Privacy Policy

Controller and contact

The website is operated by Salveo Medical Clinic shpk, NUIS/NIPT: M31420025A, Rruga Konferenca e Pezës, Pallati 2AT, Entrance 1, Tirana 1001, Albania. For privacy questions or requests, email mail@salveoclinic.al or call +355 68 367 9348.

Data we may collect

• Booking request: name, phone, email (required only when you request email contact), selected concern, appointment type, preferred date and time, contact preference and optional message. The language, originating page and agreement to be contacted are also recorded.
• Salveo Shop: name, phone, selected products, fulfilment method, delivery address when required and optional note.
• Minimal technical data: security and operational data generated by the host, such as IP address, request time and technical errors.
• Storage and video notice: your choice about YouTube videos is stored locally on your device.

The public calendar receives only capacity counts. This calendar feed does not include patient names, diagnoses, professionals or booked services.

The Academy form collects your name, phone, email, area of interest and question so we can respond. Enquiries are stored in Learning communication with access for the responsible team; they do not subscribe you to offers. Enquiries closed without proceeding to a service follow the six-month contact-request retention period. Do not include patient information.

In the patient portal we also process the information needed to provide your account, shared clinical documents, appointments, payments, messages, offer preferences and personal-data requests. Offer-consent changes are recorded with their channel, date and source.

Purposes and legal bases

• Contact, bookings and orders: to respond to your request and arrange or fulfil the service or purchase.
• Healthcare: for assessment, treatment and documentation by clinic professionals, under the rules explained below.
• Recruitment and personnel: to assess applications, administer employment and meet related legal obligations.
• Billing and legal requirements: to maintain accounting records and meet the clinic’s obligations.
• Security and complaints: to protect the system, prevent abuse and resolve disputes, based on legitimate interests and, where applicable, legal obligations.
• Offers and optional videos: only with the relevant consent, which you can withdraw.

Required fields are needed to handle the relevant request. Without them we may be unable to process it; optional information and marketing consent are not conditions of treatment.

Health data and children

The selected concern and appointment type, when linked to your name or contact details, may reveal health information from the first request. This also applies to information you may write in the message, before an appointment is confirmed or a clinical record is created.

The request is sent to Salveo Manager for the clinic to handle. Provide only what is needed for contact and initial guidance. Do not copy medical reports, test results or identity-document numbers into the public message. The form does not request document uploads and does not replace a clinical record.

Health data needed for your request and care is processed to organise, provide and document healthcare under Article 9(2)(ë) of Law 124/2024 and Instruction 2/2025. Processing is carried out by professionals bound by professional secrecy or under their responsibility. Reception uses the information needed to administer your request; clinical information is restricted according to role and care needs. Agreement to be contacted is not consent to medical treatment or offers.

Documents and communication containing diagnoses, results or clinical information are handled through the patient portal. Email and WhatsApp are used for administrative coordination and consented offers; do not send clinical records or medical results through these channels. Retention from the first request and from treatment is explained under “Retention and security”.

A parent or legal guardian should submit requests concerning a child.

Recipients and third parties

Salveo Manager is the clinic’s system for managing requests and portals. Access is restricted to authorised people according to role. Hosting, storage, maintenance and email providers process the data needed for their technical service; accounting or advisory professionals and competent authorities may receive data where needed for legal obligations or rights.

For deliveries, Intex Courrier receives only the information needed for contact, the order and delivery. It does not receive your clinical record.

YouTube loads only after you allow videos and may transmit technical data to Google. Opening Google Maps or WhatsApp links takes you to those services. Email use involves communication providers. These services may process data outside Albania, depending on their locations and rules; choosing a communication channel is not general permission to transfer your clinical record.

Transfers arranged by the clinic must use a legally permitted basis and appropriate contractual safeguards where required. Contact us about privacy to request information about the recipients, countries and safeguards relevant to your data, including a copy of applicable safeguards.

Job applications

The Work with us form collects your name, email, optional phone number, preferred role, optional message and PDF CV. Your application and document are stored in Salveo Manager to review your candidacy and contact you about it. Access is restricted to the authorised administrator; your CV is not published on the website and applying does not subscribe you to marketing offers.

