This Privacy Policy explains how Alba Med Health ("we", "us", "our") collects, uses, stores and protects your personal data when you visit www.albamedhealth.com or contact us in connection with our dental tourism coordination services. We are committed to protecting your privacy and handling your data in accordance with the General Data Protection Regulation (GDPR) and applicable data protection law.

1. Who We Are

Data Controller: Alba Med Health, Tirana, Albania
Website: www.albamedhealth.com
Email: care@albamedhealth.com
WhatsApp: +355 68 947 5964

We act as a dental tourism coordinator, connecting international patients with partner dental clinics in Tirana, Albania. We do not own or operate the clinical facilities. Treatment is provided by our partner clinics, who act as separate data controllers in respect of your clinical records.

2. What Personal Data We Collect

2.1 Information you provide to us directly:

• Name, email address, phone number and WhatsApp number
• Country of residence and preferred language
• Dental X-rays, photographs of your teeth, and written descriptions of your dental condition
• Existing dental treatment history shared for the purpose of obtaining a consultation
• Any other information you choose to share with us via WhatsApp, email or our website contact form

2.2 Information we collect automatically:

• IP address, browser type, device type and operating system
• Pages visited on our website, time spent on pages, and referring website
• Cookie data (see Section 9)

2.3 Special category data: Dental X-rays, clinical photographs and health information you share with us constitute special category data under GDPR. We process this data only with your explicit consent and solely for the purpose of providing you with a treatment assessment and coordinating your care.

3. How We Use Your Personal Data

• To provide you with a free initial consultation and written treatment plan
• To coordinate your treatment with our partner dental clinics in Tirana
• To arrange airport transfers and hotel bookings on your behalf
• To communicate with you before, during and after your treatment
• To provide aftercare support and follow-up
• To respond to your enquiries
• To improve our website and services (using anonymised analytics data only)
• To comply with our legal obligations

We will not use your data for unsolicited marketing without your consent. We will not sell, rent or transfer your data to third parties for their own marketing purposes.

4. Legal Basis for Processing

4.1 Contractual necessity (Article 6(1)(b)): Processing is necessary to provide the services you have requested, including preparing your treatment plan and coordinating your care.

4.2 Legitimate interests (Article 6(1)(f)): We process certain data on the basis of our legitimate interests, including responding to enquiries, providing aftercare, and improving our services.

4.3 Explicit consent (Article 9(2)(a)): For special category data — including dental X-rays, clinical photographs and health information — we rely on your explicit consent. You may withdraw consent at any time by contacting us.

4.4 Legal obligation (Article 6(1)(c)): We may process data where required to comply with applicable law or regulatory requirements.

5. Who We Share Your Data With

5.1 Partner dental clinics: Your dental X-rays, photographs and clinical information will be shared with the partner clinic in Tirana providing your treatment.

5.2 Hotel and transfer providers: Where you ask us to arrange accommodation or airport transfers, we share your name, arrival details and contact information with the relevant provider solely to fulfil your booking.

5.3 Technology and service providers: We use third-party providers for website hosting, analytics and messaging (including WhatsApp, operated by Meta Platforms).

5.4 Legal and regulatory authorities: We may disclose your data to law enforcement or regulatory authorities where required to do so by law.

We do not sell, rent or transfer your personal data to any third party for their own commercial purposes.

6. International Data Transfers

Your personal data may be transferred to and processed in Albania, which is outside the European Economic Area (EEA). Where we transfer your data outside the EEA, we ensure appropriate safeguards are in place, including the use of standard contractual clauses approved by the European Commission where applicable.

Your data may also be processed by WhatsApp (Meta Platforms), which involves transfers to the United States. Meta relies on standard contractual clauses for such transfers.

7. How Long We Keep Your Data

• Consultation enquiries (no treatment booked): 2 years from last contact
• Treatment coordination records: 7 years from completion of treatment
• Financial records: 7 years (in line with standard accounting requirements)
• Marketing communications (where consented): until consent is withdrawn
• Website analytics data: 26 months (anonymised)

8. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction or damage. These measures include:

• SSL/TLS encryption for all data transmitted via our website
• End-to-end encryption for WhatsApp communications
• Access controls restricting data access to authorised personnel only
• Regular review of our data handling practices

9. Cookies

9.1 Essential cookies: Necessary for the website to function. Cannot be disabled.

9.2 Analytics cookies: We use Google Analytics to understand how visitors use our website. This data is collected in anonymised or aggregated form. You can opt out via the cookie consent banner on your first visit.

9.3 Managing cookies: You can control cookie preferences via the cookie consent banner when you first visit our site. You may also configure your browser to refuse cookies, though this may affect site functionality.

10. Your Rights

Under GDPR, you have the following rights in relation to your personal data:

• Right of access: to request a copy of the personal data we hold about you
• Right to rectification: to request correction of inaccurate or incomplete data
• Right to erasure: to request deletion of your personal data
• Right to restrict processing: to request that we limit how we use your data
• Right to data portability: to receive your data in a structured, machine-readable format
• Right to object: to object to processing based on legitimate interests
• Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time
• Right to lodge a complaint: with your national data protection supervisory authority

To exercise any of these rights, please contact us at care@albamedhealth.com. We will respond within 30 days.

11. Children's Privacy

Our services are not directed to persons under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a person under 18, please contact us immediately and we will delete it.

12. Links to Third-Party Websites

Our website may contain links to third-party websites. This Privacy Policy does not apply to those sites. We encourage you to read the privacy policies of any third-party sites you visit.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The current version will always be available at www.albamedhealth.com/privacy-policy/. Where changes are material, we will notify active patients by email or WhatsApp before the changes take effect.

14. Contact Us

Alba Med Health
Tirana, Albania
Email: care@albamedhealth.com
WhatsApp: +355 68 947 5964
Website: www.albamedhealth.com