medical rehabilitation01Who we are
The controller of your personal data is Nicoleta Botezatu, IDNO 1023600039222, trading as Rebalance — medical rehabilitation, registered at Strada Alexandru Donici 2A, MD-2064, Chișinău, Republic of Moldova (“Rebalance”, “we”).
For any question about your data, contact us by phone at 0621 11 179, by e-mail at Rebalance.marketing@gmail.com or in person at our centre (Monday – Friday, 09:00 – 19:00).
02Legal framework
We process personal data in accordance with Law No. 195/2024 on personal data protection, which entered into force on 23 August 2026, repealed Law No. 133/2011 and transposes the standards of Regulation (EU) 2016/679 (GDPR). We also comply with the legislation on patients’ rights and the confidentiality of medical information, including Law No. 263/2005 on patients’ rights and responsibilities.
We apply the principles set out in Article 5 of Law No. 195/2024: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability.
03What data we process
- Identification and contact data — first and last name, phone number, e-mail, when you call us, message us (including on WhatsApp or social media), fill in the form on our website or make a booking.
- Contact form data — your name, phone number, the service you are interested in, your preferred contact method, an optional message and, if you reached the website through a campaign link, the source of the visit (UTM parameters, e.g. “instagram”). Please do not include health information in the form — we will discuss it at the consultation.
- Payment page data — your name, phone number, the amount, the service paid for, the generated payment code and, optionally, the appointment date, so that we can identify the payment and match it to your booking.
- Health data (special category) — medical history, symptoms, posture and mobility assessment results, the treatment plan and your progress. We collect it only during the consultation and sessions, from you or your legal representative — never through the website.
- Data about minors — for children, teenagers and babies, the data is provided by a parent or legal guardian.
- Booking and payment data — the chosen service, date and time, payment status. We never receive or store your full card details.
- Technical data — our hosting provider may automatically record your IP address, browser type and access time in security logs. Only if you consent in the cookie window may we use Google Analytics 4 (visit statistics) and Meta Pixel (campaign measurement). Details in our Cookie Policy.
04Purposes and legal bases
| Purpose | Legal basis (Law No. 195/2024) |
|---|---|
| Replying to messages sent through the form, by phone or WhatsApp; bookings, rescheduling and confirmations | Steps taken at your request before entering into a contract and performance of the contract (Art. 6) |
| Assessment, treatment and monitoring of your progress, patient record | Performance of the contract (Art. 6) and purposes of preventive medicine, diagnosis and treatment by professionals bound by professional secrecy (Art. 9) |
| Identifying payments and matching them to bookings | Performance of the contract and compliance with accounting obligations (Art. 6) |
| Invoicing, accounting and tax records | Compliance with a legal obligation (Art. 6) |
| Website security and abuse prevention (e.g. limiting automated messages) | Legitimate interest (Art. 6) |
| Visit statistics (Google Analytics 4) and campaign measurement (Meta Pixel) | Your consent, which you can withdraw at any time via “Cookie settings” (Art. 6 and 7) |
| Publishing reviews or photos featuring you, informational messages | Your consent, which you can withdraw at any time (Art. 6 and 7) |
We do not make decisions based solely on automated processing, including profiling.
05Online booking and payment
Online booking is provided through the Altegio platform, and card payments take place on the secure page of the bank or payment processor. When you use these services, you leave the Rebalance website.
- Data entered when booking (name, phone, e-mail, chosen service and time) is processed by Altegio on our behalf under a contract concluded in line with Art. 28 of Law No. 195/2024, or — for the provider’s own purposes — under its own privacy policy.
- Card payments are processed exclusively by the payment processor or partner bank. Rebalance never receives or stores your full card number, expiry date or CVV code.
- When paying by QR code (instant payments), the payer’s data is processed by your bank and ours under the rules of the payment system.
- We recommend reading the platforms’ privacy policies and terms before using them.
06Who we share data with
Only team members who need your data to provide our services, and who are bound by confidentiality, have access to it. The website’s admin panel is accessed with individual password-protected accounts. We may share data, strictly to the extent necessary, with:
- our processors, under contract (Art. 28): the website hosting provider, the Altegio booking platform, the bank or payment processor, the e-mail service provider and, if we use phone notifications, the Telegram service (through which the team is notified of new messages), IT and accounting services;
- Google (Google Analytics 4) and Meta Platforms (Meta Pixel) — only if you have consented to analytics or marketing cookies respectively;
- public authorities, courts or supervisory bodies, only where the law requires it.
We never sell or rent your data to anyone.
07Transfers outside the Republic of Moldova
Some providers (for example Altegio, e-mail and hosting services, Telegram, Google and Meta — the last two only with your consent —, Google Maps if you choose to show the map, and the social networks our links lead to) may process data outside the Republic of Moldova, including in the European Union or the United States. In such cases, transfers take place only with the safeguards required by Law No. 195/2024 for international data transfers (for example adequacy decisions or standard contractual clauses).
08How long we keep data
- Contact form messages and payment notifications in the website’s admin panel — deleted automatically after 180 days.
- Requests and bookings that did not lead to a service — no longer than 12 months.
- Medical documentation (patient record) — for the period required by the regulations on medical documentation.
- Accounting and tax documents — for the period required by accounting and tax law.
- Data processed on the basis of consent — until consent is withdrawn; cookies — for the periods listed in our Cookie Policy.
- Technical security logs — usually no longer than 30 days.
When these periods expire, data is securely deleted or anonymised.
09Children’s data
For minor patients, services are provided with the consent and in the presence of a parent or legal guardian, from whom the data is collected. The forms on our website are intended for adults; we do not knowingly collect data directly from children.
10Your rights
Under Articles 13–22 of Law No. 195/2024 you have the right:
- to be informed — to know who processes your data, how and why;
- of access — to confirmation that we process data about you and a copy of it;
- to rectification of inaccurate or incomplete data;
- to erasure (“right to be forgotten”), under the conditions of the law;
- to restriction of processing;
- to data portability;
- to object, including to processing based on legitimate interest;
- not to be subject to a decision based solely on automated processing;
- to withdraw your consent at any time, without affecting the lawfulness of earlier processing — for cookies, via the “Cookie settings” link at the bottom of the website.
11How to exercise your rights
Send us a request by e-mail, by phone or in writing to our address. We will reply free of charge within one month of receiving your request. If the request is complex, this period may be extended as permitted by law, and we will let you know. To protect your data, we may ask you to confirm your identity.
Some medical data must be kept for the period required by law even if you ask for it to be deleted. In that case we will explain why.
12Right to lodge a complaint
If you believe your data is processed unlawfully, please contact us first so we can resolve the issue. You also have the right to lodge a complaint with the supervisory authority:
48 Serghei Lazo St., MD-2004, Chișinău
Tel.: (+373 22) 820 801 · datepersonale.md
You may also bring the matter before the competent court.
13Data security
We apply technical and organisational measures appropriate to the risk (Art. 32): need-to-know access, individual accounts with strong passwords and lockout after failed attempts, a secure connection (HTTPS), backups, removal of metadata (including location) from published photos, regular software updates, paper documents kept in locked rooms and staff training.
If a security incident affects personal data, we will notify the CNPDCP and, where the incident is likely to result in a high risk to your rights, we will also inform you, in line with Articles 33–34.
14Cookies and local storage
We use strictly necessary cookies and local storage (for example, for your chosen language and to remember your cookie choice). Analytics and marketing cookies are activated only with your consent, which you can change at any time via “Cookie settings”. The Google map loads only if you click “Show map”. The full list is in our Cookie Policy.
15External links and social media
The website contains links to Instagram, Facebook, TikTok, YouTube, WhatsApp, Google Maps, the Altegio booking platform and the payment page of the bank or payment processor. They have their own privacy policies, for which we are not responsible. Messages you send us via social media or WhatsApp are processed only to reply to you.
16Changes to this policy
We may update this policy when legislation or our services change. The current version is always published on this page, with the date of the last update.