PRIVACYpolicy

Who we are

BB Clinic is the controller of the personal data collected through this site. For any question about your data, write to contact@bbclinic.eu.

What we collect

Only what you give us, plus a few technical details:

• Pink Pass sign-up: name, email, phone, country, preferred language, the treatments you are interested in, what you would like to refine, and your consent choices.
• Booking request: name, phone, email, the offer you chose, your preferred dates and any message.
• Early-access check (31 October): the email you enter, which we only compare with the Pink Pass list.
• Technical data: IP address (held briefly, to block abuse), browser, device, the campaign link you came from (UTM parameters) and when you submitted.

Health information

What you write about your goals may say something about your health, which the GDPR treats as a special category of data. Please share only what helps us call you back. Medical details are collected at your consultation in the clinic, never through this site.

Why we use it, and on what legal basis

• To send your Pink Pass, unlock the early offers and call you about a booking: steps taken at your request before a contract (art. 6(1)(b) GDPR).
• Health information you choose to share: your explicit consent (art. 9(2)(a)); the treatment itself: medical care (art. 9(2)(h)).
• Future offers and news: only if you tick the optional box (art. 6(1)(a)). You can unsubscribe at any time.
• Security, abuse prevention and campaign statistics: our legitimate interest (art. 6(1)(f)).
• Medical and tax records once you become a patient: legal obligation (art. 6(1)(c)).

Who receives it

Our patient coordination team, and the providers that run this site for us: hosting, IT, the CRM where your request is stored, our email delivery service (Resend) and a bot check that keeps automated spam out of the forms (Cloudflare Turnstile). If you accept analytics or marketing cookies, Google and Meta receive usage data. Public authorities receive data only when the law requires it. We never sell your data.

Transfers outside the EEA

Some providers, such as Google, Meta, Resend and Cloudflare, may process data outside the European Economic Area. These transfers rely on the EU–US Data Privacy Framework or on the standard contractual clauses approved by the European Commission.

How long we keep it

Sign-up and booking data: for the campaign and its follow-up, and no longer than 12 months after it ends. If you become a patient, medical and tax records are kept for the periods set by law. Marketing consent lasts until you withdraw it.

Your rights

You can ask for access, correction, deletion, restriction or portability of your data, object to its use, and not be subject to a decision based solely on automated processing. You can withdraw any consent at any time; this does not affect what was done before. Write to contact@bbclinic.eu.

You can also complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro), or to the authority in the EU country where you live.

Security

The site runs only over HTTPS, early access uses a signed cookie that cannot be forged, and access to submissions is limited to the people who need them.