Privacy Policy

General Information

The contents of the website www.synevo.ro (hereinafter referred to as the Site) and of the web application "MySynevo" (hereinafter referred to as "MySynevo") belong to SYNEVO ROMĀNIA S.R.L (hereinafter referred to as the "Owner" or "Synevo"), with office in Bdul. Pache Protopopescu, No. 81, Floor 2, Room 3, Sector 2, postal code 021408, Bucharest, registered with the Trade Registry Office under no. J40/20319/1994, and having tax code RO 6479639.

The MySynevo web application (hereinafter referred to as "MySynevo"/"the application") is developed by MEDICOVER TECH S.R.L., and provides its users, who can be both patients (hereinafter referred to as "Patient Users") and physicians (hereinafter referred to as "Physician Users"), with several functionalities, namely:

(i) providing information regarding the medical services offered by Synevo Romania S.R.L.;

(ii) communicating the results of medical laboratory tests performed within Synevo Romania S.R.L. to Patient Users who have a MySynevo account, as well as providing graphic representation of the evolution of the values of certain parameters;

(iii) purchasing medical services provided by Synevo Romania S.R.L.;

(iv) scheduling in order to perform medical services within Synevo Romania S.R.L.;

(v) communicating the results of medical laboratory tests performed within Synevo Romania S.R.L. to the Physician Users, to the extent requested by the Patient Users;

(vi) the sending by a Patient User of an invitation to enroll in the Application to a Physician from Synevo Romania S.R.L.'s database;

(vii) the interaction between Physician Users and Synevo Romania S.R.L. physicians through the Application, through the submission of questions by Physician Users to Synevo Romania S.R.L.;

(viii) interaction between Physician Users and Patient Users through the application, at the initiative of the Physician Users;

(ix) the possibility for Physician Users to recommend additional medical tests to patients;

(x) the possibility for Physician Users to add comments to the lab test results of Patient Users that they are connected with.

Each entity performs independent data processing in relation to MySynevo functionalities

For the functionalities referred to in bullets (i)-(vii) Synevo Romania acts as data controller and for the functionalities referred to in bullets (viii)-(x) Medicover Tech acts as data processor. The processing operations carried out by Synevo Romania as data controller are set out below. Details of the processing carried out by Medicover Tech can be found here .

As data controller, the Owner shall constantly monitor and ensure that the processing of personal data strictly complies with the principles and legislation on the protection of personal data, in particular the provisions of the Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as "GDPR"/"Data Protection Regulation").

This version of the Privacy Policy is valid starting from 9^th of April 2025 and is intended to inform you about:

The processing of your personal data, as a visitor of the Site/ MySynevo app or as a user of the functions of the Site/ MySynevo app including MySynevo ( doctor’s account), ;
- the processing of your personal data performed by Synevo, in order to carry out its activities, as described below.

Synevo may subsequently update this Privacy Policy, in which case it will inform data subjects via the Site/MySynevo app including MySynevo (doctor’s account) of any changes before they become applicable.

II. Definitions

"Personal Data" means any information regarding a natural person identified or identifiable ("data subject"); an identifiable natural person is a person that can be identified, directly or indirectly, especially regarding an identification element such as a name, an identification number, localisation data, online identifier, or one or more factors specific to his or her physical, physiological, mental, economic, cultural or social identity.

"Corporate patient" means patients receiving Synevo services pursuant to partnerships or service contracts concluded by Synevo with various categories of legal entities both in the medical and non-medical fields, and who are not direct payers (for example, clients of partners in the medical field, employees of contractual partners in the non-medical field, beneficiaries of partnerships concluded with kindergartens, beneficiaries of partnerships concluded with insurance companies).

"Direct patient" means patients receiving Synevo services, who come for those services at the Synevo’s front desks and who are direct payers, in whole or in part, including patients who benefit from certain discounts to listed prices, vouchers or other promotions based on Synevo's partnerships with various categories of non-medical legal entities (for example: union members, beneficiaries of vouchers issued by pharma companies).

"CAS Patient" means patients who order tests to be carried out by Synevo that are fully paid by the Health Insurance Fund ("CAS").

Potential CAS patient, refers to individuals who have (i) a referral ticket for services reimbursed through CAS and, due to the exhaustion of found allocated to that month by CAS, request to be placed on the waiting list dedicated to performing analyses reimbursed by CAS, or (ii) who request and schedule an appointment and are enrolled in the appointment list.

"Referring physician" means the physician who recommended/requested in the medical referral certain laboratory tests to be carried out

"Physician" means the physician who interacts with Synevo via medical representatives.

"MySynevo" means the web application owned by Synevo that facilitates: (i) the provision of information on the medical services offered by Synevo, (ii) access to the results of medical laboratory tests performed within Synevo laboratories by Patient Users who have a MySynevo account as well as the provision of graphical representation of the evolution of the values of certain parameters, (iii) the management of personal data of Synevo customers, (iv) the possibility of purchasing medical services offered by Synevo Romania online, (v) scheduling for medical services within Synevo Romania, (vi) communicating the results of medical laboratory analyses performed within Synevo Romania to the Physician Users, to the extent requested by the Patient Users, (vii) the sending by a Patient User of an invitation to enroll in the application to a physician from Synevo Romania's database, (viii) the possibility of interaction between the Physician Users and Synevo Romania's physicians through the application, through the submission of questions by Physician Users to Synevo Romania, (ix) interaction between Physician Users and Patient Users through the App, at the initiative of Physician Users, (x) the possibility for Physician Users to recommend additional medical tests to patients.. MySynevo offers customized information depending on the way the user registers in the application: via a general account, or via a personal account (Client account) that allows access to medical data (the results of laboratory tests carried out in Synevo laboratories). The use of MySynevo shall comply with the Terms and Conditions of use of the MySynevo application available at https://my.synevo.ro/

MySynevo Users - represents both Physician Users and Patient Users.

Physician User - represents MySynevo Users who are specialists in the medical field (general practitioners, specialized physicians, etc.) and who practice their medical profession in compliance with the legislation in force.

Patient User - represents MySynevo users who can be both Synevo patients and individuals interested in the medical laboratory services offered by Synevo; only individuals with full legal competence can be Patient Users.

“Processing" (and its wording variants, including without limitation "to process") means any operation or set of operations performed on Personal Data, including without limitation the collection, recording, retention, modification, use, disclosure, access, transfer or destruction of such data.

"Medical test ordering and payment function" with the option to collect biological samples either in Synevo centres or at home (hereinafter also referred to as the Function) means a function available on the website, which provides theUser of Medical test ordering and payment function , the possibility to order and pay for the available medical tests selected from the Synevo portfolio/medical test with home collection from the Synevo portfolio, available within the function, as well as to make an appointment, as appropriate, according to the information presented in the Shop Online Section. The order and payment of the medical tests selected by the user will be carried out according to the Terms and Conditions that are available at https://www.synevo.ro/termeni-si-conditii-cos-de-cumparaturi/.

"Users of the medical test ordering and payment Function" refers to the persons who use the function available on the Site to order and pay online for medical tests from the Synevo portfolio.

"Visitor" means any person who accesses or uses the Site/ MySynevo, including as a Patient User and/or Physician User.

"User of the Medical test ordering and payment function with home collection” refers to the person who uses the function available on the Site to order and pay online for home collection medical tests from the Synevo portfolio.

III. Categories of processed Personal Data

The categories of processed Personal Data depend on the interactions and relationships with the Holder, namely the relationships that concern the accessing/use of the Site/MySynevo app.. Thus, the Holder could process the following categories of Personal Data for the following categories of data subjects:

In the case of Site visitors, if you access and/or use the Site, the following categories of Personal Data could be processed:

In the event of your use of certain functions on the Site, the categories of Personal Data collected may be different (e.g. for establishing what tests are necessary, for calculating the body mass index, for calculating cardiovascular risk): sex, age, height, weight, working conditions, family medical history, habits/preferences, year and month of birth, systolic blood pressure, total cholesterol, HDL cholesterol, LDL cholesterol, smoking and non-smoking status. In the case of these functionalities, please note that the information you fill in is not stored by Synevo, nor is it combined with other information in such a way as to lead to the identification of the data subject filling in the test. The information is requested to generate the profile according to the health standards accepted worldwide, and does not lead to the identification of the person;
In the case of filling in Suggestion Forms, or requesting additional information, or filling in the Contact Form and/or filing complaints: last name, first name, e-mail address, telephone number, Synevo location;
In the case of subscribing to marketing newsletters: last name, first name, e-mail address, gender, as well as tracking data (hereinafter also referred to as device data and/or digital interaction data) in order to analyse the recipient’s degree of interest in such commercial communications (e.g.: IP address, clicks, hits, locality).
In the case of registering for online and/or offline events dedicated to medical professionals: last name, first name, e-mail address, gender, profession, specialization and tracking data, in order to analyse the recipient’s degree of interest in such communications (e.g.: IP address, clicks, visits, locality).
If you access the live webinar recordings category on the website, you can choose to subscribe to receive marketing communications. For this purpose, the following data will be processed: first name, last name, email address, tracking data (hereinafter also referred to as device data and/or digital interaction data) in order to analyse the degree of interest that the marketing communications represent for the recipient (e.g. IP address, clicks, hits, locality). To facilitate the provision of those webinars and recordings, Synevo uses the platform provided by the chosen provider. Thus, if you would like more information on how the provider processes your personal data, please refer to its Privacy Policy at: https://www.twentythree.com/gdpr In order to access the category on the website for viewing the live webinar recordings, the following are processed: county and, where applicable, city/sector, duration for which the recording was viewed, number of visits to that page, by which times the recording was viewed.When making an appointment for a visit to a collection centre for any laboratory tests from the Synevo portfolio: last name, first name, e-mail address, phone number (so that the persons making the appointment may receive a message confirming the appointment, if they have opted to receive such confirmation).
In case of purchase of medical services provided by Synevo: (i) mandatory: name, surname, CNP / serial and passport number where applicable, e-mail address, telephone number, type of services requested (ii) optional: home address (county, city, street, apartment number).
If making an appointment to come to a collection center for any of the tests in the Synevo portfolio: name, surname, e-mail address, telephone number (so that the persons making the appointment will receive an appointment confirmation message, if they have opted to receive such confirmation).
In the case of an appointment for home collection: name, surname, e-mail address, telephone number, address from which the collection will be made, personal number/passport number.
When making an appointment for genetic counselling: name, surname, email address, phone number.
In the case of appointment/listing on the waiting list for "Paraclinical investigations" or "Histopathological investigations and/or PAP test", the following are processed: the series and number of the referral ticket, the date of the referral, the validity code of the ticket, name and surname, CNP, telephone number and e-mail address (the e-mail address is optional, the applicant can be added to the list without filling it in).
In case of appointment/listing for "Preventive Investigations (PREV 1-9)" or "Follow-up Investigations (Monitor 1 -7)" the following data are requested: referral ticket series and number, date of referral and ticket validity code.
When using the Lia chatbot to obtain quick information about the services that Synevo provides: the user's IP, the page from which the Chatbot was accessed, the unique session ID and the time of access;
When using the Livechat chatbot to obtain specific information about the services provided by Synevo, and to fill in the post-chat form: last name, first name, e-mail address, time and location of access, chat ID, the page from which the chatbot was accessed, any other data resulting from the conversation and the post-chat survey. Chatbot users should not include any health concerning data in their conversations;
When filling in the information for the health sensor, respectively: last name, first name and the email address in order to receive the results from the sensor at the submitted email address.
In the case of filling in the information for the cardiovascular risk calculator, in order to send the result by email, as well as a series of general health indications: email address, name and surname.
In case of giving feedback: name, surname, e-mail address;
In case of completion of feedback questionnaires to improve Synevo services through dedicated platforms: date and time of access; device; browser; device operating system; page(s) accessed.
In the case of cholesterol monitoring by completing the registration form for reminder and submitting the option to receive reminder messages from Synevo to perform cholesterol tests and monitor their value: name, surname, date of birth, email address.

