Privacy notice

The controller of your personal data is ⟨not yet provided⟩ sh.p.k. (trading as Curalb), NIPT ⟨not yet provided⟩, ⟨not yet provided⟩, Albania.

Contact for anything about your data: info@curalb.com, phone ⟨not yet provided⟩.

Curalb is a coordination service. We are not a healthcare provider and do not treat patients. Dental treatment is provided by independent, licensed clinics, which are responsible for the clinical records they keep about you (see "Who receives your data").

We are established in Albania and apply the Albanian Law No. 124/2024 on Personal Data Protection. Because we offer our service to people in the European Union and the United Kingdom, the EU General Data Protection Regulation (GDPR) and the UK GDPR also apply to your data. The legal bases below refer to the GDPR; the UK GDPR and the Albanian law contain equivalent provisions.

Your enquiry. When you fill in the form on our website: your name, email address, phone number, country of residence, language, the treatments you are interested in, when you would like to travel, whether you have an X-ray, and anything you write in the notes field.

• Purpose: to contact you and assess whether we can help.
• Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b)). The treatments you are interested in, the notes and any X-ray are health information; we process them on the basis of your explicit consent, which you give with the first checkbox on the form (Art. 9(2)(a)).

Your assessment. We contact you by WhatsApp, phone or email, and arrange a WhatsApp video call with a dentist from our partner clinic. For this we use your contact details, the information in your enquiry, and any X-rays, photographs or medical information you choose to send us.

• Purpose: so that a dentist can tell you whether treatment is suitable and what it would involve.
• Legal basis: your explicit consent (Art. 9(2)(a)) and steps before a contract (Art. 6(1)(b)).

Sharing your case with a clinic. We share your case with a clinic only after you have agreed to it, and that agreement names the specific clinic. Agreeing to one clinic never means agreeing to another.

• Legal basis: your explicit consent (Art. 9(2)(a)).

Your patient record. If you go ahead, we keep a record of your case: your contact details, date of birth, the treatment plan and quotes, documents such as X-rays and treatment plans, appointment and travel dates, and notes our coordinators make. If we give you access to our patient portal, we also keep your login and a record of when you signed in.

• Purpose: to coordinate your treatment, travel and aftercare, and to handle any complaint or warranty claim.
• Legal basis: performance of our agreement with you (Art. 6(1)(b)); for health information, your explicit consent (Art. 9(2)(a)); and our legitimate interest in being able to defend legal claims (Art. 6(1)(f), Art. 9(2)(f)).

Optional travel services. If you ask us to arrange a hotel, airport transfers or a translator, we use your name, contact details, travel dates, number of travellers, language and — only where a hotel requires it — identity document details, and pass what is needed to that provider.

• Legal basis: performance of a contract with you (Art. 6(1)(b)).

Emails about treatments and patient stories. Only if you ticked the box for it.

• Legal basis: your consent (Art. 6(1)(a)). You can withdraw it at any time by replying to any of our emails or writing to us.

Using our website. When you visit, our server processes your IP address, browser type and the pages requested; the enquiry form is protected by a bot check that runs on our own servers and shares nothing with third parties (ALTCHA); and we record which advertising campaign or link brought you to the site (for example a campaign name or a Google or Meta click identifier), which is sent to us only if you submit an enquiry.

• Purpose: to keep the service secure and prevent abuse (we limit how many enquiries can be sent from one connection), and to understand which of our campaigns bring genuine enquiries.
• Legal basis: our legitimate interests in security and in measuring our own advertising (Art. 6(1)(f)).
• Analytics and advertising cookies are different: they are only used if you accept them. See our cookie policy.

Records of consent and access. We keep a permanent record of the consents you gave or withdrew (the exact wording and when), and of which staff member accessed or changed personal data. These records cannot be altered, including by us.

• Purpose: to be able to prove that we handled your data lawfully.
• Legal basis: our legal obligation to be accountable (Art. 5(2), Art. 6(1)(c)) and our legitimate interest in defending legal claims (Art. 6(1)(f)).

Giving us your data is voluntary, but without contact details and the health information in your enquiry we cannot arrange an assessment. We do not make decisions about you based solely on automated processing.