Send only the professional information needed for your application. Do not include identity documents, health information or unnecessary personal information about other people. For access, correction or a deletion request, use the privacy contacts above. Applications from candidates who are not hired are retained for 6 months after the recruitment process closes. At the deadline, access is blocked and the application, contact details and CV are deleted in the next system cleanup cycle. A documented legal obligation or specific dispute may require further retention, with a recorded review date. Applications are not retained for future vacancies under this agreement. Records of successful candidates are handled separately as personnel records. Deletion covers the copies managed by the website and app; the clinic must also remove any downloaded working copies. If backup data is restored, deletion records must be reapplied before access is restored.

Retention and security

Data is kept only as long as necessary to handle the request, confirm the service or order, and meet legal obligations. Contact or booking requests closed without proceeding to treatment are retained for 6 months from closure. After that period, they enter a deletion queue reviewed monthly by the administrator, who performs deletion manually. Longer retention requires a documented specific reason and review date, for example a legal obligation or dispute. Deletion removes contact details, the message and request notes; only a minimal action record and technical reference are retained to prevent the request from being recreated through a repeated submission. The clinic must also remove downloaded copies and reapply deletions when restoring backup data.

Clinical record: the record is archived 2 years after the last documented treatment and retained for a further 5 years from the archive date. Archiving restricts access and does not mean deletion. After 5 years in the archive, the record is queued for manual deletion review by the archive owner. Retention beyond that period requires a documented specific reason, such as a legal obligation or dispute, and a review date. When treatment actually resumes, the record is reactivated and the active period runs from the last treatment; a booking, contact or opening the record alone does not restart the clock. Financial records are handled separately under their applicable obligations.

Orders, excluding accounting records: information needed for order history, delivery, returns and complaints is retained for 5 years after the order closes (fulfilment or cancellation). An open dispute may require further retention of only the relevant documents, with a recorded reason and review date.

Personnel: necessary employment records are retained during employment and for 5 years after it ends. Operational data no longer needed is removed earlier. Payroll, contribution or employment-service records subject to a longer obligation are handled separately under that obligation.

Accounting records: invoices, payment records and accounting supporting documents are retained for 10 years after the relevant reporting period closes, or longer where expressly required by law. This period does not automatically apply to every order note.

At the deadline: the responsible person reviews manual deletion and records the action or specific reason for further retention. A clinical record is not automatically deleted merely because the date has passed. Working copies must also be removed and deletions reapplied if backups are restored. Technical data is retained according to security needs and the relevant service’s retention cycle; clinical-record retention is not a general period for technical logs.

Controls include restricted access, encrypted transport, validation, duplicate-request protection and audit trails in the relevant systems. No system can guarantee zero risk.

Your rights

Where the law provides, you may request information and access, correction, deletion, restriction, objection and portability, and may withdraw consent where processing relies on it. Withdrawal does not affect earlier lawful processing.

Email mail@salveoclinic.al. Where there are reasonable doubts about identity, we may request the additional information needed to verify it. You may also complain to Albania’s Information and Data Protection Commissioner.

You can also submit a request through Patient Portal → Profile → Privacy and offers, or via WhatsApp. Reception can register an externally received request; the portal allows you to confirm it. If you cannot access the portal, contact us for another suitable verification method. A deletion request does not automatically delete clinical records.

We acknowledge requests within one working day. The substantive response is provided within the statutory deadline, normally no later than 30 days; any lawful extension is explained within that initial period.

Our working days are Monday–Saturday; Sunday and public-holiday requests are handled on the next working day. Deletion requests are assessed according to the data category and retention obligations. If some information must be retained, we explain why and restrict its use. Information and request handling are free of charge except where the law expressly permits otherwise.

Legal framework and updates

This policy is based on Albanian Law 124/2024 on personal data protection and the applicable health-data rules. GDPR applies where the particular activity falls within its scope. Updates are published here with their date; a new purpose requiring consent is not activated merely by changing this policy.

Offers and your choices

General clinic and Salveo Shop offers are sent only with separate consent for Email and/or WhatsApp. Treatment consent, creation of a clinical record or a booking request does not activate offers. We do not personalise offers by diagnosis.

Manage your choices in Patient Portal → Profile → Privacy and offers. You or reception can document consent specifically given for offers. Disabling one channel does not change the other channel or affect your treatment.

To stop WhatsApp offers, send “STOP”; reception records withdrawal for that channel. For email, use the portal or write to us. Necessary appointment and service communications are handled separately. Offers are currently managed by the clinic; any future marketing platform will be reflected in this policy.