Privacy Policy

1. Who is responsible for your data

The controller of the personal data collected through this site is NIVEL-ON Limited Liability Company (Societatea cu Răspundere Limitată „NIVEL-ON”), which runs the NIVEL-ON medical practice:

For any question about your data, write to the email address above or call the number shown.

2. The law we follow

Data is processed in accordance with Law No. 195/2024 of the Republic of Moldova on the protection of personal data, in force since 23 August 2026, which repealed and replaced Law No. 133/2011. That law adopts the standards of the European Union's General Data Protection Regulation (GDPR).

We apply the same rules to every visitor, wherever in the world they are reading from. If you are in the European Union, the United Kingdom or another state with its own data protection law, the rights described below apply to you just the same.

3. What data we collect

This site presents the practice. It has no online booking, processes no payments, has no user accounts and no newsletter. Specifically, this is what is collected:

a) The review form

• the review text you write (up to 600 characters);
• your name, if you choose to fill it in — the field is optional and you may leave it empty, or write a first name or an initial;
• the language of the page you sent the review from (ro, ru or en), so we know which language you wrote to us in;
• the time you sent the review (date and time).

The form does not store your IP address, browser type, email address or phone number. That was deliberate: on a medical practice's website, the less contact data accumulates, the better.

Please do not include details about your health, your diagnosis or the treatment you received in a review, and do not include information about other people. A review is an impression of the service, not a medical record.

b) Server logs

Like any web server, the server hosting this site automatically records technical requests, which may include the IP address, the time of access and the page requested. The logs belong to the hosting provider host.md, not to us (section 4). We do not use them for traffic analysis, profiling or advertising.

c) Cookies and browser storage

The site uses one cookie of its own, named `nivelon_lang`, and sets it only when you click one of the languages RO / RU / EN. Our cookie remembers the chosen language for a year, so that on your next visit we open the site in the language you chose. It holds nothing that identifies you — only the code of the language you chose (`ro`, `ru` or `en`) — and is read by nobody else.

Besides that cookie, the site may write a temporary value to your browser's session storage (`sessionStorage`), used only to detect that the page failed to display properly and to reload it once. The value stays in your browser, disappears when you close the tab, and never reaches us.

We use no Google Analytics or any other statistics tool, no advertising pixels, no tracking cookies, and we build no profiles. Fonts and icons are hosted on our own server and are not loaded from third parties.

d) If you contact us directly

The site has no online booking. An appointment is made by phone, on WhatsApp or by email, using the contact details published on the site. When you write or call, we receive your phone number or email address and whatever you choose to tell us. We use it only to answer you and to arrange the appointment.

The basis is the performance of a contract, or steps taken at your request before entering into one (art. 6(1)(b) of Law No. 195/2024 of the Republic of Moldova). Where the message concerns your health, the processing is for the provision of health care and rests on art. 9(2)(h), and the data is processed by medical staff bound by professional secrecy, as art. 9(3) of the same law requires.

Please do not send photographs, test results or detailed descriptions of a condition before the consultation. A written message is not a substitute for a medical examination, and these channels are not designed for medical data.

We keep messages received on these channels for as long as they are needed for the appointment and to stay in touch with you. We delete them within 12 months of the last exchange unless the law requires us to keep them longer. Where those messages end up is described in sections 7 and 8.

Two further operations leave nothing stored with us: reading the language your browser announces on a first visit, and loading the Google map (sections 4 and 6).

4. Why we process this data, and on what legal basis

• Reviews — to read your opinion of the practice and, where appropriate, to publish it on the site. The basis is your consent, given by submitting the form (art. 6(1)(a) of Law No. 195/2024). You may withdraw your consent at any time: write to us at the email address above and we delete the review, without asking for an explanation.
• Server logs — created by the hosting provider host.md for the security of its own infrastructure, and decided on by the provider alone, as a controller in its own right, on the basis of its legitimate interest (art. 6(1)(f)). We do not request, access or use them.
• The language cookie — to show you the site in the language you chose. The basis is the need to give you the very thing you asked for by clicking that language: the cookie is strictly necessary for it, serves no other purpose and is not used to track you (art. 6(1)(f)). You can delete it from your browser at any time.
• Messages you send us directly (phone, WhatsApp, email) — to answer you and to arrange an appointment. The basis is the performance of a contract or the steps preceding it (art. 6(1)(b)), and, where the message concerns your health, the provision of health care (art. 9(2)(h)).
• The map on the contact page (section 6) — to show you where the practice is. The basis is our legitimate interest in helping you find it (art. 6(1)(f)); you may object by writing to us.
• The first-visit redirect — on your first visit to nivel-on.md, the server reads the language your browser announces (the `Accept-Language` header) and may send you once to the Russian or English version. We do not store that preference and do not use it for anything else. The basis is the legitimate interest in showing you the site in a language you understand (art. 6(1)(f)).

5. What happens to a review you send

A submitted review does not appear on the site automatically. It goes into a list that we read, and it may be published, rejected or left unpublished. If we publish it, the review text and the name you wrote appear — so if you would rather your name did not appear, leave the name field empty.

