Privacy Policy

1. Controller and processor roles

For account data (your clinic profile, the clinic's shared login, and settings), billing data, data about visitors to this website, and messages you send us, we are the data controller.

For patient data entered into patient records, the clinic using Medical Solutions is the data controller and we are its processor: we store and process that data only on the clinic's instructions, under the data processing agreement in section 4 of our Terms of Service. If this policy and that agreement differ on how we process data for a clinic, the agreement prevails.

The same applies to the activity log of who opened, changed, exported or deleted a patient record, and to the security alerts built from it: we keep them for the clinic, as its processor. Requests about them, including from members of a clinic's staff, go to the clinic, and we help the clinic answer them.

If you are a patient with questions about your own medical record, please contact the clinic that holds it directly; we do not have an independent relationship with patients.

Medical Solutions is operated for clinics in Albania, and this policy is written against Law no. 124/2024 "On the Protection of Personal Data", which replaced Law no. 9887/2008. Where a clinic or a data subject is also covered by the EU General Data Protection Regulation, we apply the GDPR alongside it rather than instead of it. Health data is a special category of personal data under both, and is treated as such throughout this policy.

2. What we collect

• Account data: the clinic's name and details (address, phone, email, opening hours and logo), the name and email address of the person who holds the clinic login, the hashed password and two-factor settings, and the doctors the clinic records, with their details and signatures, and the verification phone number of each login that has one (the clinic owner is asked for it at registration).
• Billing data: the name and address an invoice is made out to, with either a business's NIPT or, for an invoice in a person's own name, their personal number (NID) when they choose to add it, which we store encrypted; what was paid and for which period; and the fiscal invoice registered for each payment. We never receive or store card numbers: cards are entered on the payment provider's own page.
• Patient record data entered by clinics: name, date of birth, place of birth, nationality, contact details, address, profession, assigned doctor, any custom fields the clinic's template defines (which may include health-related information), appointments, prescriptions, price offers, whether the patient agreed to be contacted by email, and the emails sent to them.
• Files: hand-drawn or uploaded patient and doctor signatures, and the files clinics attach to records: photographs and other images, radiographs (including DICOM files), lab reports and other PDF documents. Also the screenshots and photographs sent to us with support messages.
• Messages to us: support conversations, messages sent through the contact form (name, email address, clinic name and message), replies to our emails, and messages and calls to our phone number and to our WhatsApp number.
• Usage, security and technical data: sign-in history (time, outcome, IP address, browser and country), the activity log of who opened, changed, exported or deleted a patient record, a record of which stored files were opened, security alerts, the request logs our hosting provider keeps, and counts of visits to our public pages, made without cookies.
• Records of accepting our terms: each time the owner of a clinic accepts our Terms of Service and this policy, at registration or later, we record who accepted, which edition, in which language, the IP address and browser it was accepted from, and when.
• Trial fingerprints: when a clinic registers, a one-way, keyed hash of its email address, its clinic name and, for a business, its NIPT, used only to recognize a repeat free trial.
• Announcement records: for each announcement a clinic sends, a note of its subject, text, footer, links and how many patients it was sent to, without any recipient's name or address.
• Preference data: your chosen interface language, theme and layout, and your cookie consent choice; and, for a clinic, whether its owner agreed to receive offers from us and whether it switched off news about new features, with when each was set.

