Privacy policy
Last updated: 29 October 2026
This policy explains how we process personal data when you visit aeviadental.com, write to us or come to the clinic for treatment. We apply Albanian Law No. 124/2024 on personal data protection and, for people in the European Union, the General Data Protection Regulation (EU) 2016/679 (GDPR).
Who is responsible
, NIPT , Rruga Aleksandër Goga, 2nd floor, Durrës 2000, Albania, runs AEVIA Dental & Aesthetic and is the controller of your personal data.
For any question about your data, write to us on WhatsApp or call +355 69 284 2279, or write to the address above.
Our representative in the European Union (GDPR Art. 27): .
What data we process
- Contact data: name, phone number, email address, the language you write in and your messages.
- Health data you choose to send before a visit: photos of your teeth, X-rays, a description of your situation and the treatment you are interested in.
- Clinical data when you are our patient: medical history, examinations, X-rays and scans, treatment plan and notes, consent forms and clinical photos.
- Administrative data: appointments, invoices and payments, and the travel dates you share with us.
- Website data: the technical data your browser sends (IP address, browser type, pages requested), processed by our hosting provider to deliver and protect the site. Statistics and advertising data only if you accept the corresponding cookies; see the cookie policy.
- Reference code: the assessment form creates a code (for example AEV-EN-IMP-…) so that we can match your message to your request. If you have accepted statistics cookies, the code also shows how you reached the site, for example through an advertising campaign.
Giving us data is your choice. Without contact data we cannot reply to you; without health data we cannot assess or treat you.
Why we process it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Replying to your messages and preparing a free assessment or a treatment plan | Steps you ask for before a treatment (GDPR Art. 6(1)(b)). For health data: your explicit consent (Art. 9(2)(a)), which you give in the form or by sending the data to us. |
| Diagnosis, treatment and aftercare; keeping your clinical record | Treatment contract (Art. 6(1)(b)); health care by professionals bound by medical secrecy (Art. 9(2)(h)); legal obligations on health records (Art. 6(1)(c)). |
| Appointments, reminders and organising your visit | Treatment contract and the steps before it (Art. 6(1)(b)). |
| Invoices, accounting and tax | Legal obligation (Art. 6(1)(c)). |
| Running and protecting this website | Our legitimate interest in a working, secure site (Art. 6(1)(f)). |
| Visit statistics and measuring our advertising | Your consent in the cookie banner (Art. 6(1)(a)). |
| Publishing photos of a treatment result, or your review | Your separate written consent (Art. 6(1)(a) and 9(2)(a)). We never publish them without it. |
| Establishing or defending legal claims | Our legitimate interest (Art. 6(1)(f)); for health data Art. 9(2)(f). |
Albanian Law No. 124/2024 follows the GDPR and provides corresponding legal bases.
The assessment form and WhatsApp
The assessment form does not send your answers to us or to any server. When you press "Send on WhatsApp", it opens WhatsApp with your answers already written, and you decide whether to send them. The indicative estimate is calculated in your browser from the prices on this site; no decision about you is made by automated means.
WhatsApp is a service of Meta. Messages are end-to-end encrypted; WhatsApp processes data about your account and your use of the service under its own privacy policy. If you prefer not to use WhatsApp, call us or visit the clinic.
Who receives your data
Inside the clinic, only the staff who need it for your care. All of them are bound by medical confidentiality.
Outside the clinic:
- Providers that process data on our behalf, under contract: Cloudflare, Inc. (hosting and security of this website), Google (Google Analytics, only with your consent), the dental laboratory (only what it needs to make your crowns, bridges or prostheses), our accountant and our IT providers.
- Providers that also decide how they use the data, under their own privacy policies: Meta (WhatsApp, and the Meta Pixel only with your consent) and Google (Google Ads, only with your consent).
- Public authorities, when the law requires it (for example tax or health authorities, or a court).
We do not sell personal data, and we do not use health data for advertising.
Transfers outside Albania and the EU
Our clinic is in Albania, outside the European Union, so the data you send us is processed in Albania. We apply the GDPR to the data of people in the EU.
Cloudflare, Google and Meta may also process data in the United States. These transfers rely on the EU-US Data Privacy Framework, under which these companies are certified, or on the European Commission's standard contractual clauses.
How long we keep it
- Messages and assessments that do not lead to a visit: 12 months after the last contact.
- Clinical records: 10 years after your last treatment, or longer if the law requires it.
- Invoices and accounting records: as long as tax and accounting law requires.
- Photos and reviews published with your consent: until you withdraw it.
- Cookies and statistics: see the cookie policy.
Your rights
You can ask us at any time to:
- see the data we hold about you and receive a copy;
- correct it if it is wrong or incomplete;
- delete it, unless the law requires us to keep it (for example your clinical record);
- restrict its use while we check a request of yours;
- receive the data you gave us in a common electronic format, or have it sent to another provider;
- object to processing based on our legitimate interest.
Where we rely on your consent, you can withdraw it at any time. This does not affect processing carried out before.
Write to us on WhatsApp or by post. We reply within one month and may ask you to confirm your identity first.
Complaints
If you think we process your data unlawfully, you can complain to a supervisory authority:
- in Albania: Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale (Commissioner for the Right to Information and Protection of Personal Data), Rruga Abdi Toptani, Ndërtesa 5, 1001 Tiranë, idp.al;
- in Italy: Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, garanteprivacy.it;
- in another EU country: the authority where you live or work (list of EU authorities).
If you like, write to us first: most questions are solved directly.
Children
This website is not directed at children. For patients under 18, a parent or legal guardian sends the information and gives consent.
Security
Only the staff who need your data can access it. Our devices and accounts are protected by passwords, and this site uses an encrypted connection (HTTPS). If a data breach is likely to put your rights at risk, we inform the supervisory authority and, where required, you.
Changes
We update this policy when the way we process data changes. The date at the top shows the current version.