2. In the case of MySynevo visitors, both Patient Users and Physician Users,if you access and/or use the MySynevo app, the following categories of Personal Data may be processed:

In the event of your use of certain functions on the Site, the categories of Personal Data collected may be different (e.g. for establishing what tests are necessary, for calculating the body mass index): sex, age, height, weight, working conditions, family medical history, habits/preferences. In the case of these functionalities, please note that the information you fill in is not stored by Synevo, nor is it combined with other information in such a way as to lead to the identification of the data subject filling in the test. The information is requested to generate the profile according to the health standards accepted worldwide, and does not lead to the identification of the person;
In the case of subscribing to marketing newsletters: last name, first name, e-mail address, gender, as well as tracking data (hereinafter also referred to as device data and/or digital interaction data) in order to analyse the recipient’s degree of interest in such commercial communications (e.g.: IP address, clicks, hits, locality).
When making an appointment for a visit to a collection centre for any laboratory tests from the Synevo portfolio: last name, first name, e-mail address, phone number (so that the persons making the appointment may receive a message confirming the appointment, if they have opted to receive such confirmation).
In case of subscribing to receive granular marketing communications, depending on the level of granularity for which you opt-in, the following personal data may be processed: (i) in the case of subscribing to receive generic marketing communications: first name, last name, email address, gender, as well as tracking data (hereinafter also referred to as device data and/or digital interaction data) in order to analyse the degree of interest that the marketing communications represent for the recipient (e.g. IP address, clicks, hits, location); (ii) in the case of consent to receive personalised marketing communications: in addition to the data used to send the generic marketing communications referred to in point (i), behavioural data may also be processed - e.g. Synevo centre visited, shopping basket value, number of visits to Synevo centre(s), data on previously accessed campaigns) as well as demographic data such as: gender, age, residence; (iii) in the case of consent to send personalized marketing communications based on medical data: in addition to general personal data (referred to in generic marketing communications as well as those referred to in personalized marketing communications – behavioural and demographic data, special personal data, including health data, may also be processed, such as: type of analysis requested and performed, result of tests performed; (iv) in case of agreement to participate in market research/surveys/market research: all data held by Synevo about the data subject will be processed, including general data, behavioural data, demographic data, special data, including health data. At the same time, digital interaction data, i.e. IP address, clicks, hits, location, device, used on the basis of tracking the effectiveness of campaigns, are processed for each type of communication (mentioned above) for which the data subject's consent is requested, and are an integral part of each collected agreement. In the case of an appointment for home collection: name, surname, e-mail address, telephone number, address from which the collection will be made, personal number/passport number.
In case of making an appointment for medical services within Synevo Romania by presenting at a collection center for any analysis from Synevo's portfolio: name, surname, e-mail address, telephone number (so that the persons making the appointment receive a confirmation message, if they have opted to receive such confirmation).
When making an appointment for genetic counselling: name, surname, email address, phone number.
In case of purchase of medical services provided by Synevo: (i) mandatory: name, surname, CNP / serial and passport number, if applicable, e-mail address, telephone number, type of services requested (ii) optional: home address (county, city, street, apartment number).
When filling in the information for the health sensor, respectively: last name, first name and the email address in order to receive the results from the sensor at the submitted email address.
In the case of user account registration (Patient User) - general access: first and last name, e-mail address, telephone number, as well as image, for users who opt in; In case of registration of their medical profile - Client (Patient User) access: first and last name, e-mail address, history of tests performed in Synevo laboratories on a paid basis or for which so agreed by contracts signed with Synevo partners, including result reports, health data and identification data (first and last name, gender, age, date of birth, personal numerical code, home address, e-mail address and/or telephone number), as well as providing graphical evolution of the values of certain parameters;
Communication of the results of medical laboratory tests carried out within Synevo Romania to Physician Users to the extent that the Patient Users have expressly requested this: name, surname, date of birth, age, sex, CNP, telephone number, e-mail address, home address, type of tests requested, results of the tests performed;
In the case of family account management - Client access (Patient User): name and surname, e-mail address, history of tests performed in Synevo laboratories on a paid basis or for which it has been agreed so by contracts signed with Synevo partners, including the results, health data and identification data (name, surname, gender, age, date of birth, personal identification number, home address, e-mail address and/or telephone number);
; In case a Patient User sends an invitation to enroll in the application of a doctor from the Synevo Romania database, the following data will be processed as follows: A. Data belonging to the Physician: (i) data processed by the Patients in order to send the invitation through MySynevo to the Physician - name, surname, specialty, doctor’s seal; (ii) additional data processed by the MySynevo application before displaying the above mentioned information about the Physician - name, surname, email address, phone number, paraphrase code, role in the sender physician computer system; B. Patient's data: (i) to the extent that the Patient User sends the connection invitation via the MySynevo application to the Physician User, the Physician User will have access to the following data belonging to the Patient User: (i) name, surname, date of birth, email address, telephone number, gender, age, location ; (ii) to the extent that the Patient User gives the Physician User access to the results bulletins, the Physician User will also see: the requested tests, test results, personal identification number, home address.
If the patients at the time of their visit to the Synevo receptionists have expressly consented to the referring physician having access to their results, to the extent that the physician has a MySynevo account, the physician will have access to the results of his/her patients who have consented in their MySynevo account. The patient data to which the physician will have access are: name, surname, gender, email address, telephone number, city, home address, CNP, requested tests, results of the requested tests.
In the case of interaction between Medical Users and Synevo Romania physicians through the MySynevo application by asking questions by Medical Users to Synevo Romania laboratory physicians, the personal data processed will be the name and surname of the physician who starts the chat with Synevo Laboratory and later after the chat is taken over by a person from the Laboratory, the name and surname of the person who took over the chat will be displayed.
In order to manage (consult, modify, store, etc.) the data of Patient Users and also of Physician Users, Synevo Romania will process the available data of these Users in the MySynevo application.
In the case of data subjects who have created a light account through which they do not yet have access to the results of medical tests, Synevo will contact them, by processing the following personal data: name, surname, email address, telephone number, in order to provide the necessary support to finalize the MySynevo account and thus be able to access the results of medical tests.
In the case of user account registration - Physician User - general access: name, surname, e-mail address, telephone number, password;
In the case of registration of a user account – Physician User: e-mail address, telephone number, password code, verification of the correctness of the data entered with the Synevo system;
In case of giving feedback: name, surname, e-mail address;
When completing feedback questionnaires in order to improve Synevo services through dedicated platforms: date and time of access, device, browser, device operating system, page(s) accessed.

3. In the case of visiting Synevo's receptions and/or premises, the following personal data may be processed by means of video surveillance (CCTV):

Through video surveillance systems, the Company collects and processes personal data of data subjects (direct patients, corporate patients, CAS patients, relatives, companions, collaborators, etc.) consisting of their image captured in video recordings. At the same time, there is a possibility that any other data identifying a natural person or making him or her at least directly or indirectly identifiable may also be processed through video recordings. By way of example, the following data may be extracted from the processed video images: date and time of access to the Synevo premises, date and time of departure from the Synevo premises, facial features (insofar as the images are clear), visible physical features, physical features (hair colour, hair length, approximate height, clothing worn, etc.), the giving and/or receiving of money and/or documents, the manner of dealing with other individuals and/or Synevo employees (e.g. manner of interaction with Synevo representatives, etc.), as well as any other data that may appear in the video surveillance images.

4. In the case of Users of the Medical test ordering and payment function with collection of sample in Synevo centres or with home collectionavailable on the Site (as defined in the Terms and Conditions of use for this function): last name, first name, e-mail address, telephone number, personal identification numerical (CNP), passport series and number, home address.

Note: The bank details provided by entering one or more credit cards to make the online payments required by the medical test ordering and payment function with collection of sample in Synevo centres or with home collection available on the Site are not accessed or stored by Synevo; such data are provided by the user directly on the payment processor page. After entering your bank details, you will need to fill in the personal data requested by the payment processor for security or accounting reasons, such as: address, phone number, email address. Such data are not processed in any way by Synevo. To understand for what purposes your Personal Data is processed by the payment processor, please consult its privacy policy.

To the extent that, in order to use the medical test ordering and payment function with collection of sample in Synevo centres or with home collection, available on the Site, the Personal Data belonging to other data subjects than the Visitor are disclosed (including when the Personal Data of the data subject is provided by the person who buys the diagnosis tests for and/or on behalf of another person), the person disclosing the Personal Data confirms that they have informed the data subjects about how their Personal Data will be processed, the rights that these people have under the law and that they obtained the consent of the data subjects for this operation (if applicable). For this purpose, the patients or the persons mentioned above are under the obligation to inform such persons about the processing of their Personal Data, so that the processing (e.g. within the medical act, for the submission of test results) may be achieved without the need for other formalities to be carried out by SYNEVO.

