{"id":2193,"date":"2021-02-12T23:47:32","date_gmt":"2021-02-12T23:47:32","guid":{"rendered":"https:\/\/poliklinika-dermaplus.com\/privacy-policy\/"},"modified":"2026-10-04T20:53:46","modified_gmt":"2026-10-04T21:53:46","slug":"privacy-policy","status":"publish","type":"page","link":"https:\/\/dermaplus.bozooart.com\/en\/privacy-policy\/","title":{"rendered":"Privacy policy"},"content":{"rendered":"

Last updated: 4 October 2026.<\/em><\/p>\n

This policy describes how we process the personal data of visitors to this website, in line with the General Data Protection Regulation (EU) 2016\/679 (GDPR) and the Croatian Act on the Implementation of the GDPR.<\/p>\n

1. Data controller<\/h2>\n

Poliklinika DermaPlus za dermatologiju i venerologiju, Kaptol 25, 10000 Zagreb, Croatia, registered with the Commercial Court in Zagreb under MBS 080940607, OIB (tax number) 09891009026 (the “Clinic”).<\/p>\n

For any question about the processing of personal data, or to exercise your rights, contact us at info@dermaplus.hr<\/a>, by phone on +385 1 4819 504, or by post at the Clinic’s address, marked “For the data protection officer”.<\/p>\n

2. What data we process, why and on what basis<\/h2>\n

Contact form<\/h3>\n

Name, email address and the content of your message. We use the data only to answer your inquiry. The legal basis is our legitimate interest in answering it and taking steps at your request before entering into a contract (Art. 6(1)(b) and (f) GDPR).<\/p>\n

Appointment form<\/h3>\n

Name, email address, phone number and the content of your message. We use the data to contact you and arrange an appointment (Art. 6(1)(b) GDPR). If you include health information in the message, we process it solely to arrange the appointment and provide health care (Art. 9(2)(h) GDPR). Please include only what is needed to arrange the appointment.<\/p>\n

Phone and email<\/h3>\n

When you contact us by phone or email, we process the data you provide for the same purpose and on the same basis as with the forms.<\/p>\n

Question assistant (chat)<\/h3>\n

The website offers an automated assistant that answers questions about services, prices, the team and appointments. The text of your question is forwarded, in order to compose the answer, to the artificial intelligence provider Anthropic, PBC (USA), which acts as our processor. We do not store conversations on our server; the conversation history is kept only in your browser until you close the tab. To prevent abuse we keep a cryptographic hash of your IP address for up to 24 hours. The assistant does not make diagnoses and does not replace a medical examination, so please do not enter personal health data into it. The legal basis is our legitimate interest in giving visitors accurate information quickly (Art. 6(1)(f) GDPR).<\/p>\n

Protecting forms from abuse<\/h3>\n

The appointment form is protected by Google reCAPTCHA (Google Ireland Limited). The service processes technical data about your device and browser and your IP address in order to tell people apart from automated programs. The legal basis is our legitimate interest in protecting the website from abuse.<\/p>\n

Technical data and cookies<\/h3>\n

On every visit the server records technical data (IP address, time of access, browser type) needed to run the website securely. The website does not use analytics or marketing cookies. Details are in the Cookie policy<\/a>.<\/p>\n

3. Patients’ medical records<\/h2>\n

Data the Clinic processes when providing health care (medical records) is not collected through this website and is kept in line with health care and health data regulations. We inform you about that processing when you visit the Clinic.<\/p>\n

4. Who has access to the data<\/h2>\n

Data is accessed only by Clinic staff who need it for their work and who are bound by professional secrecy. In addition, data is processed on our behalf by processors: the website and email hosting provider, Google (form protection and maps) and Anthropic (question assistant). We do not sell your data or share it with third parties for their marketing purposes. We disclose data to competent authorities only where the law requires it.<\/p>\n

Where data is transferred outside the European Economic Area (USA), the transfer relies on appropriate safeguards under Chapter V GDPR, such as standard contractual clauses or an adequacy decision.<\/p>\n

5. How long we keep the data<\/h2>\n

Inquiries sent through the forms and by email are kept for no longer than 12 months after the last communication, unless you become our patient, in which case the data is kept for the periods prescribed for medical records. Server logs are kept for no longer than 90 days.<\/p>\n

6. Your rights<\/h2>\n

At any time you have the right to request:<\/p>\n