1. Who we are
MedNexus is online software for medical clinics and practices, provided by NEOXIS IT SRL, tax identification number (CUI) RO35291883, Trade Register number J2016001809034, share capital 10,000 RON, with its registered office at Str. C. A. Rosetti nr. 5, Pitești, jud. Argeș, 110040 (‘MedNexus’, ‘we’, ‘us’). You can write to us at office@mednexus.ro with any question about personal data.
We have appointed a data protection officer (DPO), whom you can contact at dataprotection@neoxis.ro.
2. In what capacity we process data
We process personal data in two different capacities, with different rules:
- As a controller, for the data of visitors to this website and of people who request a demo or write to us, and for the contact details of representatives of our client clinics (invoicing, the contractual relationship).
- As a processor (Article 28 of Regulation (EU) 2016/679, the ‘GDPR’), for the data that the clinic enters in the application: patients, appointments, medical records, test results, employees, partners. For this data, the controller is the clinic. We process it only on the clinic’s behalf, on its written instructions and on the basis of the data processing agreement concluded with it.
If you are a patient of a clinic that uses MedNexus and you wish to exercise your rights, please contact the clinic. If you write to us, we will forward your request to the clinic without delay.
3. Data of visitors and of people who request a demo
3.1. What data we collect
- Through the ‘Book a demo’ form: your name, clinic, town or city, phone number, email address, number of doctors and your message, if you write one.
- By email: the data you choose to send us.
- A request sent through the form reaches us by email, in our Google Workspace account, and you receive a confirmation by email.
- Technical data: like any web server, the server hosting the website records the IP address, date and time, page requested and browser type in technical logs used for security and operation. The IP address is also used to limit repeated submissions of the form and appears in the email through which we receive the request, so that we can recognise abusive submissions.
We do not use tracking cookies, advertising pixels, third-party statistics tools or fonts loaded from third parties. We count visits with GoatCounter, hosted on our own server in the EU, without cookies and without storing IP addresses; we only see aggregate figures (pages visited, source of the visit, country, device type). The legal basis is our legitimate interest in knowing how the website is used (Article 6(1)(f) GDPR). See the cookie policy for details.
Website language: when you open the home page, the server determines from your IP address only the country you are visiting from, so that it can show you the website in the right language (Romanian for Romania, French for France, English everywhere else). For this we use a database on our own server (IP Geolocation by DB-IP), without sending the address anywhere else, without storing it and without cookies. You can change the language in the header at any time. The legal basis is our legitimate interest in showing you the website in a language you understand (Article 6(1)(f) GDPR).
3.2. Why, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| To respond to your demo request and contact you about it | Your consent, given by ticking the box in the form (Article 6(1)(a)), and steps taken at your request before entering into a contract (Article 6(1)(b)) |
| To protect ourselves against automated form submissions and keep the website secure | Our legitimate interest (Article 6(1)(f)) |
| The contractual relationship with the clinic (contract, invoicing, support) | Performance of the contract and legal obligations (Article 6(1)(b) and (c)) |
You can withdraw your consent at any time by writing to us at office@mednexus.ro. Withdrawal does not affect processing carried out before then.
3.3. How long we keep data
- Demo requests: 12 months from the last contact, if you do not become a client. If you become a client, for as long as the contractual relationship lasts and then for as long as the law requires.
- Server technical logs: 14 days for the web server access logs and no more than 30 days for the form log.
- Accounting documents: for as long as financial and accounting legislation requires.
4. Data in the application (on the clinic’s behalf)
For the data that the clinic enters in the application, we undertake, through the contract and the data processing agreement, to:
- process the data only to provide the service and only on the clinic’s instructions;
- maintain confidentiality, including through confidentiality obligations on our staff;
- apply appropriate technical and organisational measures: role- and profile-based access, encryption of the connection (HTTPS), encryption of stored passwords and access keys, access logs, and backups made four times a day and checked weekly by means of a test restore;
- engage sub-processors only with the clinic’s knowledge and subject to the same data protection obligations;
- help the clinic respond to patients’ requests and fulfil its obligations (security, breach notification, impact assessments);
- notify the clinic without undue delay of any personal data breach;
- when the contract ends, return or delete the data, at the clinic’s choice, except for data that the law requires us to keep;
- make available to the clinic the information needed to demonstrate compliance with these obligations, and allow audits, under the conditions set out in the agreement.
Health data belongs to the special categories of personal data (Article 9 GDPR). The legal basis for processing it is determined by the clinic, as the controller (usually the provision of health care, Article 9(2)(h)).
5. Where the data is kept and who helps us (sub-processors)
The application and the backups are hosted on servers in the European Union. We do not transfer data outside the European Economic Area, except in the situations below, where the transfer is subject to appropriate safeguards (an adequacy decision or standard contractual clauses).
| Provider | What it does | Where |
|---|---|---|
| OVHcloud (OVH SAS) | Hosting of the application, the database and the backups | EU (Germany: the application and the database; France: the backups) |
| Google Ireland Ltd. (Google Workspace) | MedNexus email: demo requests received through the form and their confirmations, correspondence with client clinics (invoices, contracts, account notifications) | EU / US (EU-US Data Privacy Framework) |
The clinic’s email account (from which emails to patients are sent), its WhatsApp Business account, SMS messages, its artificial intelligence key, the partner laboratory, the cash register, ANAF (the Romanian tax authority) and its SPV portal, and the clinic’s Facebook and Instagram accounts are services that the clinic chooses, contracts and pays for in its own name; they are not our sub-processors. The up-to-date list of sub-processors is sent to client clinics, which are notified before any change.
6. Your rights
Under the GDPR, you have the right:
- to access your data and to receive a copy of it;
- to have inaccurate data rectified;
- to have your data erased (the ‘right to be forgotten’), as provided by law;
- to restrict processing;
- to data portability;
- to object to processing based on legitimate interest;
- to withdraw your consent at any time;
- not to be subject to a decision based solely on automated processing. We do not take any such decisions.
For data on this website, write to us at office@mednexus.ro or to our data protection officer at dataprotection@neoxis.ro. We will reply within one month at most. For data in your medical record, please contact the clinic.
7. Complaints to the ANSPDCP
If you believe that your data is not being processed lawfully, you can lodge a complaint with the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP, the Romanian National Supervisory Authority for Personal Data Processing), B-dul G-ral. Gheorghe Magheru nr. 28–30, sector 1, București, www.dataprotection.ro. Please write to us first; in most cases we can resolve the matter directly.
8. Changes
We may update this policy. The version in force is always on this page, with the date of the last update. Client clinics are notified in advance of any changes affecting the data in the application.