3. Why we process it, and on what legal basis

• To provide the service to the clinic: sign-in, storing and retrieving records, producing PDFs, sending the emails a clinic asks us to send to its patients, and making sure each clinic only ever sees its own records. For account data the basis is the contract with the clinic; for patient data we act on the clinic's instructions, and the clinic's own legal basis applies.
• To keep accounts and records secure: password hashing, two-factor sign-in, sign-in history, limits on repeated attempts, the security check on public forms, and an automated check of the activity log, run several times an hour, that warns a clinic of possible misuse of its account. The basis is our legitimate interest in keeping the service, and the health records in it, secure; the alerts are produced for the clinic, as its processor.
• To be able to show that a clinic agreed to the terms under which we process its patients' data, using the records of acceptance described above. The basis is the contract with the clinic and our legitimate interest in being able to show which edition of it the clinic agreed to.
• To send service emails about the account: verification codes, welcome and trial notices, reminders before a paid period ends, invoices and security alerts. The basis is the contract with the clinic.
• To tell clinics about the Service itself in other ways: notices about maintenance, changes to the terms or prices and security go to every clinic, on the basis of the contract with the clinic; news about new features of the Service goes to every clinic whose owner has not switched it off in Settings, on the basis of our legitimate interest in telling existing customers about the product they use, and every such email says how to stop it.
• To send offers and discounts, only to clinics whose owner agreed to receive them, by a separate box at registration that is never checked in advance, or later in Settings. The basis is consent, which the owner can withdraw at any time in Settings or by replying to any offer.
• To make sure it is really the account holder asking before we lift two-factor sign-in from a login: we call the verification phone number on file, never a number given to us during the request. The basis is our legitimate interest in protecting accounts, and the patient records behind them, from being taken over by someone else.
• To count visits to our public pages (the home, pricing, about, contact and legal pages, never the dashboard or the platform's own back office), so that we know how clinics find us: the page, the site the visit came from and any campaign tags in the link, the country and the type of device, counted without cookies and without storing anything in your browser. The basis is our legitimate interest in understanding how our website is used.
• To keep encrypted backup copies, so that the Service and clinics' records can be restored after a fault, a mistake or an attack: every night an encrypted copy of the database, and a copy of each newly uploaded file. The basis is our obligation to keep the data secure and, for patient data, the clinic's instructions under our data processing agreement.
• To ask occasionally for feedback, and to invite a clinic back: a message a week into the free trial, and one after a trial or a paid period ends. The basis is our legitimate interest in hearing from clinics and keeping them as customers. You can object to these at any time by replying to one of them or by writing to us, and we will stop.
• To issue the fiscal invoice Albanian law requires for every payment: we collect the business's NIPT or, when a person invoiced in their own name chooses to add it, their personal number (NID), register the invoice with the General Directorate of Taxes through our fiscalization provider, and keep it for as long as the law requires. The basis is our legal obligation to fiscalize every sale.
• To take payments: the order and the amount go to our payment provider, and we record the outcome. The basis is the contract with the clinic.
• To keep each clinic to one free trial, using the trial fingerprints described above. The basis is our legitimate interest in offering a free trial without it being taken again and again.
• To investigate abuse of announcements: the announcement records described above let us answer a complaint, or a mail provider's question about a message, after the clinic has deleted it. The basis is our legitimate interest in stopping the platform being used to send spam.
• To answer messages, in support conversations, through the contact form, by phone and on WhatsApp, on the basis of the contract with the clinic or, for someone who is not yet a customer, our legitimate interest in replying to people who write to us.
• To remember your language, only if you accept functional cookies, on the basis of your consent, which you can withdraw at any time from the cookie preferences. Theme and layout choices are saved in your browser when you make them, because that is the setting you asked for, and are never sent to us.
• To comply with the law, where a court, prosecutor or other authority lawfully requires information, as described in section 4 of our Terms of Service.

4. Who receives it

We share personal data only with the providers below, each for the purpose stated, and with the authorities the law requires. This list is complete. Each provider that processes personal data for us is bound by written terms imposing the same data protection obligations as ours. The exceptions are Google and Meta. The Gmail mailbox is a consumer Gmail account, not Google Workspace, and we use it under Google's own terms for Gmail. Our WhatsApp number runs on the WhatsApp app on a phone, and we use it under Meta's own terms for WhatsApp.

If a clinic links its own mailbox, the emails it sends its patients go out through that clinic's own mail provider, which the clinic chooses and is responsible for.

We give clinics at least 30 days' notice before adding or replacing a provider that processes patient data, as section 4 of our Terms of Service describes. We do not sell, rent, or share personal data with advertisers or data brokers.

