6. Who we share it with
- Service providers who host and run the platform for us: hosting, email delivery and backups. They act only on our instructions. The current list is at [link to sub-processor list].
- Our professional advisers, such as our accountant, lawyers and auditors, where needed.
- Authorities, where the law requires it.
- A buyer or successor, if all or part of our business is sold or reorganised. Your data stays protected under this policy.
We never sell personal data.
7. Where your data is stored
Our platform is hosted in Germany. If data is transferred outside Albania or the EEA, we use the safeguards required by law.
8. How long we keep it
| Data | Retention |
|---|---|
| Account data | While the account is active, then 12 months |
| Verification documents | While your clinic is listed, then 3 years |
| Public profile data | Removed from the website when your clinic leaves or on request; kept internally with the verification documents |
| Access and security logs | 24 months |
| Invoices and billing records | For the period required by Albanian accounting and tax law (10 years) |
| Marketing preferences | Until you unsubscribe |
9. How we protect it
Our security measures include encryption in transit and at rest, individual accounts, two-factor authentication, role-based access (each clinic sees only its own data), access logs, and regular tested backups.
10. Your rights
You have the right to:
- access your data;
- have it corrected;
- have it erased;
- restrict how it is used;
- object to processing based on our legitimate interest;
- receive it in a portable format;
- withdraw any consent you have given.
To use these rights, email privacy@albmedica.com. We will reply within one month.
You also have the right to complain to the Commissioner for the Right to Information and Personal Data Protection in Albania (idp.al). If you live in the EU, you can also complain to your national data protection authority.
11. Cookies
We use essential cookies to keep you logged in and your account secure. For more information see our Cookie Policy.
12. Changes to this policy
We will publish any update on this page. If a change is significant, we will also tell you by email before it takes effect.
13. Contact
ALBMEDICA sh.p.k., Riza Cerova, Tirana, Albania · privacy@albmedica.com