• Our partner clinic — an independent, licensed dental clinic in Tirana, Albania, which we will identify to you before it receives anything — receives your case only with your consent. When a dentist there assesses or treats you, the clinic is a separate controller of the clinical records it keeps and is responsible for them under the law that applies to it.
• WhatsApp (WhatsApp Ireland Limited, part of Meta) carries our messages and the video call with the dentist. Messages and calls are end-to-end encrypted, so WhatsApp cannot read their content, but it does process information such as your phone number and when messages are sent, under its own privacy policy.
• Hosting: our servers are provided by host.al in Tirana, Albania. Documents you upload (such as X-rays) are stored in a private storage space provided by Hetzner Online GmbH in Germany. Our email is hosted by host.al.
• Cloudflare, Inc. operates the bot check on the enquiry form.
• Google Ireland Limited and Meta Platforms Ireland Limited receive data from analytics and advertising cookies — only if you accept them.
• Hotels, transfer companies and translators receive what they need, only when you ask us to book them.
• Authorities, courts or professional advisers where the law requires it or where it is necessary to establish or defend a legal claim.

We do not sell your personal data, and we never share it with a clinic you have not agreed to.

We are based in Albania, and our servers are in Albania. Albania is not covered by an adequacy decision of the European Commission or the UK. It has, however, adopted a data protection law closely modelled on the GDPR, and we apply the GDPR's standards to all the data we hold, wherever you live.

Clinical documents you upload are stored in the European Union (Germany). Where a service provider may process data in the United States (Google, Meta, Cloudflare), the transfer relies on the EU–US Data Privacy Framework and the UK Extension to it, or on the European Commission's standard contractual clauses.

• An enquiry that does not lead to treatment: 12 months from the date you sent it. After that your name, contact details, notes, IP address, browser details and click identifiers are automatically erased; only anonymous information (for example the treatment type, country and campaign name) is kept for statistics.
• Patient records and clinical documents (if you go ahead): 10 years from when the record was created, to allow for aftercare, warranty claims and legal limitation periods.
• WhatsApp conversations: deleted from our business account when your case is closed, and at the latest 12 months after our last contact with you.
• Marketing email consent: until you withdraw it.
• Records of consent and of access to your data: kept for as long as we may need to demonstrate that your data was handled lawfully. They contain reference numbers, the date and time, the IP address and browser from which a consent was given, and — for an enquiry — the treatment categories you asked about. They do not contain your name, contact details or notes.
• Technical logs on our servers (which can include IP addresses): rotated automatically and kept only briefly, normally a few weeks.
• Cookies: as listed in our cookie policy.

Your name, email address, phone number and notes are encrypted in our database, and all connections to our website and systems are encrypted. Uploaded documents are scanned for malware, kept in private storage that is not accessible from the internet, and can only be opened through links that expire within minutes. Staff accounts require two-factor authentication, and in our system a clinic can see a case only while it has been given access to that specific case. Every access to health information is logged in a record that cannot be altered.

You have the right to:

• ask for a copy of the personal data we hold about you (access), including in a portable electronic format;
• have inaccurate data corrected;
• have your data erased, unless we must keep it (for example a patient record we are legally required to retain);
• restrict or object to our use of your data, including — at any time — to its use for marketing;
• withdraw any consent you have given, at any time. This does not affect what we did before you withdrew it, but once you withdraw consent to process your health information we can no longer coordinate your case.

To use any of these rights, email info@curalb.com. We reply within one month, and may ask you to confirm your identity first so that we never give your data to someone else.

If you are unhappy with how we handle your data, please tell us first — we would like the chance to put it right. You also have the right to complain to a data protection authority:

• in Albania, the Information and Data Protection Commissioner (idp.al);
• in the European Union, the authority of the country where you live or work — for example the Garante per la protezione dei dati personali in Italy, or the data protection authority of your federal state in Germany (list of EU authorities);
• in the United Kingdom, the Information Commissioner's Office (ico.org.uk).

Our service is for adults. If you are enquiring for someone under 18, you must be their parent or legal guardian, and you give the consents on their behalf.

If we change how we use your data, we will update this notice and the date at the top. If a change affects something you consented to, we will ask you again before it applies to you.