Ce date prelucram
In functie de modul in care folosesti aplicatia, putem prelucra urmatoarele categorii de date:
Date de cont si identificare ale utilizatorului: nume, prenume, numar de telefon, adresa de e-mail, parola in forma securizata, denumirea dispozitivului, tara, orasul, sexul/genul, identificatori de invitatie, precum si alte date necesare administrarii contului.
Date profesionale ori de verificare: daca aplicatia include fluxuri pentru medici ori utilizatori profesionali, putem prelucra documente de verificare profesionala, numele clinicii, e-mailul clinicii si alte informatii necesare validarii statutului profesional.
Date privind consimtamantele si preferintele: dovezi ale acceptarii Termenilor si Conditiilor, Politicii de Confidentialitate, consimtamintelor pentru notificari push, e-mailuri de marketing si alte optiuni de comunicare, inclusiv marcaje temporale si jurnale tehnice asociate.
Date privind copilul, pacientul ori persoana monitorizata: orice date introduse in calculatoare si in istoricul medical functional al aplicatiei, inclusiv: inaltime, greutate, data nasterii, data masurarii, viteza de crestere, tensiune arteriala sistolica si diastolica, circumferinta taliei si soldului, varsta gestationala, lungime/greutate/circumferinta craniana neonatala, inaltimea parintilor, varsta, varsta osoasa si data acesteia, IGF-I, stadiu Tanner, forta de prindere, mana dominanta, circumferinta craniana, istoricul masuratorilor, rezultatele generate si orice alte valori introduse de utilizator in functionalitatile existente la un anumit moment.
Date tehnice si de utilizare: date privind folosirea aplicatiei, jurnale tehnice, adresa IP, tipul dispozitivului, versiunea aplicatiei, erori, evenimente de securitate, identificatori tehnici necesari functionarii si, daca activezi notificarile push, identificatorul aferent acestui serviciu.
In ce scopuri prelucram datele si pe ce temeiuri legale
Administrarea contului si autentificarea: Prelucram datele tale de cont pentru a crea, mentine si securiza contul de utilizator, pentru autentificare, recuperarea accesului si administrarea relatiei contractuale. Temeiul legal este executarea contractului ori efectuarea demersurilor precontractuale, in temeiul art. 6 alin. (1) lit. b) GDPR.
Furnizarea functionalitatilor medicale si stocarea istoricului: Prelucram datele introduse in calculatoare si in istoricul aferent pentru a genera rezultate orientative, a pastra istoricul masuratorilor si a permite utilizatorului utilizarea efectiva a serviciului solicitat. Pentru datele obisnuite necesare acestei functionalitati, temeiul este art. 6 alin. (1) lit. b) GDPR. Pentru datele privind sanatatea, conditia suplimentara de legalitate este consimtamantul explicit, exprimat distinct, in temeiul art. 9 alin. (2) lit. a) GDPR. Daca introduci date despre un copil ori pacient, confirmi ca actionezi in calitate de parinte, reprezentant legal ori persoana autorizata.
Notificari operationale si suport: Putem folosi datele tale pentru a-ti transmite mesaje necesare functionarii aplicatiei, securitatii contului, resetarii parolei, confirmarii anumitor actiuni, notificarilor privind intreruperi tehnice si raspunsurilor la solicitarile de suport. Temeiul legal este art. 6 alin. (1) lit. b) GDPR si, dupa caz, interesul legitim al Operatorului de a mentine securitatea si integritatea serviciului, in temeiul art. 6 alin. (1) lit. f) GDPR.
Comunicari comerciale si marketing: Daca ai optat separat pentru astfel de comunicari, putem transmite newslettere, informari comerciale, actualizari promotionale ori alte mesaje de marketing, inclusiv prin e-mail si notificari push. Temeiul este consimtamantul tau, in temeiul art. 6 alin. (1) lit. a) GDPR. Iti poti retrage consimtamantul in orice moment, fara a afecta legalitatea prelucrarii anterioare retragerii. Nu folosim datele privind sanatatea pentru marketing direct.
Respectarea obligatiilor legale: Putem prelucra datele necesare pentru a raspunde solicitarilor autoritatilor, pentru obligatii fiscale, contabile, de conformitate, pentru gestionarea reclamatiilor si pentru indeplinirea altor obligatii legale aplicabile. Temeiul este art. 6 alin. (1) lit. c) GDPR.
Securitatea, prevenirea abuzurilor si apararea drepturilor: Putem prelucra anumite date pentru detectarea utilizarilor abuzive, a incidentelor de securitate, pentru pastrarea probelor necesare si pentru constatarea, exercitarea sau apararea unui drept. Temeiul este interesul legitim al Operatorului, in temeiul art. 6 alin. (1) lit. f) GDPR.
Catre cine putem divulga datele
Datele tale pot fi comunicate, strict in limita necesara, catre: furnizori de hosting si infrastructura cloud, prestatori IT si mentenanta, furnizori de servicii de e-mail si notificari push, prestatori de analiza tehnica si securitate, consultanti juridici, financiari ori de audit, colaboratori medicali autorizati atunci cand functionalitatea utilizata presupune aceasta, precum si autoritati si institutii publice atunci cand legea impune. Toti destinatarii vor avea acces doar la datele necesare indeplinirii rolului lor si vor actiona in baza unor obligatii contractuale si legale de confidentialitate si securitate.
Transferuri in afara SEE
In masura in care folosim furnizori situati in afara Spatiului Economic European ori furnizori care pot accesa datele din afara acestui spatiu, transferurile se vor efectua numai in conditiile permise de GDPR, inclusiv in baza unei decizii de adecvare ori a unor garantii adecvate, cum ar fi clauzele contractuale standard.
Cat timp pastram datele
Aplicam principiul stocarii limitate si pastram datele doar pe perioada necesara scopurilor pentru care au fost colectate:
Date de cont: pe durata existentei contului si, ulterior, pentru o perioada de maximum 3 ani de la inchiderea acestuia, daca pastrarea este necesara pentru apararea drepturilor Operatorului ori pentru obligatii legale.
Date privind sanatatea si istoricul masuratorilor: pe durata utilizarii contului si a functionalitatilor de monitorizare; dupa solicitarea de stergere ori inchiderea contului, aceste date vor fi sterse sau anonimizate intr-un termen operational de maximum 30-90 zile, cu exceptia copiilor de siguranta care pot fi eliminate intr-un ciclu tehnic separat de maximum 90 zile.
Dovezi ale consimtamintelor de marketing: pe durata valabilitatii consimtamantului si, ulterior, pentru maximum 3 ani din ratiuni probatorii.
Loguri tehnice si securitate: pentru perioada de maximum 6-12 luni, cu exceptia situatiilor in care este necesara o pastrare mai lunga pentru investigarea incidentelor sau executarea unei obligatii legale.
Decizii automate
Calculatoarele si rezultatele generate de aplicatie au rol orientativ si informativ. Operatorul nu adopta, prin aplicatie, decizii bazate exclusiv pe prelucrare automata care sa produca efecte juridice ori sa te afecteze intr-un mod similar semnificativ.
Drepturile tale
In conditiile prevazute de GDPR, ai dreptul de acces la date, dreptul la rectificare, dreptul la stergere, dreptul la restrictionarea prelucrarii, dreptul la portabilitate, dreptul la opozitie, dreptul de a retrage consimtamantul atunci cand prelucrarea se bazeaza pe acesta si dreptul de a formula plangere la autoritatea competenta de supraveghere. Pentru exercitarea drepturilor, ne poti contacta la support@mehealthy.ro. Vom raspunde in termenul legal aplicabil.
Securitatea datelor
Implementam masuri tehnice si organizatorice rezonabile si adecvate naturii datelor prelucrate, cu accent sporit asupra datelor privind sanatatea, pentru a proteja confidentialitatea, integritatea si disponibilitatea acestora. Accesul la date este limitat la persoanele care au nevoie efectiva sa il aiba.
Plangeri si contact
Pentru orice intrebare privind aceasta politica ori modul in care iti prelucram datele, ne poti scrie la support@mehealthy.ro. Daca apreciezi ca drepturile tale au fost incalcate, te poti adresa autoritatii competente de supraveghere din domeniul protectiei datelor.
Ultima actualizare: 07.05.2026
What data we process
Depending on how you use the app, we may process the following categories of data:
User account and identification data: first name, last name, phone number, email address, password in secure form, device name, country, city, sex/gender, invitation identifiers, and other data required for account administration.
Professional or verification data: if the app includes flows for physicians or professional users, we may process professional verification documents, clinic name, clinic email, and other information required to validate professional status.
Consent and preferences data: evidence of acceptance of the Terms and Conditions, Privacy Policy, consent for push notifications, marketing emails, and other communication options, including related timestamps and technical logs.