• Vercel: hosts the website and the application, runs the code that handles all of the data above, and stores uploaded files in a private store. It also counts visits to our public pages (Vercel Web Analytics), without cookies.
• MongoDB Atlas (MongoDB, Inc.): the database where account, billing and patient record data is kept.
• Resend: delivers the platform's email, including verification codes, password resets, invoices, account and security notices, our replies to support messages, and the emails clinics send to their patients. It receives the recipient's name and email address, the subject and message, and the clinic's reply address.
• Google (Gmail): the mailbox our addresses on medicalsolutions.al forward to. It receives the support requests, contact form messages and replies to our emails that reach those addresses, with whatever they contain.
• Cloudflare (Turnstile): the security check on the sign-in, registration, password reset and contact forms. It receives your IP address and signals from your browser, to tell people apart from automated abuse.
• Cloudflare (R2): stores our backup copies in the European Union: the database, encrypted with a key only we hold, and copies of uploaded files.
• ImprovMX: receives mail sent to our addresses on medicalsolutions.al, such as support@, info@, privacy@ and njoftime@, and forwards it to that mailbox, with whatever it contains.
• Meta (WhatsApp): carries the messages people choose to send to our WhatsApp number, with whatever they contain.
• Anthropic (Claude): the AI assistant our team uses to build, test and maintain the Service. It can see personal data that appears in what our team works on with it, such as a screenshot sent to support or the data involved in fixing a fault.
• POK: takes card payments on its own page. It receives the order and the amount from us, and the card details directly from you; we receive only the outcome of the payment.
• CONALTUS (Con-Finance): our fiscalization provider. It receives the details of each invoice with the buyer's NIPT or, when a person has added their personal number, that number with their name and address, and registers the invoice with the General Directorate of Taxes.
• Fixie: relays our calls to the fiscalization provider from a fixed internet address, which that provider requires. The calls are encrypted end to end, so it carries invoice data it cannot read.
• The General Directorate of Taxes: receives every fiscal invoice, as Albanian law requires.

5. International transfers

Most of the providers in section 4 are established outside Albania, so personal data is transferred to the United States and the European Union. The application and the database run in the United States: Vercel runs the application's code and keeps uploaded files in Washington, D.C., and MongoDB Atlas keeps the database in Virginia. Resend, Google (Gmail), Anthropic, Fixie and Meta (WhatsApp) are also established in the United States and process the data they receive there, while Cloudflare's security check on our forms and ImprovMX's forwarding of our mail may be processed in the United States or in Europe. Our backup copies are stored in the European Union, with Cloudflare R2. POK, CONALTUS (Con-Finance) and the General Directorate of Taxes are in Albania.

We transfer personal data outside Albania only where Law no. 124/2024 allows it: to a country the Commissioner recognizes as providing an adequate level of protection, or under the safeguards that law accepts, such as contractual clauses or other guarantees authorized as it requires.

Some of these providers also have data centers in other countries. On request, we tell you, for each provider, where it processes data and which safeguard applies, and how to obtain a copy of it.

6. How long we keep it

Account and patient record data is kept for as long as the clinic's account is open. A clinic can archive or delete individual patient records and templates from the dashboard, and can download all of its data itself, with one button, at any time. A patient record that holds prescriptions, files, scan links or the patient's signature cannot be deleted: the clinic can archive it instead, and it is kept with those documents. Prescriptions cannot be deleted on their own, so a record that holds one is kept for as long as the clinic's account is open. Deleting a record that holds none of them removes the address and text of the emails sent to that patient, and takes the patient's name and notes out of the calendar; price offers issued to the patient keep their name and phone number.

When a clinic asks us to close its account, the dashboard is locked, its records stay available for export for 30 days in case the request was a mistake, and then we erase the account and everything in it, including the activity log, sign-in history and security alerts. Backup copies are deleted on their own schedule: each night's encrypted copy of the database after 35 days, and the copies of the clinic's uploaded files when we remove them from the backup, which we do within 60 days of the erasure.

A verification phone number is kept for as long as the login it belongs to, and is removed when its holder removes it or the login is deleted. The email choices described in section 2 are kept for as long as the clinic's account. Visits to our public pages are kept by Vercel only as totals, with no way back to the person who visited.

Billing data is the exception. Payment records and fiscal invoices are records we are required to keep as the seller, so when a clinic's account is erased they are kept, separated from the account, for the period Albanian tax and accounting law requires, and then deleted. They contain no patient data.