In case of using the function of ordering and paying for medical tests via the Synevo website or the MySynevo application, if for various reasons the payment has not been successfully completed, Synevo will send two messages, one by email and the other by sms, at clearly established time intervals, in order to complete the payment, according to the contract concluded at the time of requesting the services, by accepting the Terms and Conditions related to this service.

5. If remote (online) consultation services are provided (pre and/or post laboratory testing) via the Synevo Decoder platform provided by Synevo or its authorized representative, as well as via any other platform, including invoicing operations, processing of payments and the debt collection, if necessary, via the technical means used by Synevo, the following Categories of Personal Data could be processed in order to access the remote consultation service to:

schedule the consultation services by logging into the Synevo Decoder platform/any other platform: last name, first name, e-mail address, phone number, unique barcode provided by Synevo (in certain cases);
identify the patient on the Synevo Decoder platform/any other platform: last name, first name, date of birth, the Synevo location of the most recent visit;
carry out the remote consultation: (i) data provided by the patient – last name, first name, voice, picture, medical data, health status data, (ii) data accessed by the physician based on information and documents from the Synevo system – last name, first name, gender, age, date of birth, signature, data resulting from the medical referral, health data, medical data, genetic data, data recorded by the physician during the consultation (if there was a previous visit), ethnicity, customer identification code, personal identification code (CNP), data resulting from the identity document (including a digital copy of the document, as applicable), address, telephone number, e-mail, marital status, citizenship, signature, profession, occupation, as applicable, data belonging to the legal representatives, (iii) data and information recorded by the physician during the consultation – (medical data, health status data); as well as (iv) data regarding the carried out consultation recorded by the system used (session audit) - date and time of the online consultation, the duration of the online consultation, as well as all the actions undertaken by the data subject in regard to the consultation and the time these actions have been carried out;
Personal Data processed by the platform provider to ensure connection, use of the platform and to maintain its security, but not limited to: last name, first name, account ID, email address, phone number, IP address, geolocation data, platform access date and time, etc. Before accessing the platform, please carefully read its Terms and Conditions of use as well as the Privacy Policy regarding the platform's processing of personal data.

6. In the case of Patients, depending on their category and their interaction with Synevo, the following categories of Personal Data could be processed:

6.1 Direct patients

for the provision of laboratory tests, the necessary advice/recommendations for pre and/or post laboratory testing (offline or online), including for making appointments for sample collection, if applicable, invoicing, processing of payments, including for debt collection: last name, first name, gender, age, date of birth, signature, client identification code, data resulting from the medical referral, health status data, medical data, medical history information, genetic data, data recorded by the physician during the consultation, ethnicity, personal identification number (CNP), data resulting from the identity document (including a copy of the document, as applicable), home address, residential address, telephone number, e-mail address, marital status, marital status documents (including a copy of such documents, as applicable), citizenship, signature, profession, occupation, insured status and other information deriving from such status, bank details, contract information, voice, picture, date and time of service, duration of the telephone consultation, date and time of the online session, duration of the online session;
- for drafting internal statistical reports;
- for feedback requests: last name, first name, e-mail address;
- for requesting feedback through dedicated platforms: date and time of access, device, browser, device operating system, page(s) accessed.
- for online access to medical test results via WebResults: (i) when creating an account based on the laboratory test order - last name, first name, the test results reports, test order documents, including username and password, and additional (ii) when creating a web account: the web account’s username and password, e-mail address, personal identification number (CNP), signature;
- for accessing online the test results reports via MySynevo app: when creating the client access medical profile - last name, first name, e-mail address, history of the tests carried out in the Synevo laboratories on a paid basis, or otherwise established pursuant to the contracts signed with Synevo partners, including the test result reports, health data and identification data (last name, first name, gender, age, date of birth, personal identification code, home address, e-mail address and/or telephone number);
- in order to make an online appointment for Synevo services: type of testing (medical tests), last name, first name, phone number and e-mail address;
- for communicating the results of medical laboratory tests carried out within Synevo Romania to Medical Users to the extent that the Patient Users have expressly requested this: name, surname, date of birth, age, gender, CNP, telephone number, email address, home address, type of tests requested, results of the tests performed;
- when sending an invitation to a doctor from the Synevo Romania database to enroll in the MySynevo application, the following data will be processed as follows: A. Data belonging to the physician: (i) data processed by the patients in order to send the invitation through MySynevo to the Physician - name, surname, specialty, parafa code, locality; (ii) additional data processed by the MySynevo application before displaying the above mentioned information about the physician - name, surname, email address, phone number, parafa code, role in the sender physician computer system; B. Patient Data: (i) to the extent that the Patient User sends the login invitation via the MySynevo application to the Physician User, the Physician User will have access to the following Patient User data: (i) name, surname, date of birth, email address, telephone number, gender, age, location; (ii) to the extent that the Patient User gives the Physician User access to the report cards, the Physician User will also see: requested tests, test results, personal identification number, home address.

6.2 Corporate patients

for the provision of laboratory testing services: last name, first name, gender, age, date of birth, signature, data resulting from the medical referral, health status data, genetic data, ethnicity, personal identification number (CNP/PIN), data resulting from the identity document (including a copy of the document, as applicable), address, telephone, e-mail (business or personal e-mail address, as applicable), marital status, citizenship, signature, profession, occupation;
- for feedback requests: last name, first name, e-mail address;
- for online access to medical test results via WebResults: (i) when creating an account based on the laboratory test order - last name, first name, the test results reports, test order documents, including username and password, plus (ii) when creating a web account based on the personal identification number (CNP): the web account’s username and password, e-mail address, personal identification number (CNP),
- for accessing online the test results reports via MySynevo app: when creating the client access medical profile - last name, first name, e-mail address, history of the tests carried out in the Synevo laboratories on a paid basis, or otherwise established pursuant to the contracts signed with Synevo partners, including the test result reports, health data and identification data (last name, first name, gender, age, date of birth, personal identification code, home address, e-mail address and/or telephone number);
- in order to make an online appointment for Synevo services: type of testing (medical tests), last name, first name, phone number and e-mail address;
- for statistical analyses purposes;
- for communicating the results of medical laboratory tests carried out within Synevo Romania to Medical Users to the extent that the Patient Users have expressly requested this: name, surname, date of birth, age, gender, CNP, telephone number, email address, home address, type of tests requested, results of the tests performed;
- when sending an invitation to a doctor from the Synevo Romania database to enroll in the MySynevo application, the following data will be processed as follows: A. Data belonging to the physician: (i) data processed by the patients in order to send the invitation through MySynevo to the Physician - name, surname, specialty, parafa code, locality; (ii) additional data processed by the MySynevo application before displaying the above mentioned information about the physician - name, surname, email address, phone number, parafa code, role in the sender physician computer system; B. Patient Data: (i) to the extent that the Patient User sends the login invitation via the MySynevo application to the Physician User, the Physician User will have access to the following Patient User data: (i) name, surname, date of birth, email address, telephone number, gender, age, location; (ii) to the extent that the Patient User gives the Physician User access to the report cards, the Physician User will also see: requested tests, test results, personal identification number, home address.

6.3 CAS Patients

for the provision of laboratory testing services: last name, first name, gender, age, date of birth, signature, data resulting from the medical referral, health status data, medical data, genetic data, ethnicity, personal identification number, data resulting from the identity document (including a copy of the document, as appropriate), address, phone, e-mail, marital status, citizenship, signature, profession, occupation, insured status;
- In case of appointment / registration on the waiting list for "Paraclinical investigations" or "Histopathological investigations and / or PAP test" are processed: series and number of the referral ticket, date of sending, validity code of the ticket, name and surname, CNP, telephone number and email address (email address is optional, the applicant can register on the list without filling it).
- When scheduling/registering on the waiting list for "Preventive Investigations (PREV 1-9)" or "Follow-up Investigations (Monitor 1-7)" the following data are requested: referral ticket series and number, date of referral and ticket validity code.
- for feedback requests: last name, first name, e-mail address;
- for online access to medical test results via WebResults: (i) when creating an account based on the laboratory test order - last name, first name, the test results reports, test order documents, including username and password, and additional (ii) when creating a web account based on the personal identification number (CNP): the web account’s username and password, e-mail address, personal identification number (CNP),
- for accessing online the test results reports via MySynevo app: when creating the client access medical profile - last name, first name, e-mail address, history of the tests carried out in the Synevo laboratories on a paid basis, or otherwise established pursuant to the contracts signed with Synevo partners, including the test result reports, health data and identification data (last name, first name, gender, age, date of birth, personal identification code, home address, e-mail address and/or telephone number);
- for statistical analyses purposes;
- in order to make an online appointment for Synevo services: type of testing, last name, first name, phone number and e-mail address;
- for communicating the results of medical laboratory tests carried out within Synevo Romania to Physician Users to the extent that the Patient Users have expressly requested this: name, surname, date of birth, age, gender, CNP, telephone number, email address, home address, type of tests requested, results of the tests performed;

Note: The patient who has an active online account has access anytime to their identification/contact data.

Note: In regard to other processing of the patients’ Personal Data carried out by Synevo within the medical act, via manual and automatic systems, including to improve the quality of our services or for direct marketing purposes, data subjects have been informed and the data is available via the Data Submission Form for the drawing of test requests and Privacy Notice Regarding the Processing of Personal Data.

Note: In regard to the image processing, images are processed as part of video surveillance of the collection centres according to the legal provisions in force or for the legitimate interest of Synevo, as appropriate. Images are processed if data subjects visit a Synevo front desk.

7. In the case of referring physicians and nurses:

7.1.The following Personal Data of the referring physician could be processed:

To access online the results of the medical tests carried out for the Patients, for which the respective physician issued the referral/s, when the patient requested Synevo to submit the results in electronic format to the referring physician, via WebResults: last name, first name, seal code, e-mail address, username and password for the web account based on the seal code, signature;
- To carry out the medical tests, to manage health systems and services by Synevo, as part of providing the results for the tests ordered on the medical referral: last name, first name, personal identification number, seal code, signature, profession, medical specialty, workplace, e-mail address email, phone number.

