Amethyst Radiotherapy
Request an Appointment
Book an appointment

Patient Information Notice

This Information Notice on the processing of patients’ personal data at the Amethyst Clinics describes the categories of personal data we process, how and for what purposes we collect them, and the rights you have as a patient of the Amethyst Clinics when you request and use our medical services.

In line with the legislation on personal data protection, we have implemented the highest standards of confidentiality and transparency for the personal data we process in our day-to-day activity.

1. The personal data controller
For the purposes of this Information Notice, the Amethyst Clinics, meaning any legal entity of the Amethyst Group within which an Amethyst Clinic operates or will operate in the future, are personal data controllers, hereinafter referred to as “the Amethyst Clinics”.

2. Categories of personal data processed

The personal data we may process when you request and use the medical services available in any of the Amethyst Clinics may include:

  • Identification data, such as: surname, first name, date and place of birth, age, home address, personal identification number (CNP), identity card number and date of issue, other information from the identity document, signature, birth certificate (for patients under 14), data and information contained in guardianship/custody documents, notarial powers of attorney, a unique internal code for each patient;
  • Contact data: telephone number, email address;
  • Financial data and information, for example: IBAN account, account holder’s name, information on payments made;
  • Data and information related to insured status: insured status, pension slip, employer, series of the national health insurance card, other information related to the health card or the European Health Insurance Card, insurance policy series and number, insurer’s name;
  • Health data, which may include: symptoms, conditions, diagnosis, medical treatment, medical history, results of tests and investigations, blood group, data on medical prescriptions issued, evolution of the state of health, vaccinations, pregnancy, unique patient code;
  • Biometric data: height, weight, body mass index;
  • Data of family members or carers, if you provide them: surname, first name, email address, telephone number, relationship;
  • Data of parents/legal representatives, required for minor patients or patients lacking capacity: surname, first name, email address, telephone number, relationship.

In most cases, we collect these data directly from you, either when you make an appointment or later, when you come to any Amethyst Clinic to request medical services. However, in certain situations, the personal data and information we need for our activity may be obtained:

  • From a third party (family member or carer) – for minor patients or patients lacking capacity. In this situation, we may process additional personal data and information relating to both parents and/or contained in notarial powers of attorney, court decisions establishing custody/guardianship, etc.;
  • From a partner – third parties with which the Amethyst Clinics have commercial contracts for the provision of medical services, such as medical, testing or imaging laboratories, etc.;
  • The National Health Insurance House (CNAS) – if you have not been issued a health insurance card, we process the result of the query in the PIAS platform;
  • Insurance companies – if you have private health insurance, your insurer may send us the personal data and information needed to provide the medical services and to pay/settle their value.

While we provide medical services, you may give us information about your relatives who have the same medical condition as you or other medical conditions relevant to establishing your diagnosis or treatment. This information is treated as personal data and receives the same protection as your own personal data.

3. Purposes for which we process personal data
Your personal data may be used for the following purposes:

  1. Concluding, managing, administering and performing contracts for the provision of medical services;
  2. Issuing medical prescriptions and/or medical leave certificates, under the law;
  3. Conducting clinical trials;
  4. Preparing the financial and accounting documents resulting from the provision of medical services and collecting their value;
  5. Complying with legal obligations (e.g. our obligations under the contracts concluded with CNAS or the county health insurance houses, reporting obligations to the tax authorities, the Ministry of Health and/or the County Public Health Directorates, the Territorial Cancer Registry, etc.);
  6. Communicating with you about the services requested at the Amethyst Clinic, making an appointment, confirming a previously made appointment, carrying out the treatment plan, checking the effectiveness of the treatment, post-treatment monitoring;
  7. Handing over/sending test reports, results of other investigations, medical prescriptions;
  8. Pharmacovigilance – reporting adverse reactions;
  9. Participation in medical education – visits, medical consultations and non-invasive procedures performed by persons in educational and professional training;
  10. Requesting feedback on the services provided at the Amethyst Clinics through satisfaction questionnaires;
  11. Sending commercial communications about the services available at the Amethyst Clinic that may be of interest to you;
  12. Supporting steps/requests before public authorities or institutions;
  13. Participation in studies, analyses and scientific research – for this purpose we will use, whenever possible, anonymised data that do not allow third parties to identify you. If we intend to use the data in a form that allows you to be identified later, we will ask for your written consent before carrying out such an activity. Please bear in mind that the medical services offered can be improved through scientific research programmes;
  14. Statistical purposes, which are compatible with the initial purposes for which the personal data were processed – in principle, this purpose involves processing data in anonymised form, which makes it impossible for any third party to identify the person.