Leaving the field empty is not a guarantee of anonymity: what you write may identify you by itself. What we do guarantee is that we will not publish a name you did not give us.

We may decline to publish a review, without being obliged to explain the choice, and we may withdraw a published one. We do not alter the words of a review we publish.

6. The Google map on the contact page

A map provided by Google is embedded in the contact section. When it loads, your browser connects directly to Google's servers, and Google receives your IP address and may set its own cookies under its policies. The map is the only component of the page that opens a connection to a third-party server: everything else — fonts, images, icons, scripts — is served from our own server, and the browser is prevented from loading anything else from outside (section 12).

The practice's address is also written as plain text next to the map, so you can read it without using the map. Google's privacy policy is at policies.google.com/privacy.

7. Who else can see the data

• The hosting provider (host.md), which runs the server holding the site and the database. It processes the data only for us and on our instructions — in the language of the law, it is a processor — and it has technical access to the stored data to the extent needed to keep the service running.
• Google, in two distinct situations: when the map on the contact page loads (see section 6), and because our email address is a Google mailbox — any message you send us by email is stored there.
• Meta, if you choose to write to us on WhatsApp. Message content is encrypted between devices, but your phone number and the data about the communication itself are processed by Meta under its own policy.
• Public authorities, only where they request it under the law and only to the extent the law requires.

We do not sell, rent or pass data to anyone for marketing. There are no advertising partners, and we do not pass data to social networks for their own purposes.

8. Where the data is stored, and for how long

Reviews and the site's database are stored on the hosting server located in Chișinău, Republic of Moldova. If the database does not respond, the review is written to a file on that same server, from which we take it; the file is deleted afterwards and, in any case, within 12 months of the review being received.

Data leaves the Republic of Moldova in the three situations listed in section 7 — the Google map, email and WhatsApp. In all three, the transfer is made with your explicit consent, given after reading here that the services are operated by Google and Meta and that the countries where the data is stored may not offer protection equivalent to Moldova's (art. 49(1)(a) of Law No. 195/2024). If you would rather your data did not leave the country, you can call us or write to us on paper at the practice's address.

A published review is kept for as long as it remains published on the site. A review we do not publish is deleted within 12 months of receipt. In either case we delete it sooner if you ask us to. How long the server logs are kept is decided by the hosting provider, under the terms of its own service.

9. Your rights

In respect of the data we hold about you, you have the following rights under Law No. 195/2024:

• the right of access — to learn whether we process data about you and to receive a copy of it (art. 15);
• the right to rectification — to have inaccurate data corrected (art. 16);
• the right to erasure — to have data deleted, including a review you sent (art. 17);
• the right to restriction of processing (art. 18);
• the right to data portability — to receive the data in a machine-readable format (art. 20);
• the right to object — to object to processing based on legitimate interest (art. 21);
• the right to withdraw consent at any time, without affecting the lawfulness of the processing carried out on the basis of that consent before it was withdrawn (art. 7(3)).

For any of these, write to doctor.olgabahneanu@gmail.com. We answer without undue delay and in any case within one month of receiving the request. If the request is complex, or if several arrive at once, we may extend that period by up to two months, telling you within the first month. There is no charge. If we cannot tell from the message who is writing to us, we may ask for further information to confirm your identity, so that we do not hand your data to anyone else.

10. If you are not satisfied with our answer

You have the right to lodge a complaint with the supervisory authority of the Republic of Moldova:

If you are in the European Union or the United Kingdom, you may also contact the data protection authority of your own country.

11. Photographs and videos of patients

The site contains photographs and videos taken at the practice. A person's image is personal data, and images connected with a medical procedure concern health, so they fall within the special category set out in art. 9 of Law No. 195/2024. Such material may be published only with the explicit consent of the person appearing in it, given for that particular publication (art. 9(2)(a)), and only under a contract concluded in writing with that person or their legal representative, together with that person's written consent (art. 6(1) of Law No. 62/2022 of the Republic of Moldova on advertising). That consent may be withdrawn at any time, even if it was given for a fixed term (art. 6(2)).

If you appear in a photograph or video on this site and want it taken down, write to doctor.olgabahneanu@gmail.com. We take it down, no explanation needed.

12. Security

The site is served only over an encrypted connection (HTTPS). The page on which reviews are read is not available to the public: access to it is restricted at web-server level. The review form stores no IP addresses and asks for no contact details, and the limit on submissions per minute works without recording who sent them. Your browser is instructed, through a content security policy (Content-Security-Policy), to load nothing from outside our own server except the Google map on the contact page.

We cannot promise absolute security — nobody can, and a privacy policy that promises it is not telling the truth. What we can say is that we do not collect data we do not need: data that does not exist cannot be lost.

13. Children

The site is intended for adults and does not knowingly collect data about children. The review form is not meant for children. If a review reaches us from someone below the age the law sets for consent online — or if a parent or legal representative writes to tell us a child sent one — we delete it.

14. Changes to this policy

If the way the site works changes, we update this document and change the date at the top of the page. The version published here is the one in force.

The Romanian version of this document is the original. In the event of any discrepancy between a version in another language and the Romanian text, the Romanian text prevails.