7.2.The following Personal Data of the external nurses who collected the samples for laboratory testing are processed for the provision of medical laboratory testing services, management of health systems and services by Synevo: last name, first name, signature, profession, workplace, address e-mail, nationality, gender, home address, telephone number.

8. In the case of medical personnel participating in events organized by Synevo

8.1 The following Personal Data of medical personnel could be processed:

to register to offline events organized by Synevo, such as conferences, working groups, round tables and other similar events: last name, first name, specialty, medical degree, institution where they work, seal code, locality, email address, telephone number;
- to receive additional information requested by you at the previously mentioned events: last name, first name, e-mail address, telephone number;
- to receive marketing communications depending on the type of communications you opt for: last name, first name, specialty, medical degree, institution where they work, seal code, locality, email address, telephone number, device information such as (address IP, clicks, visits, locality, etc.);
- to generate anonymized or pseudonymized statistics.

9. In the case of healthcare professionals / data subjects who access Synevo's webinar recordings from the website and choose to express their consent to subscribe to receive marketing communications, the following will be processed: first name, last name, email address, tracking data (hereinafter also referred to as device data and/or digital interaction data) in order to analyze the degree of interest that the marketing communications represent for the recipient (e.g. IP address, clicks, hits, locality). To facilitate the provision of those webinars and recordings, Synevo uses the platform provided by the chosen provider. Thus, if you would like more information on how the provider processes your personal data, please visit their Privacy Policy at: https://www.twentythree.com/gdpr

In view of accessing the category on the website for viewing live webinar recordings, the following are processed: the county and where applicable the city/sector, the duration for which the recording was viewed, the number of visits to that page, the number of times the recording was viewed.

10. In the case of job candidates

10.1. In case of job candidates can be processed the following personal data: last name, first name, gender, age, date of birth, citizenship, signature, data from marital status documents, e-mail address, address, telephone number, picture, profession, position/title, city, current job, professional training (e.g. diploma, studies), certifications, courses, skills, hobby, objective and/or subjective information acquired as a result of references and any other Personal Data transmitted directly by the candidate through CV or indirectly during the recruitment process.

10.2 In addition to the data categories mentioned above, for the purpose of requesting references on candidates, Synevo may process the following categories of personal data belonging to persons recommended by candidates: name and surname, position, place of work, e-mail address and/or telephone number.

11. In the case of the contact persons of collaborators/reprezentatives/potential collaborators (corporate)

11.1. In the case of the contact persons of collaborators/potential collaborators (corporate),as part of the initiation, respectively management of the contractual relationship with them: last name, first name, e-mail address, telephone number, title, workplace, profession.

11.2. In the case of contact persons of collaborators, in the context of sending satisfaction questionnaires to the respective corporate customers regarding Synevo services: name, surname, e-mail address.

11.3. In the case of legal representatives of collaborators, in the context of negotiating and/or concluding contracts for the provision of services: name and surname of the legal representative, signature, place of work, profession, e-mail address, telephone number, as well as any other information that may result from certificates issued by the Trade Register.

12. In the case of healthcare professionals, Synevo may collect data from public sources, such as: last name, first name, specialty, location where the concerned healthcare professionals work, the entity where the concerned healthcare professionals work, e-mail address, telephone number, as appropriate. Such data can be processed to initiate a collaboration with the respective professionals, given the data controller's field of activity, as well as to establish the future company business and development directions.

13. In the case of subscribers receiving commercial communications via the Site: last name, first name, e-mail address, gender and tracking data in order to analyse the impact the transmitted communications have on the recipient (e.g. IP address, clicks, hits, locality). Such tracking data helps Synevo understand whether the campaigns it promotes are of interest to the data subjects. Thus, based on the number of communications received, opened and accessed, we can tell if changes are needed in terms of our communications. The IP address is processed by the provider used by Synevo to send the electronic communications, i.e. Salesforce, but it is not used by Synevo in any way other than that mentioned in this Policy.

13.1 In the case of subscribers receiving commercial communications and who have opted in at Synevo's front desks: last name, first name, e-mail address, telephone number and digital interaction data (e.g. IP address, clicks, hits, locality).

13.2 In the case of subscribers (physicians) receiving commercial communications and who opted in by filling in the forms handed by medical representatives: (i) general data: last name, first name, e-mail address, telephone number, gender (ii) profession-specific data and demographic data: age, specialty, seal code, location of the hospital/clinic/office/provider of medical services where the data subject works, (iii) profession-specific data and behavioural data: hospital/clinic/practice/provider of medical services where the data subject works, medical degree, medical field of interest, workplace locations in the case of multiple workplaces, (iv) device data: IP address, email receipt time, email opening time, link accessed in the email, number of link hits via the email, geolocation data (country, city).

In the case of persons who access the website in order to watch webinar recordings and subscribe to receive marketing communications, as mentioned above, the data processed are: name, surname, email address, tracking data (hereinafter also referred to as device data and/or digital interaction data) in order to analyse the degree of interest that the marketing communications represent for the recipient (e.g. IP address, clicks, hits, locality)

Commercial communications are sent to physicians via the previously mentioned Salesforce platform.

The general data is processed to send general communications, such as: communications about Synevo's activity, about tests from our portfolio and the campaigns we run (for example, the “Jurnal de laborator” magazine, other newsletters of general interest), etc. Demographic data, profession-specific and behavioural data are processed together with the general data in order to send personalized communications, depending on the interests of the data subjects, the area in which they are located, such as: communications about tests or campaigns depending on the specialty of the data subjects or of the medical field of interest, communications about the opening of Synevo centres in their locality, etc. Synevo does not carry out automated processing and does not take automated decisions that produce legal effects that concern or similarly affect the data subject to a significant extent. Furthermore, the behavioural profile that Synevo generates consists of the manual classification of the subscriber in a category, based on the information provided, as well as taking into account the degree of interaction with Synevo based on the data subject’s participation in organized events, market research or any other relevant activities. The device data, as mentioned above, are used in the transmission of all commercial communications by Synevo, if the data subject has expressed their consent for such use, since by collecting such Personal Data the impact the communications have on the recipient is analysed, as well as whether the campaigns promoted by Synevo are of interest to the data subjects. As mentioned above, Synevo collaborates with service providers to transmit commercial messages via e-mail.

For each category of subscribers, only the data for which they have given their consent to receive commercial communications shall be used, depending on the communications they have opted for.

Before subscribing to receive commercial communications regardless of your capacity in relation to Synevo (patient, site visitor, healthcare professional, etc.), please read the Terms and Conditions and the Privacy Policy available on the platform in order to better understand how your Personal Data may be processed. Personal Data at https://www.salesforce.com/company/privacy/.

Data processed by the Salesforce provider are stored on the territory of the European Union.

13.3. In the case of subscribers to receive commercial communications who have opted in, on a case-by-case basis, email messages will have a built-in mechanism for expressing feedback on that communication. The data subject may voluntarily choose to express his or her opinion on that commercial communication. No personal data other than those processed for the purpose of sending commercial communications, i.e. the ID associated to each data subject in the system used for sending commercial communications and implicitly the email address used for the purpose of sending commercial communications, are processed. In addition to the feedback mechanism in the body of the email, the data subject is also provided with a "free text" box in which the data subject can voluntarily write what he/she considers relevant. However, Synevo does not encourage the mentioning of personal data in that "free text" field.

If you have given your consent for the processing of your Personal Data for market research/surveys/market prospecting purposes, the following categories of personal data may be processed: last name, first name, telephone number, e-mail address, specialization, tracking data, as well as any other personal data that you maybe provide directly in market surveys/research (e.g., picture, voice, etc.). The tracking data are processed to trace the effectiveness of the e-mails sent.

After visiting a Synevo reception, the data subject has the opportunity to express his or her opinion about the visit to the Synevo centre by publishing the opinion via the Google platform. Such expression of opinion on the Synevo centre visited is not compulsory and is absolutely voluntary. Synevo does not process personal data if the data subject decides to publish a review of the visited centre via Google. However, there is a chance that through the use of the data subject's own Google account, a number of personal data belonging to the data subject are processed. In order to be fully informed, the data subject is responsible for informing himself/herself about the processing of personal data that Google carries out for the purpose of publishing that review. Synevo has no control over those reviews and is not in a position to delete or edit them, should the data subject so wish.

14. In the case of persons contacting Synevo via the Call Centre or by phone, at the phone numbers available on the website or via other means of remote communication, belonging to the Holder, as part of:

14.1 Making appointments for laboratory testing services and/or for scheduling the necessary consultations before and/or after the laboratory testing (offline or online), the following Personal Data may be processed: last name, first name, personal identification number (CNP), insurance status, medical referrals, date of birth, phone number, e-mail address, barcode, voice.

14.2 The confirmation of the contact data or any other Personal Data processing by phone with the activation of the call registration function, in order for the data subjects to exercise their rights, as provided by the Data Protection Regulation, or in order to manage the situations that may arise in relation to data protection, the following Personal Data can be processed: last name, first name, personal identification number (CNP), date of birth, age, telephone number, e-mail address, home address, barcode, testing request number, test results access credentials, account password based on CNP, the Synevo location where the biological sample was sampled, the capacity of legal representative/guardian/curator/relative/in-laws or any other relevant relationship with the patient, voice.

14.3 In the case of telephone inquiries, complaints and suggestions, as well as those sent via other means of remote communication, the following Personal Data may be processed: last name, first name, home address, telephone, e-mail address, voice. If you provide via sub inquires, including via the contact form on the Website, other data that were not expressly requested by the Holder, Synevo will exclusively process the data necessary to manage your inquiry. If you provide other data that was not requested, but that proves useful for managing your inquiry, it will be processed in accordance with the provisions of this Policy.

15. In the case of people who contact Synevo via the Call Centre and who consent to fill out the feedback form following their experience with the Call Center: last name, first name, phone number, data resulting from the filled-out form. The registration of your option regarding the submission of the feedback form is carried out using the platform of the processor Mediatel, which stores the data within the European Union.

16. In the case of legal representatives of minor/adult patients who suffer from mental disorders impeding choice (parent, guardian or curator, relative, as appropriate): last name, first name, signature, residence address, and in certain cases, also identity document data or civil status document data.

