Our Privacy Policy.

1. Who we are

This policy explains how Kurti Clinic collects, uses and protects your personal data when you visit our website, contact us or receive treatment at the clinic. We are the controller of this data:

2. Legal basis

We process data in accordance with:

• Albanian Law no. 124/2024 "On the protection of personal data" in the Republic of Albania;
• the General Data Protection Regulation (GDPR) – Regulation (EU) 2016/679, for patients and visitors from the European Union to whom we offer our services;
• Albanian Law no. 54/2024 "On electronic communications in the Republic of Albania", for the use of cookies (see the Cookie Policy);
• Albanian legislation on healthcare services and medical professional secrecy.

3. What data we collect

Data you give us

• Identification and contact: first name, surname, email, phone/WhatsApp, country of residence, preferred language.
• Health data: panoramic X-ray (OPG), CT/CBCT, photos of your teeth, medical and dental history, allergies and medication you declare to us.
• Travel data: arrival and departure dates, flight, accommodation, when you ask us to help organise them.
• Communications: messages you send us by form, email, phone or WhatsApp.
• Financial data: quote, invoices and payments (we do not store bank card numbers).

Data collected automatically

• IP address, device and browser type, pages visited and the source of the visit (e.g. an ad), through cookies and similar technologies, only according to your choice in the cookie banner.

4. Purpose and legal basis

We do not make decisions about you based solely on automated processing, nor do we create profiles with legal effects for you.

5. Health data

Health data is a special category of data and is handled with additional protection:

• it is seen only by the doctors, assistants and lab technicians working on your case, all bound by professional secrecy;
• we use it only to assess, plan and carry out your treatment;
• "before and after" photos are published only with your specific written consent, which you can withdraw at any time;
• you can withdraw your consent to sending health data before your visit whenever you wish; withdrawal does not affect the lawfulness of earlier processing.

6. Who we share it with

We never sell your data. We share it only when necessary, with:

• Service providers (processors) who act on our instructions and under contract: CRM platform and contact form (GoHighLevel / LeadConnector), email and hosting services, WhatsApp (Meta), Google (Maps, Analytics) and Meta (advertising), the last two only if you consent to cookies;
• Travel partners (transfers, accommodation), only the minimum data and only when you ask us;
• Public authorities, where required by law;
• Your dentist at home, only at your request.

7. Transfers outside Albania

Some service providers may process data outside Albania and the EU (e.g. in the USA). In these cases, transfers take place only with the safeguards required by law, such as standard contractual clauses or an approved adequacy framework. You can request a copy of these safeguards by writing to us.

8. How long we keep it

9. How we protect it

We use appropriate technical and organisational measures: encrypted connections (HTTPS), password- and role-based access, backups, and confidentiality agreements with staff and providers. In the event of a security breach that puts your rights at risk, we notify the Commissioner within 72 hours and, where the risk is high, you as well.

10. Your rights

At any time, free of charge, you have the right:

• to be informed and to access your data, including receiving a copy;
• to rectify inaccurate or incomplete data;
• to request erasure of your data, except where the law requires us to keep it (e.g. medical records);
• to restrict processing;
• to receive your data in electronic format and transfer it to another doctor (portability);
• to object to processing based on legitimate interest and to direct marketing;
• to withdraw your consent at any time.

Write to us at info@kurticlinic.com. We reply without delay and within 30 days at the latest. For your security, we may ask you to verify your identity.

11. Complaints

If you believe your data is not being handled properly, write to us at info@kurticlinic.com. We treat every complaint as a priority and reply in writing. The law also gives you the right to lodge a complaint with the authority responsible for personal data protection.

12. Minors

This website is not aimed at children. We process the data of patients under 18 only with the consent and in the presence of a parent or legal guardian.

13. Changes

We may update this policy when our services or the law change. The version in force is always the one on this page, with the update date at the top.

14. Contact

For any privacy questions: