DRAFT — under legal review. This text is not yet final and may change.

Privacy policy

Draft version: 7 November 2026

1. Who we are and who is responsible for the data

Thea Dental is a platform for dental clinics and call centers. The roles for personal data are separate:

• Bridge contacts (call-back requests, consents, referral to a clinic, invoicing of completed appointments): the controller is [Operatori i Urës — për t'u plotësuar] (the “Bridge Operator”), tax ID [për t'u plotësuar], [për t'u plotësuar]. Privacy contact: [për t'u plotësuar]. Partner call centers act as the Operator’s processors.
• A clinic’s patients (calendar, records, invoices, reminders): the controller is the clinic. When a patient expressly agrees to be referred to a named clinic, that clinic becomes an independent controller for the visit and provides its own privacy notice.
• A call center’s own campaigns: the controller is the call center.
• iVoip is only the technical provider (hosting, software, infrastructure, support): it processes data only on the controller’s instructions, under a data processing agreement (GDPR Art. 28), and never for its own purposes.

2. Forms on this website (demo, contact, partner sign-up)

The controller is the Bridge Operator. We collect name, organisation, e-mail, phone, city and message; for partner sign-up also the company name, tax ID (NIPT) and licence number (clinics). Legal basis: your request and pre-contractual steps. We do not sell or share data with third parties for marketing.

3. Patients’ call-back requests (Bridge)

• Box 1 — requested call-back (required): we call you once to give information and book a visit at a partner clinic in Albania (pre-contractual steps, GDPR Art. 6(1)(b)); the type of visit you choose is health data, processed only with your explicit consent (Art. 9(2)(a)).
• Box 2 — promotional messages (optional): only with your consent and only on the channels you choose.
• Box 3 — automated calls (optional): calls from an AI-based virtual assistant that says so in its first sentence.
• Your number is verified with an SMS code (OTP); without verification we do not call. As proof of consent we keep the version of the text you saw, the time, the source, your IP address and browser.
• The call comes from an Albanian number (+355) and operators are located in Albania, outside the European Union; you can ask to be called back by an operator in the EU.
• Your data is passed to a clinic only after you expressly agree on the phone to that named clinic; the transfer uses the European Commission’s standard contractual clauses.
• Retention: up to 24 months after the last contact (proof of consent); after withdrawal the number is kept only on the “do not call” list. Every message lets you reply “STOP”.

4. How long we keep website data

• Demo and contact requests: up to 24 months, or less if you ask for deletion.
• Rejected sign-ups: up to 12 months, to prevent abuse.
• Technical rate-limiting data (IP): about 2 days.

5. Cookies

Only strictly necessary technical cookies (session and form protection). No advertising or analytics cookies.

6. Clinics’ WhatsApp messages

Reminders sent by clinics on WhatsApp contain only the date, time and clinic, never diagnoses or treatments, and can be stopped with “STOP”.

7. Your rights

You may request access, rectification, erasure, restriction, objection, portability and withdraw consent at any time by writing to [për t'u plotësuar]. You may complain to the Albanian Information and Data Protection Commissioner or to the Italian Garante per la protezione dei dati personali.

8. Where data is stored

On servers in the European Union managed by the technical provider (exact location to be confirmed in the final version). Security measures: encrypted connections, role-based access, isolation between partners and a tamper-evident consent log.