GDPR — website

Website privacy notice

Last updated: 13 October 2026

About this notice

This notice explains how IFCC SRL processes personal data through the International Family Care Clinic website: the appointment and blood-test enquiry forms, partnership form, server records and cookies. It does not cover the clinic’s processing of patient information for medical care. That will be set out in a separate patient privacy notice, published on this site when the clinic’s text is ready.

Controller

IFCC SRL (International Family Care Clinic), CUI 55017107, Nr. Reg. Com. J2026041531008, with registered office at Str. Grigore Ionescu nr. 48, mansardă, ap. 9, camera 1, Sector 2, Bucharest, and clinic at Str. Popa Savu 3A, Sector 1, Bucharest, is the controller of personal data processed through this website. For privacy requests write to privacy@ifcc.ro.

What we process

When you request an appointment or enquire about blood tests, we process the details you submit so we can handle your request and contact you: name, email, telephone number, preferred contact language, how you heard about us (optional), organisation or school name (optional), and any notes you add. For a consultation request we also process the service chosen, preferred date and time, consultation language, and preferred doctor if you give one. For a child consultation we process the child’s name as the patient and the parent or guardian’s name as the contact. For a blood-test enquiry we process the type of enquiry, any test list you type, and the filename of any file you upload. If you use the partnership form we process organisation name, contact name, role, email, phone, message and the time of sending. We also record that you confirmed you were shown this website notice. Server logs may include IP address, browser type and the page requested, kept only as needed for security and troubleshooting.

Health information

Blood-test enquiries, uploaded referrals or test lists, and the notes field may include health data (special category data under GDPR Art. 9). Where you provide such information, we ask for a separate, unticked checkbox: “I consent to IFCC processing the health information I submit so it can arrange my request.” That processing is based on your explicit consent (GDPR Art. 9(2)(a)). You may refuse; if you do, we may not be able to arrange the request that depends on that information. You may withdraw consent by writing to privacy@ifcc.ro; withdrawal does not affect processing already carried out. If tests are arranged, the necessary details are shared with our partner laboratory.

Legal bases

Handling your appointment request, blood-test enquiry or partnership message: GDPR Art. 6(1)(b) (steps at your request prior to a contract). The general checkbox on the form only records that this website notice was shown to you; it is not a separate legal basis for processing the request. Strictly necessary cookies and the staff login cookie: Art. 6(1)(f) (secure operation of the site) and, where required by ePrivacy, necessity for a service you asked for. Optional analytics or marketing cookies: Art. 6(1)(a) only if you opt in. Health information: Art. 9(2)(a) as described above.

Who handles the data

Form data and related notifications are received or stored by these services acting for IFCC: (1) Netlify (website hosting and Netlify Blobs storage of booking and form records) — United States; transfer safeguarded by Netlify’s GDPR terms and Standard Contractual Clauses / EU–US Data Privacy Framework where applicable. (2) Resend (sending clinic notification emails and patient acknowledgement emails) — United States; transfer safeguarded by Resend’s GDPR terms and Standard Contractual Clauses / EU–US Data Privacy Framework where applicable. (3) SiteGround (mailbox hosting for info@ifcc.ro, where clinic notification emails are delivered) — European Union / EEA under SiteGround’s hosting arrangements for that mailbox. When you opt in to analytics, Google Analytics 4 (Google LLC, United States) also processes usage data under Google’s GDPR terms, the EU–US Data Privacy Framework and Standard Contractual Clauses. We do not use Supabase. We do not sell personal data.

Cookies and server records

The public site uses only essential cookies today: ifcc_consent (up to 180 days) stores your cookie banner choice; ifcc_admin_session (7 days, HttpOnly) is set only after staff login; ifcc_admin_locale (up to one year) remembers the admin interface language. Language for the public site is in the URL (/en, /ro, /fr), not in a cookie. Google Analytics 4 may run only after you opt in via the cookie banner (Consent Mode keeps analytics storage denied until then). No advertising tools are installed. Server / edge logs from hosting may record IP address, user agent and requested URL for security and reliability, for a short period.

Files and retention

Uploaded referral or test-list files are attached to the clinic notification email sent to info@ifcc.ro. The file content is not stored in the website database or Netlify Blobs; only the filename may be stored with the request so coordinators can see that a file was sent. Request records (including optional notes and typed test lists) are stored in Netlify Blobs for the clinic admin Bookings inbox. There is no automatic deletion today; retention will be set by IFCC and this notice will be updated. The patient acknowledgement email does not repeat health details from your request (notes, test list or file content).

Your rights

You may request access, rectification, erasure, restriction, portability and objection, and you may lodge a complaint with the Romanian DPA (ANSPDCP) or your local supervisory authority. We do not use automated decision-making that produces legal effects. For child consultations, a parent or guardian should submit the form. Contact: privacy@ifcc.ro.