Last updated: 18.10.2026

1. Who we are

The data controller is DOKTALO SRL, VAT/CUI 49468900, Trade Register no. J12/439/2024, registered office at Str. Șesul de Sus nr. 26, ap. 12, Florești, Cluj County, Romania (“Doktalo”, “we”).
Data protection contact: [email protected].

This policy covers doktalo.ro and the app.doktalo.ro platform.

2. Data we process

Category	Examples	Source
Account data	name, email, phone, clinic, role, password (stored hashed)	the user
Billing data	company name, VAT number, address, billing details	the user
Imaging studies and clinical data	DICOM files, clinical history, interpretation request	the referring clinic
Animal owner data	name or other data contained in DICOM headers or clinical records	the referring clinic
Communications	emails, in-platform messages	the user
Technical data	IP address, browser type, access and security logs	automatic

Animal medical data is not personal data. It becomes personal data when it identifies a person (e.g. the owner’s name in a DICOM header). We recommend clinics anonymise owner data before upload where it is not needed.

3. Purposes and legal bases (Art. 6 GDPR)

Purpose	Legal basis
Account creation and management; providing teleradiology services and reports	performance of a contract (Art. 6(1)(b))
Invoicing, accounting, e-Invoicing	legal obligation (Art. 6(1)(c))
Platform security, fraud prevention, access logs	legitimate interest (Art. 6(1)(f))
Answering enquiries sent by email	legitimate interest / pre-contractual steps
Marketing communications (if any)	consent (Art. 6(1)(a)), withdrawable at any time

4. Our role for data submitted by clinics

For uploaded studies and clinical data, the clinic is normally the controller and Doktalo acts as processor (Art. 28 GDPR). We process this data only to deliver the requested interpretation, under our terms, which include the processing clauses required by Art. 28 GDPR.

5. Artificial intelligence tools

The platform may use AI tools to support report drafting (e.g. dictation transcription and text structuring). Every report is reviewed and signed by a veterinarian. We make no decisions based solely on automated processing that produce legal effects on individuals (Art. 22 GDPR).
The AI provider is OpenAI (via API). We send the text of the radiologist’s dictation or notes needed to draft the report. Under OpenAI’s policy, API data is not used to train its models.

6. Recipients (processors)

We share data only with providers needed to run the service, under contract:

• hosting and storage: Hetzner Online GmbH (data centres in Germany)
• content delivery and protection (CDN/firewall): Cloudflare, Inc.
• transactional email: Resend (USA)
• invoicing: Oblio (Romania)
• AI report-drafting assistance: OpenAI (USA)
• collaborating radiologists who interpret studies, bound by confidentiality
• authorities, only where required by law

We do not sell personal data.

7. Transfers outside the EEA

The website, platform and imaging studies are hosted in the European Union (Germany). Some providers (Cloudflare, Resend, OpenAI) may process certain data in the USA. For these transfers we rely on appropriate safeguards: the EU-US Data Privacy Framework adequacy decision, for certified providers, or European Commission Standard Contractual Clauses.

8. Retention

Data	Period
Account	while the account exists; deleted on closure, except data kept for legal obligations
DICOM studies and reports	10 years from the report date
Accounting registers and supporting documents	5 years from 1 July of the year following the financial year end (Romanian Accounting Law 82/1991, as amended by Law 36/2023)
Security logs	90 days

9. Security

We use appropriate technical and organisational measures:

• encrypted connections (HTTPS/TLS)
• role-based access
• hashed passwords
• firewall and monitoring
• encrypted storage of imaging studies (encryption at rest)
• backups

No system is completely secure. We will notify you as required by law of any breach affecting you.

10. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent. Write to [email protected]; we reply within one month.
For data uploaded by a clinic, you may also contact that clinic.
You may lodge a complaint with the Romanian supervisory authority, ANSPDCP (Bd. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest; [email protected]; www.dataprotection.ro), or the authority in your EU country of residence.

11. Cookies

This site uses strictly necessary cookies:

• login
• security (Wordfence)
• language preference (Polylang)

We do not use analytics or marketing cookies.

12. Changes

We may update this policy. The current version is published on this page with its last-updated date.