4. Legal grounds for processing personal data
The processing of personal data by the Amethyst Clinics is based on Article 6(1)(b) and (c) of the General Data Protection Regulation, namely the conclusion and performance of the contract for the provision of medical services or compliance with a legal obligation of the controller, for the purposes listed at points i.–viii. Where special categories of data, such as health or biometric data, are also processed in the course of these activities, the processing is also based on the need for medical diagnosis, the provision of health care or medical treatment [Article 9(2)(h) of the General Data Protection Regulation]. In carrying out their activity, the Amethyst Clinics are bound by confidentiality under Law no. 46/2003 on patients’ rights. There may be situations in which the processing of special categories of personal data is also based on:

  • Protecting your vital interests or those of another natural person, in medical emergencies or when the person concerned is physically or legally incapable of giving consent [Article 9(2)(c)];
  • Reasons of public interest in the area of public health [Article 9(2)(i)];
  • The establishment, exercise or defence of legal claims [Article 9(2)(f)].

Please note that the results of medical investigations, tests and analyses are confidential and may only be communicated to you personally. If you wish to receive any information or documents containing special categories of personal data, such as health or biometric data, electronically by email, please bear in mind that we can no longer ensure their confidentiality and security after they have been sent; the security of the data after sending is your responsibility and that of your email service provider. If you do not agree, you can find out the results of your investigations or collect documents containing data about your health/biometric data only in person, at any Amethyst Clinic.

In certain situations, personal data may be processed on the basis of the legitimate interest of the Amethyst Clinics, such as processing carried out to support steps/requests before public authorities or institutions, to send satisfaction questionnaires in order to improve the quality of the services offered at the Amethyst Clinics (the purposes listed above), or to organise the internal activity of the Amethyst Clinics, including any contentious or litigation proceedings before the competent bodies.

The processing operations listed at points 9, 11 and 13 (for the latter, only where the data are used in the form in which they were collected, which allows the person to be identified) are based on your consent; as a principle, for the processing under point 13 we will use anonymised data as far as possible. We may carry out these processing activities only if we have obtained your prior written consent. You may withdraw your consent at any time by email to dpo@amethyst-radiotherapy.com or directly with our staff at the Amethyst Clinics, without affecting the lawfulness of the processing carried out before the withdrawal. The provision of medical services is not conditional on giving any consent.

5. How long do we keep personal data?
Personal data are kept for the period needed to comply with legal retention obligations and/or the internal procedures of the Amethyst Clinics, based on the following criteria:

  • The periods set by specific legislation (such as financial and accounting legislation and the legislation specific to the provision of medical services);
  • The maximum periods for legal steps, actions or administrative complaints by and/or against the Amethyst Clinics;
  • The time practically needed, after the legal or limitation periods expire, for the data to be effectively anonymised or deleted.

Applying these criteria, the following retention periods can be identified:

  1. Data and information collected to provide medical services and resulting from this activity are processed for the entire period during which the medical service is provided. They are then stored for 50 years, unless they need to be stored for longer.
  2. Data and information processed for financial and accounting purposes are stored for at least 5 years from 1 July of the financial year following the year in which the financial or accounting document was issued. The related supporting documents, such as contracts and payments made/settled, are subject to the same retention period.
  3. Data and information processed to improve the quality of the services of the Amethyst Clinics are stored for at least 3 years; after this period, we may continue to use the data in anonymised form.
  4. For processing based on your consent, for the purpose listed at point 11 above, personal data are processed until the intended purpose is achieved, but for no more than 3 years from their collection or until consent is withdrawn, whichever occurs first. Withdrawing consent does not affect the lawfulness of the processing carried out before the withdrawal. Withdrawing consent for the purpose listed at point 13 above will not affect statistical processing already carried out on your data. Withdrawing consent for the purpose listed at point 9 cannot take effect after you have been discharged; in this situation, we will keep the consent given in order to prove that you agreed during the period in which the participation in medical education took place.

