Privacy policy

Welcome to the website of Poliklinika Kranjčec (www.poliklinika-kranjcec.com). Your privacy is extremely important to us, and we are committed to protecting personal data in accordance with the General Data Protection Regulation (GDPR) and the relevant Croatian regulations.

1. Data controller

• Name: Poliklinika Kranjčec d.o.o.
• Registered office: Ulica Tomislava Ivčića 20b, 23000 Zadar, Croatia
• VAT ID (OIB): 77468505537
• Phone: +385 23 324 881
• E-mail: poliklinika.kranjcec@gmail.com

2. Types of personal data we collect

• Identification data (e.g. first name, surname, personal ID number, date of birth)
• Contact data (e.g. address, phone number, e-mail)
• Health data (e.g. medical history, diagnoses, findings, medical images)
• Technical data (e.g. IP address, device type, browser, cookies)
• Marketing data (e.g. preferences, responses to campaigns)

We collect data through online forms, telephone and e-mail inquiries, when concluding contracts and providing healthcare services, and automatically when you visit the website.

3. Purposes of processing and legal basis

• Scheduling appointments and providing healthcare services — performance of a contract and a legal obligation
• Keeping medical records — a legal obligation and the public interest in the field of public health
• Responding to inquiries — our legitimate interest in providing you with the requested information
• Sending promotional content (newsletter) — solely with your consent, which you can withdraw at any time
• Analysing website traffic and optimising content — a legitimate interest in improving the functionality of the site
• Answering general questions through the AI assistant — our legitimate interest in providing the requested information; separate chat transcript storage — your consent through the optional checkbox; chatbot statistics — your consent to analytics cookies, which you can withdraw in the consent settings

4. Cookies

We use cookies in order to:

1. ensure the technical correctness and customisation of the site
2. track visit statistics (Google Analytics)
3. run digital advertising (Google Ads, Facebook Pixel)

You cannot disable essential cookies, but you can disable analytical and marketing cookies in your browser settings or through our consent management banner.

5. Data recipients

• IT and hosting providers, including Netlify for the website and Supabase for the chatbot functions and database
• OpenAI as the artificial intelligence model provider that processes a question to generate a reply
• Providers of analytical and marketing tools (Google LLC, Meta Platforms Inc.)
• Authorised state bodies when required by law

The primary chatbot analytics database and Supabase chatbot functions are configured in Ireland (eu-west-1). This does not mean that all processing by every provider takes place only in Ireland or the EEA. OpenAI and other providers may process data in other countries; details of their processing and safeguards are available in their privacy and data-processing documents. Transfers outside the EEA are subject to the safeguards required by applicable rules.

6. Storage period

• Medical records: at least 10 years after the end of treatment (in accordance with the Healthcare Act)
• Accounting documents: 11 years (the General Tax Act)
• Newsletter data: until consent is withdrawn
• Analytical cookies: according to the tool settings (up to a maximum of 26 months)
• Chatbot statistics without conversation text: up to 25 months
• Stored conversation transcript, only with separate consent: up to 120 days; automated deletion runs daily

7. Data security

We apply technical and organisational measures such as SSL encryption, access control, pseudonymisation and regular security checks to prevent unauthorised access to, loss of, or misuse of data.

8. Your rights

You have the right to:

1. Access the personal data we process about you
2. Rectify inaccurate or incomplete data
3. Erase data (the "right to be forgotten") when the data is no longer needed or you have withdrawn consent
4. Restrict processing in certain situations
5. Transfer data to another controller
6. Object to processing based on a legitimate interest or carried out for the purposes of direct marketing
7. Withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal
8. Lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop@azop.hr

To exercise your rights, contact us in writing or by e-mail; you will receive a response within 30 days at the latest.

9. Processing of minors' data

The polyclinic's services are intended for persons over 16 years of age, unless consent is given by a parent or legal guardian. We do not knowingly collect the data of minors without appropriate authorisation.

10. AI chatbot and chatbot analytics

Our chatbot provides general information about services, doctors, prices, procedures and contact details. It is not a doctor, does not diagnose, does not replace an examination and does not make treatment decisions. Contact a doctor for personal medical advice. Please do not enter your name, contact details, medical records or other information that directly identifies you in the chat.

When you submit a question, its text and up to eight previous messages needed for context are sent to Supabase, which forwards them to the OpenAI API to generate a reply. This happens even if you do not enable chat transcript storage. Our OpenAI API request is configured not to store the conversation as application state; OpenAI says API content may be included in abuse-monitoring logs for up to 30 days by default. See OpenAI's data processing and retention documentation.

Optional chat transcript storage: storage is enabled by default through a separate, optional checkbox in the chat. While the box is checked, your questions, assistant replies, conversation language, detected question category, displayed card names and related chat actions are stored in the Supabase database in Ireland. The conversation is assigned a random identifier; we do not ask for your name or contact details. Storage lasts up to 120 days, and automated deletion runs daily. Uncheck the box or start a new conversation to send a deletion request for the saved transcript; you may also contact us by e-mail. This consent applies only to storage by us to improve the assistant: the question is still sent to OpenAI to generate a reply. If you enable storage again, earlier messages from the period when the box was unchecked are not stored retroactively.

Statistics: if you accepted analytics cookies in the consent banner, we record limited events such as opening the chat, sending a message, the topic/category of a question, and clicks on booking, a service, a doctor or contact details. These records do not contain the free-text question or assistant reply; they may include the identifier of a service or doctor that was clicked. They are retained for up to 25 months to understand usage and improve the chat. Without accepted analytics consent, these statistical events are not sent to our analytics database.

To prevent abuse and limit request frequency, the chatbot temporarily calculates a protected HMAC fingerprint of the IP address. The raw IP address is not written to the chatbot analytics database; the rate-limit record is used only briefly.

Supabase states that the project's primary data-storage region is Ireland; its support providers and subprocessors may process data elsewhere under their current terms. See Supabase region information and the subprocessor list. Send questions about your data to poliklinika.kranjcec@gmail.com.

11. Automated decision-making

We do not carry out profiling or automated decisions that would have legal or similarly significant effects on you.

12. Changes to the privacy policy

We may update this policy from time to time to comply with regulations or technological changes. The updated version will always be published with the date of the last change indicated. We recommend that you check it periodically.

Thank you for your trust! For any questions about privacy protection, contact us at poliklinika.kranjcec@gmail.com or by phone at +385 23 324 881.