PRIVACY POLICY

1. General commitment to data protection

We are fully committed to handling personal information in accordance with the applicable laws of the Republic of Moldova, which are aligned with and compliant with the General Data Protection Regulation (GDPR).

This means that all personal data:

  • will be processed lawfully, fairly, and transparently;
  • collected for specified, explicit, and legitimate purposes;
  • limited to what is necessary;
  • kept up to date; retained only as long as required; and
  • processed securely and with integrity.

This Privacy section is designed to explain how we handle your personal data and to ensure you understand your rights.

Clinics receiving patient data act as independent data controllers, not joint controllers. The Platform may act as a processor for certain clinic-related operations as required by Moldovan law.

2. Why we process personal data

We process personal data throughout our relationship with you for purposes such as updating you on our services, managing server or website functionality, meeting regulatory requirements, and ensuring continuity of communication.

3. What personal data we collect

"Personal data" refers to any information relating to an identifiable individual, either directly or indirectly. This does not include anonymized data where the identity has been removed.

4. How personal data is collected

We may collect personal data directly from you, including when you submit information through our website, complete forms, engage with us through your User account, or enter into a contract with us.

5. Lawful basis for processing

We will only process your personal data when permitted by law. The lawful bases commonly relied upon are:

  • your prior consent;
  • performance of a contract with you;
  • compliance with a legal obligation; or
  • our legitimate interests, provided these do not override your rights and freedoms.

We may also process personal data where necessary to protect vital interests or for reasons of public interest.

6. Change of purpose

We will only use your personal data for the purposes for which it was collected, unless the new purpose is compatible with the original one. If we intend to use your data for an unrelated purpose, we will notify you and explain the legal basis for doing so.

We may process your data without your knowledge or consent when permitted by law.

7. Sharing personal data with third parties

We may share your personal data with third parties when required by law, when necessary to manage our relationship with you, or when there is a legitimate interest in doing so.

All third-party relationships are governed by appropriate data-processing agreements ensuring compliance with GDPR and maintaining high standards of data security.

8. Retention of personal data

Data retention periods vary depending on the purpose for which personal data was collected.

We may retain certain data within our CRM system to maintain service continuity; however, we regularly review and delete outdated information securely.

9. Storage and security of personal data

Personal data is stored securely, including in locked physical storage and on encrypted CRM systems protected by strict password protocols.

10. IP addresses

We collect anonymous statistics relating to website and social media usage. IP addresses may be collected for analytical purposes, though such information does not identify individual users.

11. Cookies and Local Storage

We use browser local storage and session storage (collectively referred to as "cookies" in this policy) to improve website functionality and provide a personalised experience. You can manage your consent through the cookie banner displayed on your first visit to the platform.

11.1. Strictly Necessary

These items are essential for the platform to operate correctly and cannot be declined. They do not require your consent.

  • jwt (Local Storage) — Stores your authentication token to keep you securely logged in. Retained until you log out or the session expires.
  • user (Local Storage) — Stores your user profile data (name, role, ID) used for display and access control throughout the platform. Retained until you log out.
  • notifications (Session Storage) — Temporarily holds your unread in-app notifications for the current browser session. Automatically cleared when the tab or browser is closed.
  • USER_DISABLED_2FA_WINDOW (Session Storage) — Remembers whether you dismissed the two-factor authentication setup prompt during the current session. Automatically cleared when the tab or browser is closed.

11.2. Functional (Optional)

These items enhance your experience by remembering your preferences across visits. You may decline them via the cookie consent banner. The platform will continue to function normally, but your preferences will not be remembered between sessions.

  • smilenow.lang (Local Storage) — Remembers your selected display language so you do not need to reselect it on every visit. Stored persistently until you clear your browser data.
  • smilenow.currency (Local Storage) — Remembers your selected currency for displaying treatment prices. Stored persistently until you clear your browser data.
  • referralCode (Local Storage) — Temporarily stores a referral code passed via a referral link, used to attribute your registration to the referring user. Cleared automatically after sign-up is completed.

We do not use advertising cookies or third-party tracking cookies. No data stored locally on your device is shared with third parties.

12. Data breaches

In the event of a high-risk data breach, we will notify the affected individual(s) within 72 hours, as well as the relevant supervisory authority. All breaches are handled in accordance with our Data Breach Policy and recorded in our breach register.

13. Your rights under GDPR

13.1. Right to be informed

You have the right to clear information about how your personal data is processed, which this Privacy section aims to provide.

13.2. Right of access

You may request access to your personal data and related information, including processing purposes, retention periods, and any data-sharing activities.

13.3. Right to rectification

You may request correction of inaccurate or incomplete personal data. Where such data has been shared with third parties, we will notify them of the rectification where reasonably possible.

13.4. Right to erasure

You may request deletion of your personal data where there is no compelling reason for its continued processing, except where retention is required by law or for regulatory purposes.

13.5. Right to restrict processing

You may request that we restrict processing of your data in certain situations, including where accuracy is contested or where processing is based on legitimate interests.

13.6. Right to data portability

You may request to receive your personal data in a structured, commonly used, and machine-readable format to transfer to another service provider.

13.7. Right to object

Where we process your data based on legitimate interests, you may object to such processing. We will cease processing unless compelling legitimate grounds override your objection.

14. Exercising your rights

You may exercise any of your rights by contacting us using the details provided in these Terms and Conditions. We will respond within one month, extendable by two months for complex requests.

Requests are free of charge unless manifestly unfounded, repetitive, or excessive.

15. Consent

During registration, you may choose your preferred method(s) of contact, such as email or SMS. You may update your preferences at any time. We will use only the methods you have permitted.

16. Age restrictions

The Platform is not intended for use by individuals under the age of 18.

Any medical or personal information relating to a minor may only be submitted by the minor's legal guardian, who is responsible for ensuring the accuracy and lawfulness of such data.

17. Changes to this privacy policy

SmileNow may update or amend this Privacy Policy at any time.

The most recent version will always be available on the Platform. Continued access or use of the Platform following the publication of an updated version constitutes the User's acceptance of the revised Policy.