The activity log of who opened, changed, exported or deleted a patient record, and the record of which stored files were opened, are deleted after 24 months. The IP address on each activity log entry is removed after 30 days. Security alerts are deleted 24 months after the clinic answers them. The recipient address and text of emails sent through the platform are removed after 24 months, or sooner once the patient's record is deleted; the subject line, the kind of message and when it was sent stay with the account. Sign-in history is deleted after 90 days. Announcement records are deleted after 180 days. Records of accepting our terms are kept for as long as the clinic's account exists, as evidence of what it agreed to, and are erased with it.

Trial fingerprints are kept for as long as we offer a free trial, including after an account is erased, because recognizing a repeat registration is their only purpose. They cannot be turned back into the email address, name or NIPT they came from; they can only be matched when the same value is entered again.

Support conversations are kept until the clinic deletes them or its account is erased. The email notifications we send about them carry no message text. Messages sent through the contact form, and replies to our emails, are kept in our mailbox for as long as we need them to answer and follow up.

Our hosting provider keeps request logs (the time, the page address, the IP address and the browser) for security and troubleshooting, for a limited period, after which they are deleted automatically. Page addresses can contain a record's identifier; they are built so that they do not carry patient names or clinical details.

7. Security

Passwords are hashed and never stored in plain text. Two-factor secrets, the passwords of linked mailboxes and personal ID numbers are stored encrypted. Every clinic's data is scoped by a clinic identifier so that one clinic cannot query or view another clinic's records through the application. Traffic to the platform is encrypted in transit.

No system is completely immune to risk, and we encourage clinics to use strong, unique passwords and two-factor sign-in, to share the clinic login only with people who need access, changing the password when one of them leaves, and to follow the advice on shared computers in section 2 of our Terms of Service.

8. Your rights

If you hold a Medical Solutions account, or have written to us, you may ask us to access, correct, export, or delete your personal data, to restrict its processing, or to object to processing based on our legitimate interest, including the feedback emails in section 3, subject to applicable law. Where processing is based on your consent, you can withdraw it at any time. You can update most account details yourself from the dashboard, or contact us using the details in section 13. We reply within one month of receiving a request; if a request is complex we may extend that by up to two further months, telling you why within the first month.

If you are a patient and want to exercise rights over your medical record, please contact the clinic that holds it. As the controller of that data, the clinic is responsible for responding to your request; we will assist the clinic in fulfilling it where needed.

You can complain to the Information and Data Protection Commissioner (Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale), the supervisory authority in Albania, at any time. You do not need to contact us first. Where the GDPR applies to you, you may also complain to the supervisory authority where you live or work.

9. Cookies and browser storage

We use a small number of cookies and similar browser storage to keep you signed in, to protect our forms from automated abuse, to keep what you are typing into a form until you save it, and to remember your choices. Only the language cookie depends on your consent to functional cookies. Theme and layout choices are saved in your browser when you make them, and stay there until you clear them. See our Cookie Policy for the full list and how to manage your choice. Visits to our public pages are counted without any cookie or browser storage.

10. Children

Medical Solutions accounts are issued to clinics, one shared login per clinic, not to children directly. Patient records may relate to minors where a clinic treats them; clinics are responsible for the lawful basis for holding that data.

11. Changes to this policy

We may update this policy from time to time, and the date above changes whenever we do. The list of providers in section 4 is part of our data processing agreement with clinics, so a change to it, or any other material change, is put to every clinic to accept in the dashboard, with the notice our Terms of Service describe.

12. Language

This policy is published in Albanian and English. If the two versions differ, the Albanian version prevails.

13. Contact us

Questions about this policy or your data, and requests to exercise your rights, can be sent to privacy@medicalsolutions.al or through the contact form at www.medicalsolutions.al/contact. A clinic can also write to us from the Support page in its dashboard. You can call us on +355 67 56 54 602, or write to us on WhatsApp at +32 45 607 1631.

The controller is ADSH-2014 (NIPT L41804001A, registered address Tiranë, Njësia Administrative nr.6, Rruga 'Hamdi Pepa', Pallati i ri, kati përdhes, Njësi tregtare 2B, zona kadastrale 8240). We have not appointed a data protection officer; the contact details above reach the people responsible for data protection.