IV. Purposes and lawful basis for Personal Data Processing

The Personal Data of the data subjects categories mentioned in section III above, provided throughout the relationship with the Holder, as part of the medical act and for the provision of medical testing services, for the creation and management of the web account used to access the results of the laboratory tests, requesting offers, filling-in online forms, ordering and paying for medical tests online via the medical test ordering and payment function, improving Synevo services, subscribing to receive commercial communications, or provided in another way via the use of the Site or throughout the relationship with Synevo, may be processed by Synevo directly and/or via its agents, for the following purposes and based on the following grounds:

1. If you are a visitor to the Site, we will process your Personal Data as follows:

1.1. For more details on the use of cookies, please read the Cookie Policy available on the Synevo website (www.synevo.ro).

Lawful basis: consent, contract performance or legitimate interest, according to the provisions of Law no. 506/ 2004 on the processing of personal data and the protection of private life in the electronic communications sector.

1.2. For the purpose of managing the tests performed by you on the Site (e.g. for establishing what tests are necessary, for calculating the body mass index, for calculating cardiovascular risk): sex, age, height, weight, working conditions, family medical history, habits/preferences, month and year of birth, systolic blood pressure, total cholesterol, HDL cholesterol, LDL cholesterol, smoking or non-smoking status. Depending on the tests performed, the processed Personal Data categories may be different. As previously mentioned, the information provided during the test is not stored or corroborated with other information in order to identify the person filling-in the respective test.

Lawful basis: legitimate interest.

1.3. For the purpose of managing the inquiries sent via the suggestion forms, requests for additional information, the Contact Form and/or complaints on the Site.

Lawful basis: legitimate interest.

1.4. For the purpose of managing the subscriptions to receive marketing communications regarding Synevo's campaigns, promotions, as well as Synevo's activity, including the processing of tracking data to analyse the effectiveness of the communications sent and the interest shown.

Lawful basis: consent.

1.5. For the purpose of managing registrations for the events organized by Synevo, and for sending event-related communications, including by processing the tracking data in order to analyse the interest in such communications and their effectiveness.

Lawful basis: consent

1.6. For the purpose of accessing the live webinar recordings viewing category on the website, the following is processed: county and, where applicable, city/sector, duration for which the recording was viewed, number of visits to that page, by the times the recording was viewed.

Lawful basis: legitimate interest

1.7. For the purpose of subscriptions to receive marketing communications prior to viewing the recording of the webinars available on the website: name, surname, email address, tracking data (hereinafter also referred to as device data and/or digital interaction data) in order to analyze the degree of interest that the marketing communications represent for the recipient (e.g. IP address, clicks, hits, locality). To facilitate the provision of those webinars and recordings, Synevo uses the platform provided by the chosen provider. Thus, if you would like more information on how the provider processes your personal data, please visit its Privacy Policy at: https://www.twentythree.com/gdpr

Lawful basis: consent

1.8. For the purpose of making online appointments for carrying out tests from the Synevo portfolio.

Lawful basis: contract.

1.9. For the purpose of scheduling genetic counselling.

Lawful basis: contract

1.10. For the purpose of managing the use of the Lia chatbot in order to obtain various information about Synevo laboratory services without calling the call centre.

Lawful basis: legitimate interest.

1.11. If you use the Livechat chatbot in order to obtain specific information about the services Synevo provides, and you fill in the post-chat form, we may process your personal data based on the legitimate interests of the Holder for the following purposes:

identification of the data subjects;
- settling the requests of the data subjects and providing answers to their inquiries;
- archiving the conversations for the establishment, exercise or defence of Synevo's rights in court, as well as in any other legal proceedings;
- handling of any other requests, complaints, suggestions;
- archiving the post-chat form to improve user experiences.

Lawful basis: legitimate interest

1.12. For the purpose of using the health sensor and receiving its result by email

Lawful basis: legitimate interest.

In addition, Synevo may process certain personal data through Campaigns conducted from time to time, and information on the purposes and manner of processing of such personal data will be contained in the respective Campaign Regulations, and this Privacy Policy will be supplemented by each Regulation as appropriate.

1.13. For the purpose of using the cardiovascular risk calculator and receiving its result by email, along with a set of general health information

Lawful basis: legitimate interest

1.14. For the purpose of scheduling home collection

Lawful basis: contract.

1.15 For the purpose of sending documents, via e-mail when requesting analyses in the case of home collection services

Lawful basis: contract

1.16. For the purpose of providing feedback

Lawful basis: legitimate interest

1.17. For the purpose of completing feedback questionnaires in order to improve Synevo services through dedicated platforms

Lawful basis: legitimate interest

1.18. In the case of employee contacts, in the context of sending satisfaction questionnaires to the respective corporate customers regarding Synevo services: name, surname, e-mail address.

Lawful basis: legitimate interest

1.19 For the purpose of cholesterol monitoring by filling in the registration form for the reminder of the related questionnaire and sending the option to receive reminder messages from Synevo for cholesterol tests and monitoring of their value

Lawful basis: legitimate interest

Synevo may also process certain personal data through Campaigns conducted from time to time, and information on the purposes and manner of processing of such personal data will be contained in the respective Campaigns' regulations, and this Privacy Policy will be supplemented by each regulation as appropriate.

1.20. For the purpose of the purchase of medical services provided by Synevo, Synevo will process the corresponding data for the placement of the online order.

Lawful basis: performance of the contract

2. If you are a visitor to MySynevo app, both Patient Users and Doctor Users included,we may process your Personal Data as follows:

2.1 For more details on the use of cookies, please read the Cookie Policy.

Lawful basis: consent, contract performance or legitimate interest, legal obligation, according to the provisions of Law no. 506/ 2004 on the processing of personal data and the protection of private life in the electronic communications sector.

For the purpose of managing the use of the Lia chatbot in order to obtain various information about Synevo laboratory services without calling the call centre.

Lawful basis: consent.

2.3 For the purpose of managing your use of the functionalities of the Site (e.g. determining the necessary analyses, calculating the body mass index): gender, age, height, weight, working conditions, family history of illnesses, habits/preferences. Depending on the test performed, the categories of Personal Data processed may be different. As mentioned above, the information completed during the test is not stored or combined with other information to identify the person who completed the test in question.

Lawful basis: legitimate interest.

2.4. For the purpose of the purchase of medical services provided by Synevo through online ordering on the website.

Lawful basis: contract performance

2.5 For the purpose of managing subscriptions to receive marketing communications relating to Synevo campaigns, promotions and Synevo activity, including the processing of tracking data to analyse the effectiveness of the communications sent and the interest shown.

Lawful basis: consent.

2.6. For the purpose of managing subscriptions to receive granular marketing communications, depending on the level of granularity the data subject opts for (generic, personalized, personalized communications based on medical data and participation in market research/surveys, market prospecting) using digital interaction data.

Lawful basis: consent.

NOTE: Digital interaction data, processed for each type of communication for which the data subject's consent is sought, is an integral part of each consent collected. In the case of expressing consent to receive personalised marketing communications, please note that the profile created is not based solely on automated processing. Withdrawal of consent may take place at any time and will take effect for the future, without affecting the lawfulness of previously carried out processing.

2.7. For the purpose of online scheduling for testing purposes in the Synevo portfolio.

Basis for processing: contract.

2.8. For the purpose of scheduling genetic counselling.

Lawful basis: contract

2.9. For the purpose of using the health sensor and receiving its result by e-mail

Lawful basis: legitimate interest.

2.10. For the purpose of scheduling home sampling

Lawful basis: contract.

2.11 For the purpose of sending documents via e-mail in the case of home collection services

Lawful basis: performance of the contract

2.12. For the purpose of registering and managing the user account – general access to general information about Synevo services, details regarding the locations of Synevo collection centres and laboratories, the possibility to purchase medical tests online and, respectively, to book appointments with the collection centres, without allowing access to personal or medical data.

Lawful basis: consent.

2.13. For the purpose of registering and managing a medical profile – client access to provide access to your personal data as a Synevo client, as well as to the complete history of results reports for the tests carried out by Synevo Romania within the Synevo laboratories on a paid basis or otherwise established via the contracts signed with Synevo's partners, as well as providing graphic representation of the evolution of the values of certain parameters.

Lawful basis: consent.

2.14. For the purpose of communicating the results of medical laboratory tests carried out within Synevo Romania to Medical Users to the extent that the Patient Users have expressly requested this.

Lawful basis: consent.

2.15. For the purpose of providing a Physician User access to the results of the Patient User's requests for analysis, through the MySynevo application by using the "Share results" button

Lawful basis: consent.

2.16. For the purpose of linking and managing family accounts – client access to manage the medical profiles of Synevo clients and family members (minor children) via a single MySynevo client account. The purpose is to give you access to both your personal data, as a Synevo client and to the personal data of family members who are also Synevo clients and to the complete history of results reports for the tests carried out by Synevo Romania within the Synevo laboratories on a paid basis or otherwise established via the contracts signed with Synevo's partners, for each medical profile linked with the account registered in the application.

Lawful basis: consent.

2.17. In order to comply with the legal obligations, for the following purposes:

compliance with the regulations applicable to Synevo, including in the healthcare field, as well as compliance with the provisions of the European/National Standards on the quality and qualifications requirements that medical laboratories must comply with;
management of health systems and services by Synevo;
settlement of inquiries/complaints regarding the exercise of the rights of data subjects in the context of data processing, as indicated below in section XI;
internal audit;
archiving of documents in compliance with the legal provisions and the retention periods in Synevo's archival code, approved by the competent authority;
Management of relations with public authorities or with other entities that provide public services;

Lawful basis: legal obligation.

2.18. To conclude and perform contracts, for the following purposes:

providing access to MySynevo app, including MySynevo – doctor’s account in compliance with the Terms and Conditions of Use of the MySynevo Application;
management of inquiries/complaints received regarding the contract performance, or the use of the MySynevo app in compliance with the terms and conditions of use of the MySynevo application;
contacting data subjects with a light account who do not have access to their medical test results in order to provide the necessary support to complete the creation of their MySynevo account to access their medical test results.
contacting doctors whose Doctor's account has not been completed for various reasons (system error, data entered did not match those in the Synevo system, etc.)

Lawful basis: performance of the contract.

