Privacy Policy — Neocliniq
This English translation is provided for convenience only. In case of any discrepancy, the Romanian version prevails.
1. Introduction and the data controller
This policy explains how personal data are processed in connection with the Neocliniq platform (the neocliniq.com website and the app.neocliniq.com application), in accordance with Regulation (EU) 2016/679 (the “GDPR”) and applicable Romanian legislation.
The data controller for the data described in Section 3 is:
Microsec International SRL, with its registered office at Str. Lungă, Nr. 53, Sibiu, Sibiu County, Romania, registered with the Trade Registry under no. J32/937/2022, CUI 46116608 (VAT: RO46116608), contact e-mail: contact@neocliniq.com (hereinafter “Neocliniq” or “we”).
Please also read Section 4 carefully, as it explains an essential distinction: for a significant part of the data in the Platform (the data entered by laboratories about cases, clinics and patients), Neocliniq is not a controller but a processor, the controller being the customer laboratory.
2. Definitions in brief
- “personal data” — any information relating to an identified or identifiable natural person;
- “controller” — the entity that determines the purposes and means of the processing;
- “processor” — the entity that processes data in the name and on behalf of the controller;
- “Customer” / “laboratory” — the entity that holds a Neocliniq subscription;
- “User” — the natural person who uses the application through an account.
3. What data we process as a controller
3.1. Account and identity data
When you create an account and sign in, we process: name, e-mail address, password (stored exclusively, in cryptographically protected form, by our authentication provider Auth0 — we have no access to plain-text passwords), the technical account identifier, your role within the workspace, as well as authentication logs (date, time, IP address).
3.2. Billing and payment data
For subscriptions we process: the Customer’s name and fiscal identification details, the name of the contact person, the billing address, and the history of invoices and payments. Full bank card details are collected and processed exclusively by the payment processor Stripe and never reach Neocliniq’s servers; we receive only limited information (for example, the last 4 digits of the card, the payment status).
3.3. Technical and usage data
Use of the Platform generates technical logs: IP address, browser and device type, pages/actions accessed, error messages, timestamps. We use them for security, troubleshooting and the proper functioning of the Service.
3.4. Support correspondence
When you contact us (for example, at contact@neocliniq.com), we process your contact details and the content of the correspondence in order to respond to your request.
3.5. The form on our offer pages
On the offer pages you reach from our ads (addresses starting with /o/, for example /o/configurare-gratuita/) you can leave your phone number, your role in the lab and your lab’s name, as well as, optionally, your first name and the number of technicians, so that we can call you about Neocliniq. Together with these we record the offer and the page you sent the form from, the campaign labels in the link (for example the source and the names of the campaign and the ad), the page language and the time of sending. For this form we do not record your IP address and do not use cookies.
3.6. The Meta Pixel on offer pages (only with your consent)
Only if you agree in the consent bar, the offer pages load the Meta Pixel of Meta Platforms Ireland Limited. It tells Meta that you visited the page and, where applicable, that you sent the form — without the form’s content — together with technical identifiers (the _fbp and _fbc cookies, your IP address, browser and device type). We use this to measure and improve our ads. You can withdraw your consent at any time through “Cookie settings” in the offer page footer. The rest of the website and the app never load the Pixel.
We do not process special categories of data (Art. 9 GDPR) in our capacity as controller. Such data may exist in the Platform only as part of the data entered by the Customer, a situation covered by Section 4.
4. Our role as processor: data entered by laboratories
4.1. Within its workspace, the Customer (the laboratory) may enter data about orders/cases, partner clinics and doctors and, in certain situations, data relating to patients (for example, a patient’s name or identifiers associated with a case, technical details of the work, any attached files).
4.2. For all such data, the controller is the customer laboratory, which determines what data it enters and for what purpose, while Neocliniq acts exclusively as a processor within the meaning of Art. 28 GDPR: we process such data only on the basis of the Customer’s documented instructions (embodied in the Platform’s functionality and in the contract), only for the provision of the Service, and we do not use it for our own purposes.
4.3. The controller–processor relationship is governed by a data processing agreement (DPA), which forms an integral part of the Platform’s Terms and Conditions and covers the requirements of Art. 28(3) GDPR: the subject matter and duration of the processing, its nature and purpose, the types of data, confidentiality obligations, security measures, the regime applicable to sub-processors (Section 6 below), the assistance provided to the controller with regard to data subjects’ rights and incidents, and the deletion or return of the data upon termination of the services.
