Privacy policy

The doctorestimator.ro website and application are operated by CODEMARS SRL, registered office at 2 Armoniei Street, Șelimbăr, Sibiu, Romania, tax identification number RO45431372, contact email: contact@doctorestimator.ro.

In this policy, “Doctor Estimator”, “we”, “us”, “our” and “the controller” mean the entity above.

This policy explains how we process personal data when you:

• visit doctorestimator.ro;
• complete the expression-of-interest / beta-registration form;
• communicate with us by email, form or telephone;
• receive access to and use the Doctor Estimator application; or
• interact with the cookie banner and, where applicable, set your cookie and analytics choices.

Doctor Estimator is a tool for organisation and record keeping for healthcare professionals.

Where a user enters patient data into the application, including name, telephone number, clinic, procedure or other information associated with medical services, that user may determine the purposes and means of processing for their own professional activity. In such cases, the user may act as controller for those data and Doctor Estimator may act, depending on context and the contractual relationship, as a technical provider/processor.

If the application is used with real patient and medical-procedure data, some data may constitute health data, a special category receiving additional protection under GDPR.

We recommend that users enter only strictly necessary data. Initials or short identifiers may remain personal data if, in the specific context, a person can be identified directly or indirectly.

We use a limited number of providers (processors/sub-processors) to operate the service. The principal providers are:

• Vercel Inc. — hosting and delivery of the website and dashboard application;
• Railway Corp. — backend infrastructure (API) hosting;
• Neon (Neon Inc.) — PostgreSQL database hosting, with encryption in transit (TLS) and at rest;
• Anthropic — AI processing for appointment import from images. The uploaded image and import note are sent to the Anthropic API solely to extract appointments; images are not stored on our servers. Images may contain patient names and Anthropic processing may occur outside the EU, including in the United States, under standard contractual clauses and/or the EU-US Data Privacy Framework (DPF). Anthropic does not use these data to train its models;
• Twilio SendGrid — operational email delivery (invitations and account activation), with processing configured in the European Union;
• Sentry (Functional Software, Inc.) — technical error monitoring, with data stored in the European Union region;
• Google Analytics — website traffic analysis, only if you consented to this processing;
• consultants, lawyers or providers assisting us in operating the service; and
• public authorities or competent institutions, where required by law.

Data are transferred only to the extent necessary for the purposes described in this policy. The current sub-processor list is also available in the Data Processing Agreement.

Some technical providers may store or process data outside Romania or the European Economic Area. Where such transfers occur, we rely on appropriate legal mechanisms, such as standard contractual clauses, adequacy decisions or other safeguards under applicable law.

In particular, the AI import function (Anthropic) may process uploaded images outside the European Economic Area under standard contractual clauses and/or the EU-US Data Privacy Framework (DPF). We do not guarantee processing exclusively in the European Union for AI functions.

We retain data only as long as necessary for the purposes for which they were collected and to comply with legal obligations.

Indicatively:

• expression-of-interest/beta form data may be retained for up to 12 months from the last interaction, if they do not become a contractual relationship;
• account data are retained for the life of the account and afterwards for a reasonable period necessary for security, support, internal audit and legal obligations;
• data entered in the application are retained until deleted by the user, account closure or receipt of a valid deletion request, except where legal obligations or legitimate grounds justify temporary retention; and
• backups and technical logs may be retained for a limited period under our operational and security policies.

The user may request deletion of the account and, where applicable, associated data by sending a written request to contact@doctorestimator.ro.

We will assess the request and respond within a reasonable time under applicable law. In certain situations, we may retain certain data for an additional period, for example where necessary to comply with a legal obligation, defend legal claims or complete the normal backup and restoration cycle. The right to erasure is not absolute.

Subject to the conditions set out by law, you may have the following rights:

• access to your data;
• rectification;
• erasure;
• restriction of processing;
• data portability;
• objection where processing is based on legitimate interest;
• withdrawal of consent where processing is based on consent; and
• lodging a complaint with the competent supervisory authority.

To exercise your rights, write to contact@doctorestimator.ro. We may request additional information to verify your identity before responding.

We respond to rights requests (including requests for data export in a structured format or account deletion) within no more than 30 days of receiving the request, in accordance with GDPR Article 12.

In Romania, the competent supervisory authority is:

We may update this policy periodically. The current version will remain available on this page together with the date of the last update.

Where changes are material, we may notify users by email or through the application, where appropriate.

For questions about this policy or the processing of personal data, contact us at contact@doctorestimator.ro.