Last updated: 4 October 2026.
This policy describes how we process the personal data of visitors to this website, in line with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Croatian Act on the Implementation of the GDPR.
1. Data controller
Poliklinika DermaPlus za dermatologiju i venerologiju, Kaptol 25, 10000 Zagreb, Croatia, registered with the Commercial Court in Zagreb under MBS 080940607, OIB (tax number) 09891009026 (the “Clinic”).
For any question about the processing of personal data, or to exercise your rights, contact us at info@dermaplus.hr, by phone on +385 1 4819 504, or by post at the Clinic’s address, marked “For the data protection officer”.
2. What data we process, why and on what basis
Contact form
Name, email address and the content of your message. We use the data only to answer your inquiry. The legal basis is our legitimate interest in answering it and taking steps at your request before entering into a contract (Art. 6(1)(b) and (f) GDPR).
Appointment form
Name, email address, phone number and the content of your message. We use the data to contact you and arrange an appointment (Art. 6(1)(b) GDPR). If you include health information in the message, we process it solely to arrange the appointment and provide health care (Art. 9(2)(h) GDPR). Please include only what is needed to arrange the appointment.
Phone and email
When you contact us by phone or email, we process the data you provide for the same purpose and on the same basis as with the forms.
Question assistant (chat)
The website offers an automated assistant that answers questions about services, prices, the team and appointments. The text of your question is forwarded, in order to compose the answer, to the artificial intelligence provider Anthropic, PBC (USA), which acts as our processor. We do not store conversations on our server; the conversation history is kept only in your browser until you close the tab. To prevent abuse we keep a cryptographic hash of your IP address for up to 24 hours. The assistant does not make diagnoses and does not replace a medical examination, so please do not enter personal health data into it. The legal basis is our legitimate interest in giving visitors accurate information quickly (Art. 6(1)(f) GDPR).
Protecting forms from abuse
The appointment form is protected by Google reCAPTCHA (Google Ireland Limited). The service processes technical data about your device and browser and your IP address in order to tell people apart from automated programs. The legal basis is our legitimate interest in protecting the website from abuse.
Technical data and cookies
On every visit the server records technical data (IP address, time of access, browser type) needed to run the website securely. The website does not use analytics or marketing cookies. Details are in the Cookie policy.
3. Patients’ medical records
Data the Clinic processes when providing health care (medical records) is not collected through this website and is kept in line with health care and health data regulations. We inform you about that processing when you visit the Clinic.
4. Who has access to the data
Data is accessed only by Clinic staff who need it for their work and who are bound by professional secrecy. In addition, data is processed on our behalf by processors: the website and email hosting provider, Google (form protection and maps) and Anthropic (question assistant). We do not sell your data or share it with third parties for their marketing purposes. We disclose data to competent authorities only where the law requires it.
Where data is transferred outside the European Economic Area (USA), the transfer relies on appropriate safeguards under Chapter V GDPR, such as standard contractual clauses or an adequacy decision.
5. How long we keep the data
Inquiries sent through the forms and by email are kept for no longer than 12 months after the last communication, unless you become our patient, in which case the data is kept for the periods prescribed for medical records. Server logs are kept for no longer than 90 days.
6. Your rights
At any time you have the right to request:
- access to your data and a copy of it,
- correction of inaccurate or incomplete data,
- erasure of data where there is no longer a legal basis for processing,
- restriction of processing,
- transfer of your data to another controller,
- an end to processing based on legitimate interest (objection),
- withdrawal of consent, without affecting the lawfulness of earlier processing.
We will reply within one month at the latest. If you believe we process your data unlawfully, you have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr.
7. Data security
We apply technical and organizational safeguards: encrypted data transfer (HTTPS), restricted access to data and regular system updates.
8. Changes to this policy
We may change this policy when the processing or the regulations change. The current version is always published on this page, with the date of the last update.