2.19. To fulfil the legitimate interests of the Holder, for the following purposes:

establishment, exercise or defence of Synevo's rights in court, as well as in any other legal proceedings;
handling of any other requests, complaints, suggestions;
ensuring the security of the technical means available for providing remote consultation services, as well as ensuring the security of the personal data thus processed.
the transmission of an invitation to enroll in the MySynevo application by a Patient User to a doctor from the Synevo Romania database;
the transmission by a Patient User of a login invitation (Patient-Physician login) in the MySynevo application of a doctor from the Synevo Romania database;
In the case of interaction between Physician Users and Synevo Romania physicians through the MySynevo application by Physician Users asking questions to Synevo Romania's laboratory physicians;
In order to manage (consult, modify, store, etc.) the data of Patient Users and also of Physician Users, Synevo Romania will process the available data of these Users in the MySynevo application.

Lawful basis: legitimate interest.

2.17. For the purpose of providing feedback

Lawful basis: legitimate interest

2.18. For the purpose of completing feedback questionnaires in order to improve Synevo services through dedicated platforms

Lawful basis: legitimate interest

If you are a visitor of Synevo's receptions and/or premises, we may process your Personal Data via video surveillance (CCTV) as follows:

3.1 In order to comply with legal obligations for the following purposes:

security and protection of property and persons;
preventing and combating crime;
to carry out the orders of public authorities;
fulfilment of legal obligations, such as but not limited to: disposal of waste according to its type, under the conditions required by law, compliance with mandatory medical regulations, etc;
dealing with requests from data subjects.

Lawful Basis: legal obligation

3.2 In order to fulfil Synevo's legitimate interests for the following purposes:

compliance with internal procedures and applicable law;
protection of samples and equipment in the laboratory and collection centres;
defending the Company's interests in court or in contentious proceedings;
conducting internal audits;
maintenance of the video surveillance system;
obtaining evidence in the event of incidents or complaints, subject to the conditions and restrictions imposed by law;
resolving incidents/complaints that may arise during receptions, in relations with Synevo's patients and clients, and in the rest of the professional relations carried out by Synevo;
security and protection of property and persons (where such processing is not legally required);
the fulfilment of the order of public authorities (where such processing does not fall under legal obligation);
The resolution of any other situations that may arise in the course of the company's business and require the viewing of video surveillance images in order to resolve them.
preventing and combating the commission of criminal offences (where such processing is not covered by a legal obligation);
the processing of requests from data subjects;

Lawful basis: legitimate interest

4. If you are a user of the medical test ordering and payment function with collection of sample in Synevo centres or with home collection available on the Site, we will process your Personal Data as follows:

4.1 In order to comply with the legal obligations, for the following purposes:

compliance with the regulations applicable to Synevo, including in the healthcare field, as well as compliance with the provisions of the European/National Standards on the quality and qualifications requirements that medical laboratories must comply with;
management of health systems and services by Synevo;
provision of medical services offered by Synevo, including as part of the filling-in of inquiry forms to carry out the medical testing services;
fulfilment of the financial, accounting and fiscal obligations, including the compilation of accounting records, keeping of the supporting documents forming the basis of the accounting records;
settlement of inquiries/complaints regarding the exercise of the rights of data subjects in the context of data processing, as indicated below in section XI;
internal audit;
archiving of documents in compliance with the legal provisions and the retention periods in Synevo's archival code, approved by the competent authority;
Management of relations with public authorities or with other entities that provide public services;

Lawful basis: legal obligation.

4.2. To conclude and perform contracts, for the following purposes:

receipt and processing of orders for tests placed online by the users of the medical tests ordering and payment function on the Site (by accepting the Terms and Conditions of use of this function on the Site);
as part of the data processing for telephone appointments;
as part of the identification of the patient prior to providing the remote consultation service;
as part of the actual provision of the remote consultation services;
as part of the audit of the remote consultation;
management of inquiries/complaints received in connection with the contract performance, or with the provision of services, respectively;
in case of non-completion of payment, sending the reminder messages referred above in order to complete the payment.

Lawful basis: contract.

4.3. To fulfil the legitimate interests of the Holder, for the following purposes:

establishment, exercise or defence of Synevo's rights in court, as well as in any other legal proceedings;
handling of any other requests, complaints, suggestions;
ensuring the security of the technical means available for providing remote consultation services, as well as ensuring the security of the personal data thus processed.

Lawful basis: legitimate interest.

5. If you are a patient, we may process your Personal Data as follows:

5.1. If you are a direct patient:

5.1.1.In order to comply with the legal obligations, for the following purposes:

compliance with the regulations applicable to Synevo, including in the healthcare field, as well as compliance with the provisions of the European/National Standards on the quality and qualifications requirements that medical laboratories must comply with;
management of health systems and services by Synevo;
provision of medical services offered by Synevo, including as part of the filling-in of inquiry forms to carry out the medical testing services;
feedback request on how services were performed, as well as on patient needs and requirements;
fulfilment of the reporting test data and the results obligation, as provided by the applicable legislation;
fulfilment of the financial, accounting and fiscal obligations, including the compilation of accounting records, keeping of the supporting documents forming the basis of the accounting records;
settlement of inquiries/complaints regarding the exercise of the rights of data subjects in the context of data processing, as indicated below in section XI;
internal audit;
archiving of documents in compliance with the legal provisions and the retention periods in Synevo's archival code, approved by the competent authority;
Management of relations with public authorities or with other entities that provide public services;
Keeping of certain registers, statements, forms in compliance with the provisions of special laws;
invoicing, payment collection for provided services, other payment operations, payment returns;
ensuring the security of the Synevo premises.

Lawful basis: legal obligation.

5.1.2. To conclude and perform contracts, for the following purposes:

performance of contracts for the provision of medical assistance, including the provision of contracted services, making appointments, carrying out laboratory tests, delivery of results, provision of consultation services pre and/or post laboratory testing by technical means;
as part of the data processing for telephone appointments requested by patients or transmitted by other means of remote communication;
management of inquiries/complaints received in connection with the contract performance;
manage the web accounts provided to patients, who have requested the creation of such accounts, in order to access online the results of their medical tests;
sending documents via e-mail in the case of home collection services;
delivery of personalized medical assistance offers, as per the patient's request.

Lawful basis: contract.

5.1.3. To fulfil the legitimate interests of the Holder, for the following purposes:

establishment, exercise or defence of Synevo's rights in court, as well as in any other legal proceedings;
drafting statistical reports on various conditions, medical tests, test packages, test results, health trends, as well as any other statistics based on the data in Synevo's possession;
the transmission by a Patient User of a login invitation (Patient-Physician login) in the MySynevo application of a doctor from the Synevo Romania database;handling of any other requests, complaints, suggestions.

Lawful basis: legitimate interest.

5.1.4. To fulfil the interests of Synevo, for the following purposes:

delivery of advertising communications to subscribers regarding Synevo's services and activity;
processing of health data for purposes other than those previously mentioned, such as statistics purposes for the spread of various diseases, viruses, as well as other information related to Synevo's activity;
providing access for a Physician User to the results of the Patient User's analysis requests, through the MySynevo application by using the "Provide access" button
getting feedback;

Lawful basis: consent.

5.2. If you are a corporate or CAS patient:

5.2.1.In order to comply with the legal obligations, for the following purposes:

compliance with the regulations applicable to Synevo, including in the healthcare field, as well as compliance with the provisions of the European/National Standards on the quality and qualifications requirements that medical laboratories must comply with;
management of health systems and services by Synevo;
provision of medical services offered by Synevo, including as part of the filling-in of inquiry forms to carry out the medical testing services, making appointments;
verification of the patient/potential patient's eligibility for analyses paid for by CAS;
feedback request on how services were performed, as well as on patient needs and requirements;
fulfilment of the reporting test data and the results obligation, as provided by the applicable legislation;
fulfilment of the financial, accounting and fiscal obligations, including the compilation of accounting records, keeping of the supporting documents forming the basis of the accounting records;
settlement of inquiries/complaints regarding the exercise of the rights of data subjects in the context of data processing, as indicated below in section XI;
internal audit;
archiving of documents in compliance with the legal provisions and the retention periods in Synevo's archival code, approved by the competent authority;
Management of relations with public authorities or with other entities that provide public services;
Keeping of certain registers, statements, forms in compliance with the provisions of special laws;
ensuring the security of the Synevo premises.

Lawful basis: legal obligation.

5.2.2.In order to conclude and perform contracts, for the following purposes:

manage the web accounts provided to patients, who have requested the creation of such accounts, in order to access online the results of their medical tests;
delivery of personalized medical assistance offers, as per the patient's request.

Lawful basis: contract.

5.2.3. To fulfil the legitimate interests of the Holder, for the following purposes:

provision of the requested medical services and delivery of the medical tests results to the patient;
establishment, exercise or defence of Synevo's rights in court, as well as in any other legal proceedings;
drafting statistical reports on various conditions, medical tests, test packages, test results, health trends, as well as any other statistics based on the data in Synevo's possession;
as part of the data processing for telephone appointments requested by patients or transmitted by other means of remote communication;handling of any other requests, complaints, suggestions.
in the context of scheduling for CAS-settled analyses, by being put on the waiting list if no CAS funds are available at the time of the request
the transmission by a Patient User of a login invitation (Patient-Physician login) to the MySynevo application of a doctor from the Synevo Romania database;
handling any other requests, complaints, suggestions.

Lawful basis: legitimate interest.

5.2.4. In order to fulfill Synevo's interests for the following purposes:

Providing access for a Physician User to the results of a Patient User's analysis requests via the MySynevo application by using the "Offer Access" button

Lawful basis: consent.

Providing access to a Physician User to the results of the Patient User's requests for analysis, through the MySynevo application by using the "Offer access" button

At the same time, through the occasional campaigns, Synevo may process certain personal data, and the information on the purposes and processing manner of such personal data can be found in the rules of the respective campaigns; this Privacy Policy shall be supplemented with such rules, as appropriate.

6. If you are the referring physician or sample collection external nurse, we will process your data as follows:

6.1. In order to comply with the legal obligations, for the following purposes:

compliance with the regulations applicable to Synevo, including in the healthcare field, as well as compliance with the provisions of the European/National Standards on the quality and qualifications requirements that medical laboratories must comply with;
management of health systems and services by Synevo;
provision of medical services offered by Synevo to patients, including as part of the filling-in of inquiry forms to carry out the medical testing services;
fulfilment of the financial, accounting and fiscal obligations;
settlement of inquiries/complaints regarding the exercise of the rights of data subjects in the context of data processing, as indicated below in section XI;
internal audit;
archiving of documents in compliance with the legal provisions and the retention periods in Synevo's archival code, approved by the competent authority;
management of relations with public authorities or with other entities that provide public services;

Lawful basis: legal obligation.