In the situations listed at points (3) or (4), the processing of the data will stop for those purposes, but the personal data may continue to be processed for other purposes.
Please note that, given the complexity of deleting personal data, especially when deletion is done manually (as opposed to automated deletion), the retention periods mentioned above may be extended by up to 12 months. During this period, no other processing of your personal data takes place, except for storing them for deletion/destruction.

6. Disclosure of personal data
In certain situations and under strict conditions, your personal data may be disclosed to third parties, such as:

  • Providers of IT systems, software, technical equipment and communications (SMS, email);
  • Partner clinics and laboratories, collaborating doctors, family doctors or any other providers of medical services;
  • Private health insurance companies, for the settlement and payment of the medical services provided to you;
  • Business partners, providers of financial and/or payment, marketing, archiving and document destruction services;
  • Manufacturers/marketing authorisation holders of medicines – when reporting adverse reactions or conducting clinical trials;
  • Public authorities and institutions, such as the National Health Insurance House, the county health insurance houses, the Ministry of Health, the National Institute of Public Health, the Public Health Directorates, the National Authority for Quality Management in Health, the National Agency for Medicines and Medical Devices of Romania, the National Agency for Fiscal Administration (ANAF), etc., or other public authorities, at their express written request or where there are suspicions that a crime has been committed;
  • Third parties requesting access to personal data in order to perform their duties under contracts concluded with the Amethyst Clinics or under various legal provisions, such as: (1) authorities verifying, regulating and controlling the activity of the Amethyst Clinics; (2) financial auditors and/or tax consultants; (3) lawyers, mediators, professional consultants, experts; (4) courts, arbitration courts, bailiffs, notaries public;
  • Other companies of the Amethyst Group, to carry out internal administrative tasks, to organise and improve our activity or to manage our workforce efficiently;
  • Acquiring third parties, if the activity of the Amethyst Clinics were (wholly or partly) transferred and the patients’ personal data were part of the assets traded.

In any situation involving the disclosure of personal data to third parties (public and/or private), the Amethyst Clinics take all technical and organisational measures to ensure adequate protection of the personal data. As a general rule, the Amethyst Clinics do not transfer personal data outside the European Economic Area. However, if personal data are transferred to countries outside the European Economic Area and other regions with data protection legislation, the Amethyst Clinics will ensure that the personal data are adequately protected, in accordance with the mechanisms provided by the General Data Protection Regulation for safeguarding your personal data.

7. Your rights in relation to the processing of personal data
Under the General Data Protection Regulation, you have the following rights:

  • The right of access to your data and to request a copy of them;
  • The right to request the rectification or completion of inaccurate or incomplete personal data;
  • The right to request the deletion of the personal data processed, to the extent permitted by law;
  • The right to obtain the restriction of processing, where the accuracy of the data processed or the lawfulness of the processing is contested;
  • The right not to be subject to a decision based solely on automated processing (profiling);
  • The right to object to the processing of your data on grounds relating to your particular situation, where the processing is based on a legitimate interest;
  • The right to receive your data in a structured format and to request their transfer, where the processing is based on the performance of a contract or on consent;
  • The right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP).

To exercise any of these rights or to make requests or complaints, please contact us at dpo@amethyst-radiotherapy.com or submit a written request directly at the Amethyst Clinics. You can contact the National Supervisory Authority for Personal Data Processing using the contact details available at www.dataprotection.ro. More details on the processing of personal data can be found in our Privacy Policy, available at our premises and on our website.

8. Data Protection Officer

At the Amethyst Clinics, the Data Protection Officer can be contacted at dpo@amethyst-radiotherapy.com. The Data Protection Officer can be contacted using these contact details for questions, suggestions or complaints, or to exercise the rights guaranteed in relation to data protection.
To identify the data subject, we may ask for additional documents or information. All requests will be handled promptly, in accordance with the applicable legislation, and free of charge. Information on the action taken on a request concerning the data subject’s rights will be provided without undue delay and in any event within one month of receipt of the request. Under the law, this period may be extended by two months where necessary, taking into account the complexity and number of requests. In this case, the data subject will be informed of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request electronically, the information will be provided electronically where possible.

Version updated on: 01.07.2025