Child, patient, or monitored person data: any data entered into calculators and the app's functional medical history, including: height, weight, date of birth, measurement date, growth velocity, systolic and diastolic blood pressure, waist and hip circumference, gestational age, neonatal length/weight/head circumference, parents' height, age, bone age and its date, IGF-I, Tanner stage, grip strength, dominant hand, head circumference, measurement history, generated results, and any other values entered by the user in features available at a given time.
Technical and usage data: app usage data, technical logs, IP address, device type, app version, errors, security events, technical identifiers required for operation, and, if you enable push notifications, the identifier related to that service.
Purposes and legal bases for processing
Account administration and authentication: We process your account data to create, maintain, and secure your user account, for authentication, access recovery, and management of the contractual relationship. The legal basis is contract performance or steps prior to entering into a contract, under Article 6(1)(b) GDPR.
Providing medical-related features and storing history: We process data entered into calculators and related history to generate indicative results, keep measurement history, and allow effective use of the requested service. For regular data necessary for this functionality, the basis is Article 6(1)(b) GDPR. For health data, the additional lawfulness condition is explicit consent, separately expressed, under Article 9(2)(a) GDPR. If you enter data about a child or patient, you confirm that you act as a parent, legal representative, or authorized person.
Operational notifications and support: We may use your data to send messages necessary for app operation, account security, password reset, confirmation of certain actions, notifications regarding technical interruptions, and responses to support requests. The legal basis is Article 6(1)(b) GDPR and, where applicable, the Operator's legitimate interest in maintaining security and service integrity, under Article 6(1)(f) GDPR.
Commercial communications and marketing: If you separately opted in for such communications, we may send newsletters, commercial information, promotional updates, or other marketing messages, including by email and push notifications. The basis is your consent under Article 6(1)(a) GDPR. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal. We do not use health data for direct marketing.
Compliance with legal obligations: We may process data necessary to respond to requests from authorities, for tax, accounting, and compliance obligations, complaint handling, and fulfillment of other applicable legal obligations. The basis is Article 6(1)(c) GDPR.
Security, abuse prevention, and defense of rights: We may process certain data to detect abusive use, security incidents, preserve necessary evidence, and establish, exercise, or defend legal rights. The basis is the Operator's legitimate interest under Article 6(1)(f) GDPR.
Who we may disclose data to
Your data may be disclosed, strictly on a need-to-know basis, to: hosting and cloud infrastructure providers, IT and maintenance providers, email and push notification service providers, technical analytics and security providers, legal, financial, or audit consultants, authorized medical collaborators when required by the used functionality, as well as public authorities and institutions when required by law. All recipients will have access only to the data needed to perform their role and will act under contractual and legal confidentiality and security obligations.
Transfers outside the EEA
To the extent that we use providers located outside the European Economic Area or providers that may access data from outside this area, transfers will be carried out only under conditions permitted by GDPR, including based on an adequacy decision or appropriate safeguards such as standard contractual clauses.
How long we retain data
We apply the storage limitation principle and retain data only for the period necessary for the purposes for which it was collected:
Account data: for the duration of the account and, afterwards, for up to 3 years from account closure if retention is necessary for defending the Operator's rights or for legal obligations.
Health data and measurement history: for the duration of account use and monitoring features; after a deletion request or account closure, this data will be deleted or anonymized within an operational period of up to 30-90 days, except for backups that may be removed in a separate technical cycle of up to 90 days.
Marketing consent records: for the validity period of consent and, afterwards, for up to 3 years for evidentiary purposes.
Technical and security logs: for a period of up to 6-12 months, except where longer retention is necessary for incident investigation or to comply with a legal obligation.
Automated decisions
The calculators and results generated by the app are informative and indicative. Through the app, the Operator does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect you.
Your rights
Under GDPR, you have the right of access, rectification, erasure, restriction of processing, data portability, objection, the right to withdraw consent when processing is based on consent, and the right to lodge a complaint with the competent supervisory authority. To exercise your rights, you can contact us at support@mehealthy.ro. We will respond within the applicable legal deadline.
Data security
We implement reasonable and appropriate technical and organizational measures considering the nature of processed data, with increased focus on health data, to protect their confidentiality, integrity, and availability. Access to data is limited to persons who have an actual need to access it.
Complaints and contact
For any question regarding this policy or how we process your data, you can write to us at support@mehealthy.ro. If you believe your rights have been violated, you may contact the competent data protection supervisory authority.
Last updated: 07.05.2026