6.2. To fulfil the legitimate interests of the Holder, for the following purposes:

online transmission of the results to the referring physicians, when the patients on the medical referral have opted for this;
drafting of internal statistical reports;
provision of medical services, the management of health systems and services by Synevo.

Lawful basis: legitimate interest.

7. If you are a healthcare professional participating in Synevo events, we will process your data as follows:

7.1.To fulfil the legitimate interests of the Holder, for the following purposes:

register for events organized by Synevo;
delivery of the information and details requested via the contact details provided;
drafting of internal statistical reports on the events held both in anonymized and pseudonymized format;

Lawful basis: legitimate interest.

7.2. To fulfil the interests of the Holder, for the following purposes:

delivery of marketing communications based on the type of opted-in communications; Lawful basis: consent.

8. If you are a job candidate, we will process your data as follows:

8.1. In order to comply with the legal obligations, for the following purposes:

monitoring / security access to Company premises;
- ensuring the security of objectives, goods and persons (video surveillance);
ensuring the necessary security measures to protect personal data and other sensitive information for the Company's activity;
informing candidates and resolving requests from data subjects exercised under the General Data Protection Regulation 2016/679/EU on the protection of individuals with regard to the processing of personal data and on the free movement of such data ("GDPR") or other applicable legal provisions;
archiving of documents in compliance with the legal provisions and the retention periods in Synevo's archival code, approved by the competent authority;
management of relations with public authorities or with other entities that provide public services;

Lawful basis legal obligation.

8.2 In order to take the necessary steps to conclude a contract for the following purposes:

carrying out specific recruitment activities for certain vacancies within Synevo;
handling any applications for the recruitment of specific vacancies.

Lawful basis: contract.

8.3. To fulfil the legitimate interests of the Holder, for the following purposes:

Filling in vacancies, following the conclusion of a recruitment contract with recruitment and selection agencies;
storing the applications received from recruitment agencies during the recruitment process;
selection of candidates, analysis of candidates' reputation and integrity;
storage of candidate data for which storage is not done on the basis of consent;
esting of candidates.

Lawful basis legitimate interest.

8.4. Based on the consent given for the following purposes:

Storing your data for contacting you for subsequent recruitment processes, in relation to the one for which you applied;
requesting references for the recruitment of certain positions;

Lawful basis: consent

Note 1: Your consent may be withdrawn at any time. Withdrawal of your consent will take effect for the future without affecting the lawfulness of the processing carried out prior to the withdrawal.

Note 2: When candidates apply for one of the available jobs, withholding consent to storage will not have negative consequences on the existing recruitment process. The consequence of not granting consent to the storage of personal data and subsequent contact is that for subsequent recruitment processes, the candidate will not be contacted.

Note 3: Where candidates apply spontaneously for future opportunities, the consequence of not giving consent to the storage of personal data and subsequent contact is that the application will not be registered.

9. If you are a contact person for collaborators/potential collaborators, we will process your data, as follows:

9.1. In order to comply with the legal obligations, for the following purposes:

compliance with the regulations applicable to Synevo, including in the healthcare field, as well as compliance with the provisions of the European/National Standards on the quality and qualifications requirements that medical laboratories must comply with;
management of health systems and services by Synevo;
fulfilment of the financial, accounting and fiscal obligations;
settlement of inquiries/complaints regarding the exercise of the rights of data subjects in the context of data processing, as indicated below in section XI;
internal audit;
archiving of documents in compliance with the legal provisions and the retention periods in Synevo's archival code, approved by the competent authority;
Management of relations with public authorities or with other entities that provide public services;
Keeping of certain registers, statements, forms in compliance with the provisions of special laws;

Lawful basis: legal obligation.

9.2. To fulfil the legitimate interests of the Holder, for the following purposes:

initiation, respectively management of the contractual relationship with Synevo's collaborating partners/potential collaborators;
handling of any other requests, complaints, suggestions.

Lawful basis: legitimate interest

In order to execute the contract signed by the Holder and the Collaborator for the following purposes:
negotiation and signature of contracts concluded by the legal representatives of collaborators

Lawful basis: conclusion and performance of the contract.

10. If you are a contact person of the collaborators we may process your data:

10.1. In order to fulfil the legitimate interests of the Data Controller for the purpose of transmitting and obtaining information by means of satisfaction questionnaires to corporate customers

Lawful basis: legitimate interest.

11. If you are a healthcare professional, we will process your data as follows:

11.1. In order to comply with the legal obligations, for the following purposes:

compliance with the regulations applicable to Synevo, including in the healthcare field, as well as compliance with the provisions of the European/National Standards on the quality and qualifications requirements that medical laboratories must comply with;
management of health systems and services by Synevo;
fulfilment of the financial, accounting and fiscal obligations;
settlement of inquiries/complaints regarding the exercise of the rights of data subjects in the context of data processing, as indicated below in section XI;
internal audit;
archiving of documents in compliance with the legal provisions and the retention periods in Synevo's archival code, approved by the competent authority;
Management of relations with public authorities or with other entities that provide public services;
Keeping of certain registers, statements, forms in compliance with the provisions of special laws;

Lawful basis: legal obligation.

11.2. To fulfil the legitimate interests of the Holder, for the following purposes:

initiation, respectively management of the contractual relationship with you;
Establishment of the company's future business and development directions based on the developing areas of activity that may require specific laboratory testing services;
handling of any other requests, complaints, suggestions.

Lawful basis: legitimate interest.

12. If you subscribed to receive marketing communications, we will process your Personal Data as follows:

For marketing purposes, to deliver, by means of remote communication (e.g. e-mail, telephone) and via other digital communication platforms, commercial communications, information, news about Synevo's activity, ongoing campaigns or other commercial messages regarding Synevo products and services, including about products and services available in collaboration with Synevo affiliates and partners. We will send you gender-specific marketing messages, as there is a possibility that certain marketing messages may target only females or males, as applicable. Furthermore, to deliver the previously mentioned communications, we will process the digital interaction data (e.g. IP address, hits, clicks, location) to analyse the degree of interest you have in the communications received and to make changes in the type of communications we send out. The IP address shall be processed by the provider (Salesforce) used to deliver the communications, in order to receive information such as number of opened emails/messages by recipients and the links accessed. The IP address is not processed by Synevo in any way other than the aforementioned manner. To fully understand how data is processed for the purpose of sending out commercial communications from Synevo, including the digital interaction data processing technology, please refer to the Salesforce Privacy Policy.

Furthermore, please note that if you are a potential patient, in order to receive commercial communications from Synevo you can opt-in online, using the dedicated section, or you can inform us that you want to be informed of the activity, campaigns, Synevo projects etc. when visiting the Synevo centres by filling-in the forms available at the Synevo front desks. The current state of the technology used does not allow us to identify the online and offline actions of the same person, therefore we cannot identify, nor track whether a particular user who has opted-in on the Synevo website to receive commercial communications is the same person as the patient at a Synevo centre, who chose there in-person by using the dedicated forms to receive marketing communications. The same applies to the withdrawal of consent. This is extremely important for managing your commercial communications options, and thus subscribing and unsubscribing (consent, respectively withdrawal of consent) must be done via the same channel, otherwise we will not be able to identify the changes you request or if there is any change in your options. If you subscribe online to receive the above-mentioned commercial communications, to unsubscribe, you will need to either press the unsubscribe link received in each communication or send us an email to the contact address mentioned in section XI of this document with your request to unsubscribe.

If you consent to receive communications from us by filling in the form available in Synevo centres, you can withdraw your consent as follows: (i) you can unsubscribe either by accessing the unsubscribe link received in each communication, (ii) you can notify the front desk of a Synevo centre about the withdrawal of your consent or (iii) you can send an e-mail to the contact address mentioned in section XI requesting to unsubscribe.

If you have subscribed both online and in Synevo centers to receive marketing communications, we will unsubscribe you based solely on the capacity in which you have requested to do so (patient, user). This means that you will still receive communications for the channel for which you did not opt-out (e.g. you unsubscribed from the marketing communications you opted out of when you visited the Synevo reception, but did not unsubscribe from the marketing communications you opted out of when you browsed the Synevo website).

If you are a doctor or healthcare professional, in order to receive marketing communications from Synevo, you will need to opt-in by ticking the appropriate box on the appropriate agreement form provided for each type of communication you opt-in for.

Insofar as you have consented to receive communications from us by filling in the form provided, you have the following possibilities to withdraw your consent: (i) you can unsubscribe by clicking the unsubscribe link received in each communication, (ii) you can notify your Synevo medical representative of your withdrawal of consent, or (iii) you can send an e-mail to the contact address mentioned in section XI of this document requesting unsubscribe.

Depending on the types of communications for which you have opted in, we will send you personalized marketing communications so that the emails/ SMS communications/ phone call you receive are in line with your preferences.

To the extent that you have subscribed to receive marketing communications prior to viewing the recording of the webinars available on the Site, you may opt-out by: (i) unsubscribing by clicking the unsubscribe link received in each communication; (ii) notifying your Synevo medical representative of your opt-out; or (iii) sending an email to the contact address listed in Section XI of this document requesting to unsubscribe.

Lawful basis: consent.

Note 1: Your consent for direct marketing activities may be withdrawn at any time. Withdrawal of your consent will have effect for the future, without affecting the lawfulness of the processing carried out prior to the withdrawal.

Note 2: For certain processing activities, the legal basis may be a legal obligation (among those mentioned below)

For the purpose of providing feedback on marketing messages received from Synevo: Synevo has incorporated into the body of the commercial (marketing) messages a way of expressing an opinion on the relevance to the individual concerned of the respective advertising message received. At the time of expressing the opinion, a separate page will open, which gives the data subject the possibility, in addition to the opinion already expressed, to add in a "free text" field whatever they consider relevant, if they consider it necessary to write something. Feedback is voluntary and not obligatory. Synevo wishes that by collecting the opinion of data subjects on the commercial communications sent, it can adjust the communications according to their relevance to the recipients. No automatic or manual profiling is carried out in order to obtain and/or interpret the feedback received from data subjects.

Lawful basis: legitimate interest.