4.4. Data subjects whose data have been entered into the Platform by a laboratory (for example, patients) are asked to address their requests in the first instance to the laboratory concerned, in its capacity as controller. We will assist the laboratory, upon request, in resolving such requests.
5. Purposes and legal bases of the processing (as controller)
| Purpose | Data | Legal basis |
|---|---|---|
| Account creation, authentication, provision of the Service | account and identity data | performance of the contract — Art. 6(1)(b) GDPR |
| Invoicing, collection of payments, accounting records | billing and payment data | legal obligation — Art. 6(1)(c) GDPR; performance of the contract — Art. 6(1)(b) |
| Platform security, prevention of fraud and abuse, technical logging | technical and usage data | legitimate interest — Art. 6(1)(f) GDPR (protecting the service and our customers) |
| Diagnosing and remedying errors, improving the Service | technical and usage data, in as limited a form as possible | legitimate interest — Art. 6(1)(f) GDPR |
| Operational communications (notifications regarding the account, the subscription, changes to the terms) | e-mail, account data | performance of the contract — Art. 6(1)(b) GDPR |
| Support and correspondence | support correspondence | legitimate interest / pre-contractual or contractual steps, as applicable |
| Calling you about Neocliniq, at your request, from our offer pages | phone, first name, lab, role in the lab, number of technicians, offer, page and campaign labels | pre-contractual steps taken at the data subject’s request — Art. 6(1)(b) GDPR; legitimate interest in knowing which campaign you came from — Art. 6(1)(f) |
| Measuring our ads with the Meta Pixel (offer pages only) | technical identifiers, page visit, form submission (without its content) | consent — Art. 6(1)(a) GDPR and the cookie rules (Romanian Law no. 506/2004) |
| Defending rights in legal proceedings | the relevant data | legitimate interest — Art. 6(1)(f) GDPR |
We do not use data for e-mail marketing without consent, we do not make automated decisions producing legal effects concerning data subjects, and we do not carry out profiling (Art. 4(4) and Art. 22 GDPR).
6. Recipients and processors (sub-processors)
To provide the Service we use the following providers, which process data on our behalf (and, for the data referred to in Section 4, as sub-processors of Neocliniq, under the Customer’s general authorization given through the DPA):
| Provider | Role | Processing location |
|---|---|---|
| Microsoft Azure (Microsoft Ireland Operations Ltd.) | hosting of the infrastructure, databases and files | West Europe region (Netherlands), EU |
| Auth0 / Okta | authentication and identity management services | tenant in the EU region |
| Stripe (Stripe Payments Europe Ltd.) | card payment processing and subscription management | EU, with possible transfers to Stripe Inc. (USA) subject to the safeguards described in Section 7 |
| Microsoft Azure Communication Services | sending transactional e-mails (invoices, account notifications) | Microsoft infrastructure, with processing directed towards the EU |
If you consent on our offer pages (Section 3.6), the data collected by the Pixel go to Meta Platforms Ireland Limited. For collecting and transmitting these data we are joint controllers with Meta (Art. 26 GDPR); Meta’s further processing is governed by its own privacy policy.
Platform data are hosted in the European Union. We may also disclose data to public authorities where the law requires us to do so, as well as to professional advisers (accountants, lawyers) bound by confidentiality obligations. We do not sell personal data.
The up-to-date list of sub-processors is available on request at contact@neocliniq.com; relevant changes will be communicated to Customers in accordance with the DPA.
7. International transfers
As a rule, data processing takes place in the European Union (the EU regions of the providers referred to in Section 6). To the extent that a provider carries out, for certain operations, transfers to third countries (for example, to Stripe, Microsoft or — for data collected by the Pixel with your consent — Meta group entities in the United States), such transfers take place on the basis of the safeguards provided for in Chapter V of the GDPR: adequacy decisions (including the EU–U.S. Data Privacy Framework, where applicable) and/or standard contractual clauses (SCCs) adopted by the European Commission, supplemented, where necessary, by additional measures.
