Privacy Policy

1. Controller and processor roles

For account data (your clinic profile, staff logins, and settings), Medical Solutions is the data controller.

For patient data entered into cartels, the clinic using Medical Solutions is the data controller. Medical Solutions acts as a data processor, storing and processing that data solely on the clinic's instructions and for the purpose of providing the service. If you are a patient with questions about your own medical record, please contact the clinic that holds it directly; we do not have an independent relationship with patients.

Medical Solutions is operated for clinics in Albania, and this policy is written against Law no. 124/2024 "On the Protection of Personal Data", which replaced Law no. 9887/2008. Where a clinic or a data subject is also covered by the EU General Data Protection Regulation, we apply the GDPR alongside it rather than instead of it. Health data is a special category of personal data under both, and is treated as such throughout this policy.

2. What we collect

• Account data: clinic name, owner and staff names, email addresses, hashed passwords, role, and doctor assignments.
• Patient record data entered by clinics: name, date of birth, place of birth, nationality, contact details, address, profession, assigned doctor, and any custom fields the clinic's template defines (which may include health-related information).
• Signatures and images: hand-drawn or uploaded patient/doctor signatures, and images attached to cartel fields.
• Usage and technical data: login timestamps, session identifiers, and basic request metadata needed to operate and secure the service.
• Preference data: your chosen interface language and theme, and your cookie consent choice.

3. Why we process it

• To provide the service: authentication, storing and retrieving cartels, generating PDF exports, and enforcing that each clinic only ever sees its own records.
• To secure accounts: password hashing, session management, and detecting misuse.
• To communicate with you about your account when necessary.
• To remember your language and interface preferences, where you've consented to functional cookies.

4. Where your data is stored

Data is stored using reputable third-party infrastructure providers, principally MongoDB Atlas (database) and Vercel (application hosting and file storage for uploaded images and signatures via Vercel Blob). These providers act as our sub-processors and are bound by their own data protection and security commitments.

We do not sell, rent, or share patient data with advertisers or data brokers.

5. Data retention

Account and patient record data is retained for as long as the clinic's account remains active. If a clinic closes its account, we will delete or anonymize the associated data within a reasonable period, except where we are required to retain it for legal or accounting reasons.

A clinic administrator can archive or delete individual cartels and templates directly from the dashboard.

6. Security

Passwords are hashed and never stored in plain text. Every clinic's data is scoped by a tenant identifier so that one clinic cannot query or view another clinic's records through the application. Traffic to the platform is encrypted in transit.

No system is completely immune to risk, and we encourage clinics to use strong, unique passwords and to limit staff accounts to people who need access.

7. Your rights

If you hold a Medical Solutions account, you may ask us to access, correct, export, or delete your account data, or to restrict or object to certain processing, subject to applicable law. You can update most account details yourself from the dashboard, or contact us using the details below.

If you are a patient and want to exercise rights over your medical record, please contact the clinic that holds it. As the controller of that data, the clinic is responsible for responding to your request; we will assist the clinic in fulfilling it where needed.

If you believe your data has been handled improperly and we have not resolved it with you, you may complain to the Information and Data Protection Commissioner (Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale), the supervisory authority in Albania. Where the GDPR applies to you, you may instead complain to the supervisory authority where you live or work.

8. Cookies

We use a small number of cookies to keep you signed in and to remember your language preference. See our Cookie Policy for the full list and how to manage your choice.

9. International transfers

Our infrastructure providers may process data in countries outside your own. Where that happens, we rely on the safeguards those providers offer (such as standard contractual clauses) to keep your data protected to a comparable standard.

10. Children

Medical Solutions accounts are issued to clinics and their staff, not to children directly. Patient records may relate to minors where a clinic treats them; clinics are responsible for the lawful basis for holding that data.

11. Changes to this policy

We may update this policy from time to time. If we make material changes, we will update the effective date above and, where appropriate, notify clinic administrators.

12. Contact us

Questions about this policy or your data can be sent to Synaps Digital Solutions via synapslimited.eu.