The data controller for the Sofimar mobile application (the "App") is:
Please use the email above for any request related to your personal data or to this policy.
This policy describes what personal data we collect through the App, why we use it, who we share it with, how long we keep it, and your rights as a data subject under Regulation (EU) 2016/679 ("GDPR") and Romanian Law no. 190/2018.
The App processes health data (a special category of personal data under Article 9 GDPR). This data receives enhanced protection and is processed only for the purposes described below.
The clinic advertises on Facebook and Instagram. To see whether the ads bring installs and subscriptions, the App includes Meta's app-events kit (the Facebook SDK), provided by Meta Platforms Ireland Limited. It starts only after you agree: on iPhone through the system's question "Allow this app to track your activity?", on Android through the App's own question at the first launch. Without consent, the kit sends nothing.
With your consent we send Meta only the following events, without name, CNP, email, phone or medical data:
With the events, Meta's kit sends the device's advertising identifier (IDFA on iOS, if you allowed tracking; Google Advertising ID on Android), technical information about the device and the App, and the IP address. Meta uses them, together with the data of your Meta account, to tell us how many installs and subscriptions the ads brought and to show the clinic's ads; for this processing Meta is an independent controller, under the Meta Privacy Policy.
You can withdraw your consent at any time in the App (Account → Ad measurement; on iPhone also in Settings → Privacy & Security → Tracking). After withdrawal nothing more is sent; what was sent stays with Meta under its policy.
| Purpose | Data involved | Legal basis (GDPR) |
|---|---|---|
| Creating and managing your account | Email, password, phone, name | Art. 6(1)(b) — performance of a contract |
| Identity verification (automatically through Didit, or by the clinic's reception) | ID image, face images (Didit check only), CNP, name, document number, date of birth, the address printed on the document, the check's IP address | Art. 6(1)(a) and Art. 9(2)(a) — explicit consent, asked before the face check; Art. 9(2)(h) — necessary for the provision of healthcare services |
| Medical appointments, medical letters, lab results | CNP, medical data, appointments | Art. 6(1)(b) and Art. 9(2)(h) — medical diagnosis and provision of healthcare |
| Sending notifications about your appointments, the status of appointment/availability processing, and new lab results (push notifications and on-device reminders) | Push token; appointment and lab-result events. Notifications contain only generic text and never medical content. | Art. 6(1)(b) — performance of a contract, and Art. 6(1)(f) — legitimate interest in keeping you informed |
| Automated interpretation of lab results (optional, on demand) | Lab result document | Art. 6(1)(a) and Art. 9(2)(a) — explicit consent |
| Online purchase of subscriptions (card payment via NETOPIA Payments) and payment records | Name, email, phone, the invoice address (typed by you or, as a proposal, the one on your identity document), chosen plan, amount, order id and the payment confirmation. The full card number and CVV never reach us. If you turn on automatic card payment, we keep a token issued by NETOPIA Payments for the saved card, its last 4 digits and its expiry date. The token is deleted when you switch automatic card payment off, when the contract ends (or, if fair compensation owed on leaving the contract is to be collected from the card, once the exit is completed) or when you delete your account; a card that also pays another subscription you pay for automatically is kept for that one | Art. 6(1)(b) — performance of a contract, and Art. 6(1)(c) — tax and accounting obligations |
| Measuring the effectiveness of the clinic's ads (Meta Ads), described in section 3.4 | App events (install, account created, appointment booked, payment), the device's advertising identifier, technical information about the device and the App, IP address | Art. 6(1)(a) — consent, which you can withdraw at any time in the App |
| App security (abuse prevention, rate limits) | UID, timestamps | Art. 6(1)(f) — legitimate interest |
| Compliance with legal obligations (e.g. medical records) | As required | Art. 6(1)(c) — legal obligation |
We do not sell your data and we do not use medical data for advertising. We share it only with the following processors, strictly for the operation of the App, and, only with your consent, with Meta for ad measurement (section 3.4):
| Processor | Role | Data shared |
|---|---|---|
| Google LLC (Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Cloud Tasks) | Cloud infrastructure for authentication, storage, and execution | All account and medical data stored in the App |
| Didit (didit.me) | Automatic identity verification: reading the document, checking that you are a real person and comparing your face with the photo on the document | Document and face images, the data read from the document, IP address and device information. Didit processes the data in the European Union and keeps it for the period we set; when you delete your account we ask Didit to delete your checks too. |
| Google LLC — Gemini API | Automated interpretation of lab results, at your request | The content of the lab result document |
| Expo (650 Industries, Inc.) | Push notification delivery service, which relays our notifications to your device through Apple Push Notification service (iOS) and Firebase Cloud Messaging (Android) | Your device push token and the generic notification text (no medical content) |
| NETOPIA FINANCIAL SERVICES S.A. (NETOPIA Payments) | Processing of online card payments for subscriptions. Card details are entered only on NETOPIA Payments' secure page, which processes them in its own name under its payer privacy notice; we never receive or store them | Name, email, phone, amount and order id. We get back the payment confirmation, the masked card (last 4 digits) and, if you turned on automatic card payment, a token identifying the saved card |
| Intelligent IT S.R.L. (SmartBill) | Issuing and electronically delivering the invoices for online payments, including reporting to the national RO e-Factura system (ANAF) | Name, personal numeric code (CNP, when verified), email, phone, amount and order number |
| Meta Platforms Ireland Limited (Facebook, Instagram) | Measuring the clinic's ads, only with your consent (section 3.4). Meta processes this data as an independent controller, under its own privacy policy | The events listed in section 3.4, the device's advertising identifier, technical information about the device and the App, IP address. Never name, CNP, email, phone or medical data |
For the Gemini API we use a paid Google Cloud subscription, which contractually provides that the data we submit is not used to train Google's models.