8. Data retention
- Account data: for as long as the account and the workspace exist; after the contract ends, workspace data are retained for a 90-day grace period (for export or reactivation) and then permanently deleted from active systems, in accordance with the Terms;
- Billing data and financial-accounting documents: for the period required by Romanian tax and accounting legislation (currently, as a rule, 5 years, or the special retention periods applicable to supporting documents);
- Technical and security logs: short periods, proportionate to the purpose (as a rule, up to 12 months), except where incidents are being investigated;
- Support correspondence: for as long as necessary to resolve the request and to keep a record of the contractual relationship, as a rule no more than 3 years from the last interaction;
- Offer-page form data: at most 12 months from your last submission if you do not become a customer; if you do, the rules for account data apply;
- Your Meta Pixel choice: kept only in your browser until you change it or clear the site’s data;
- Backups: deleted data disappear from backups in accordance with their normal rotation cycle.
For data processed in our capacity as processor (Section 4), the retention period is determined by the customer laboratory; upon termination of the services, we apply the deletion/return regime set out in the DPA and the Terms.
9. Your rights
As a data subject, you have, under the conditions laid down in the GDPR, the following rights:
- the right of access to the data concerning you (Art. 15);
- the right to rectification of inaccurate or incomplete data (Art. 16);
- the right to erasure (the “right to be forgotten”), in the situations provided for in Art. 17;
- the right to restriction of processing (Art. 18);
- the right to data portability (Art. 20);
- the right to object to processing based on legitimate interest (Art. 21);
- the right not to be subject to a decision based solely on automated processing which produces legal effects (Art. 22);
- the right to withdraw your consent, where processing is based on consent, without affecting the lawfulness of processing carried out beforehand.
To delete your account, the steps and what is kept are described on the Deleting your account page.
To exercise these rights, write to us at contact@neocliniq.com. We will respond within one month at the latest; this period may be extended by two further months in complex cases, in which case you will be informed. If your request concerns data entered into the Platform by a laboratory (Section 4), we will forward it to the laboratory acting as controller and will assist it in resolving the request.
You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — 28-30 G-ral. Gheorghe Magheru Blvd., District 1, Bucharest, www.dataprotection.ro — as well as the right to bring proceedings before the courts.
10. Data security
We apply appropriate technical and organizational measures, including:
- encryption of data in transit (TLS/HTTPS) and encryption at rest provided by the cloud infrastructure;
- authentication through a specialized provider (Auth0), with no storage of plain-text passwords; support for modern authentication mechanisms;
- logical separation of each workspace’s data (multi-tenant architecture with tenant-level isolation);
- role-based access control, both within the application and internally, on a need-to-know basis;
- logging, monitoring and periodic backups;
- hosting in certified data centres (Microsoft Azure, EU), with industry-grade physical and organizational measures;
- vendor assessment and the conclusion of data processing agreements with each sub-processor.
In the event of a personal data breach likely to result in a risk to individuals’ rights, we will notify the ANSPDCP and, where required by law, the data subjects and/or the laboratories acting as controllers, within the time limits laid down in Art. 33–34 GDPR.
11. Cookies and similar technologies
11.1. The marketing website (neocliniq.com) does not set tracking, analytics or marketing cookies, with one exception: the offer pages reached from our ads (addresses starting with /o/), where, only if you agree in the consent bar, the Meta Pixel loads and sets the _fbp and _fbc cookies (Section 3.6). If you refuse, the Pixel does not load and the form works just the same. You can change your choice at any time through “Cookie settings” in the offer page footer; when you withdraw consent, we delete these cookies. Otherwise the website uses only the browser’s local storage (localStorage) for a few functional preferences — the display theme, the chosen language, the dismissal of the informational banner and your Pixel choice; these preferences remain in your browser and are never transmitted to us.
11.2. The application (app.neocliniq.com) uses only storage mechanisms that are strictly necessary for its operation: session and authentication elements (including those set by the authentication provider Auth0 to keep the session secure) and basic functional preferences (for example, the display theme). Under applicable legislation, these do not require consent, as they are indispensable for providing the service requested.
11.3. For any other non-essential cookies we will update this policy and request prior consent through a dedicated banner.
12. Changes to this policy
We may update this policy to reflect legislative or technical changes, or changes to our services. The current version is published on the website at all times. Significant changes will be announced through the application and/or by e-mail, before they take effect, where the law or the nature of the change so requires.
13. Contact
For any questions regarding data protection:
Microsec International SRL
Str. Lungă, Nr. 53, Sibiu, Sibiu County, Romania
CUI: 46116608 (VAT: RO46116608) | Trade Registry: J32/937/2022
E-mail: contact@neocliniq.com
Last updated: September 2026