Our cloud functions and Firestore database run in the European Union (region europe-west8, Milan).
Currently, uploaded files (medical letters, lab results) are stored on Firebase Storage in region
US-EAST1 (United States). Additionally, the Gemini service may process data
outside the European Economic Area (Didit processes it in the European Union), and the Expo push notification service processes your device push token
and the notification text in the United States.
These transfers rely on Google LLC's certification under the EU-US Data Privacy Framework and on the European Commission's Standard Contractual Clauses, providing a level of protection equivalent to that of the EU. We are actively working to move file storage fully to an EU region as options become available.
If you accepted ad measurement (section 3.4), Meta Platforms Ireland Limited may transfer the measurement data to Meta Platforms, Inc. in the United States, under its certification in the EU-US Data Privacy Framework and the Standard Contractual Clauses.
While your account is active, we retain account data and medical data. You may request deletion of your account at any time directly from the App (menu Account → Delete account) or through our Account and Data Deletion page. Upon account deletion:
For identity verification: verification sessions (the declared CNP and name) are deleted after 30 days; photos and document images sent to reception after the decision and within 30 days at the latest; the technical log of checks (no CNP, names or images) is kept for 180 days.
We may retain an archived account marker and CNP reference only to match the correct clinic record, prevent record mismatches, and support verified restoration if you later create a new app account. Medical records and documents such as appointments, lab results, imaging results, medical letters, and prescriptions may be retained where required for healthcare, accounting, security, or legal obligations. These records are not accessible through the deleted app account and may be restored to a new app account only after CNP verification, where lawful. We will delete any additional app data that we are legally allowed to delete.
Records of online subscription payments (orders, payment confirmations, fiscal documents) are kept for as long as accounting and tax law requires, even if you delete your account.
Ad-measurement data (section 3.4) is not stored by us; Meta keeps it under its own policy. Withdrawing your consent stops it from being sent.
As a data subject, under GDPR you have the following rights:
To exercise any of these rights, write to sofimar.ajutor@gmail.com. We will respond within 30 days.
We use appropriate technical and organizational measures to protect your data: encryption in transit (HTTPS/TLS), encryption at rest in Google Cloud infrastructure, strict access rules in Firestore and Firebase Storage (each user can only see their own data), rate limits on sensitive operations (e.g. identity verification), and uniqueness locks on the CNP to prevent identity impersonation.
Accounts are created by adults only. Parents or guardians may add their children in the App (name, CNP, date of birth) and buy the Sofimar Junior subscription for them; the child's data is processed under Art. 6(1)(b), 6(1)(c) and 9(2)(h) GDPR, and access to the child's medical documents is granted only after the Clinic confirms the parent–child link. Beyond that, we do not knowingly collect data from minors; if we become aware that we have, we delete it without undue delay.
We may update this policy as the App evolves. The effective version is shown at the top of the page. We will communicate significant changes through the App or by email before they take effect.
For any question, write to sofimar.ajutor@gmail.com or to SOFIMAR IMAGING SRL, B-dul Laminorului no. 38, Room 1, 3rd floor, Apt. 9, Sector 1, Bucharest, Romania (clinic: Str. Justinian no. 3, Sector 2, Bucharest).