13. If you are a physician and you have opted to participate in the market research/surveys/market prospecting carried out by Synevo, including through proxies, we will process your Personal Data as follows for:

establishing contact for the conduct of the respective market research/surveys/market prospecting;
carrying out of the market research/surveys/market prospecting;
archiving the data related to the project carried out;
settlement of inquiries/complaints regarding the exercise of the rights of data subjects in the context of data processing, as indicated below in section XI;
management of relations with public authorities or with other entities that provide public services;

Lawful basis: consent.

If you are a data subject and following your visit to a Synevo reception you voluntarily choose via Google to leave a review on the Google page of that reception, we will not process certain personal data for this action on your part. Since that review is public, just like any other user of the Internet, Synevo will also be able to view the same personal data made public by posting that review. The purpose of Synevo's making it possible for interested persons to leave a public review is to provide transparency on the customer's opinion of each individual reception.

Lawful basis: legitimate interest.

15. If you are a third party that contacts us via the Call Centre, via other phone numbers or other means of communication, we will process your Personal Data as follows:

15.1. In order to comply with the legal obligations, for the following purposes:

settlement of inquiries/complaints regarding the exercise of the rights of data subjects in the context of data processing, as indicated below in section XI;
archiving of documents in compliance with the legal provisions and the retention periods in Synevo's archival code, approved by the competent authority;
confirmation of contact data or any other Personal Data by telephone with the activation of the call recording function, in order for the data subjects to exercise their rights, or to manage situations that may arise in relation to data protection;
management of relations with public authorities or with other entities that provide public services;

Lawful basis: legal obligation.

15.2. To fulfil the legitimate interests of the Holder, for the following purposes:

handling of any other requests, complaints, suggestions;
confirmation of contact data or any other Personal Data by telephone with the activation of the call recording function,in order for the data subjects to exercise their rights, or to manage situations that may arise in relation to data protection;

Lawful basis: legitimate interest.

16. If you are the legal representative of a minor patient, we will process your data as follows:

16.1. In order to comply with the legal obligations, for the following purposes:

compliance with the regulations applicable to Synevo, including in the healthcare field, as well as compliance with the provisions of the European/National Standards on the quality and qualifications requirements that medical laboratories must comply with;
management of health systems and services by Synevo;
provision of medical services offered by Synevo, including as part of the filling-in of inquiry forms to carry out the medical testing services;
fulfilment of the financial, accounting and fiscal obligations, including the compilation of accounting records, keeping of the supporting documents forming the basis of the accounting records;
settlement of inquiries/complaints regarding the exercise of the rights of data subjects in the context of data processing, as indicated below in section XI;
internal audit;
archiving of documents in compliance with the legal provisions and the retention periods in Synevo's archival code, approved by the competent authority;
Management of relations with public authorities or with other entities that provide public services;
Keeping of certain registers, statements, forms in compliance with the provisions of special laws;
invoicing, payment collection for provided services, other payment operations, payment returns;
ensuring the security of the Synevo premises.

Lawful basis: legal obligation.

16.2. To fulfil the legitimate interests of the Holder, for the following purposes:

handling of any other requests, complaints, suggestions.

Lawful basis: legitimate interest.

V. Cookies files

Both the Site and the MySynevo app use cookies. For more information on how these files are used, please read the Cookies Policy available on the Synevo website at www.synevo.ro and on MySynevo.

VI. Recipients of Personal Data

In order to fulfil the processing purposes, the Holder may disclose certain personal data categories to the following categories of recipients:

the data subject and/or their legal representatives;
the referring physician and other healthcare personnel involved in the medical act (in the case of patient data);
the representatives of Synevo, entities from the Holder's Group;
the contractual partners of Synevo, beneficiaries of the services provided by Synevo, including, but not limited to, other medical testing laboratories, medical offices, medical clinics, hospitals, kindergartens, insurance companies, other corporate partners (in the case of corporate partners that are the patient’s employer, the latter's data may be disclosed to the employer as part of the assessment of the patient’s work capacity, as permitted by law and for occupational medicine purposes, but without disclosing data on the results of the medical tests if the patient did not expressly consent to such a disclosure);
Synevo's contractual partners, providers of laboratory testing services;
Synevo's contractual partners, service providers such as, but not limited to, payment processors, security service providers, archiving service providers, marketing agencies, mass mailing service providers, Software as a Service provides - the platform intended for the provision of remote consultation services, data storage as databases service providers – CRM, hosting services, external consultants in various fields such as accounting, tax, legal service providers, professional organizations, market research organizations, employment selection and placement agencies, etc.,
judicial authorities or other public authorities/entities of any type, international organizations, etc.

VII. Duration of the personal data processing

The Holder will process your Personal Data for the duration necessary to achieve the processing purposes and thereafter in compliance with our internal policies, and to fulfil the applicable legal obligations, including, but not limited to, the archiving obligation. The data will also be stored according to Synevo's internal policies on data and document retention periods.

It is possible that, following the fulfilment of the legal archiving obligations, the Holder may order the anonymization of the data, thus removing their personal identifiable characteristics, and continue to process the anonymous data for statistical purposes.

If a patient has an active web account and wishes to close/delete that account, clicking on the “Delete account” button, will not delete it automatically, nor will such action delete automatically the Personal Data from the account. Instead, this request to delete their data shall be settled by Synevo within the term established by the relevant legal provisions.

If a patient has an e-mail address, and receives a customer satisfaction survey, but wishes to stop receiving such invitations, they will no longer receive such-mails for a period of 3 (three) years. If after the 3 (three) years the patient returns to a Synevo collection centre, following their visit, the satisfaction survey will be sent again, based on the legal obligations of testing laboratories. Invitations to fill-in the customer satisfaction surveys are not commercial communications, they are sent pursuant to legal obligations resulting from the services provided by Synevo.

In the case of subscribers, when receiving commercial communications and processing data for marketing and for market research/market prospecting purposes, Synevo will process the data until: (i) the data subject withdraws their consent; (ii) the data subject exercises their right of opposition according to the law; or (iii) according to the internal policies, the term for keeping and processing such Personal Data has expired, in compliance with the purpose for which the data were collected. If any data subject wishes to know the specific retention period of the data processed for marketing purposes, they can request such information by submitting a request using the contact details provided in section XI of this document.

In the case of website visitors using the Livechat chatbot, Synevo will process their personal data for a period of 3 years from the date of their conversation with a Synevo operator.

In the case of candidates, personal data is stored by Synevo for processing during the recruitment process and thereafter, as required by applicable Synevo internal policies and in accordance with applicable legal requirements, including, but not limited to, archiving requirements, as follows:

Eligible candidates who are selected to participate in the interview and consent to the storage of their personal data after the end of the recruitment process: their personal data, following the candidates' consent, will be stored for a period of 2 years from the time of giving consent;
Eligible candidates, who are selected for interview and do not consent to the storage of personal data after the end of the recruitment process: personal data will no longer be stored by the controller, if the candidate does not consent, and will be deleted/destroyed within one month after the end of the recruitment process;
Candidates considered ineligible, who applied through recruitment agencies: according to contractual obligations, personal data of these data subjects will be stored for a period of 12 months, so that it will not be possible to contact the candidates during this period;
Candidates who have applied via recruitment platforms, where the recruitment process is pending: their personal data will be stored by the controllers who own those platforms, according to their storage policies;
Candidates who have applied for the recruitment process but are considered ineligible and who have not been asked for consent to keep their CVs in the database for subsequent recruitment processes: personal data of these candidates will be processed for one month after the end of the recruitment process;
Spontaneous candidates: if they give their consent to the storage of their personal data, the data will be kept for a period of 2 years from the moment of giving consent, otherwise the data will be deleted/destroyed within one month from the moment of refusal/non-receipt of consent;
At the same time, the data processed as a result of the testing of candidates will be stored for the same duration as for the above mentioned categories;
And the personal data of the data subjects processed for the purpose of requesting references will be stored for the same duration as for the above mentioned categories;
In addition, for candidates for whom the recruitment process results in employment, the Company will store their personal data for processing for the duration of the employment/mandate/collaboration relationship and thereafter as required by applicable internal Company policies and in accordance with applicable legal requirements, including but not limited to archiving requirements.

Upon the expiry of the term provided by the internal policies or the legal provisions in force, the personal data will be deleted.

VIII. Transfer of Personal Data

The Personal Data provided to Synevo may be transferred outside of Romania to countries within the European Economic Area.

Outside the European Economic Area, the Personal Data may be transferred to: China or the USA depending on the type of services required. It is possible that in carrying out its business, the aforementioned transfer countries may change. For specific information regarding the transfer of your data outside the European Economic Area, if such transfer takes place, please send us an inquiry to the address mentioned below in section XI.

IX. Security of Personal Data

The Holder considers that the confidentiality and security of your Personal Data is of utmost importance, and understands that it has to ensure the data’s safety throughout the processing activities stipulated in this Privacy Policy. To this end, the Holder has implemented appropriate technical and organizational measures to ensure a level of security corresponding to the risks associated with the types of data processed and the processing operations.

X. Provision of Personal Data

The provision of Personal Data may be a contractual obligation or an obligation necessary for the conclusion/performance of a contract, it may be necessary to be able to receive the services provided by Synevo, to browse the Site and to benefit from the facilities offered here. In some cases, the refusal to provide Personal Data may result in the impossibility to benefit from the services provided to you via the Site (for example, the impossibility of registering your inquiry). In the case of direct marketing activities or market research/surveys/market prospecting, the provision of personal data is voluntary.

Although Synevo requires your consent for the processing of certain Personal Data, it is possible that the processing grounds may change and thus, such consent, may no longer be required by law. In such cases, the Holder may use other grounds for data processing, such as the provision of medical services, contract performance or legitimate interest.

XI. Rights of the Data Subject

In regard to the processing of the Personal Data as indicated in this Privacy Policy, each data subject shall have the following rights, according to the applicable legal provisions:

the right to be informed – the right to receive minimum information regarding the processing activities carried out by the Holder, in compliance with legal requirements;
the right of access to personal data – the right to obtain from the data controller, upon request and under the conditions established by the law, a confirmation whether the data subject’s data are or not processed by the data controller, as well as other details regarding the processing activities;
the right to rectification – the right to obtain from the data controller the rectification of inaccurate personal data concerning the data subject, respectively to obtain the supplementation of incomplete personal data, including by providing an additional statement;
the right to erasure ("the right to be forgotten") - the right to obtain from the data controller the deletion of the data subject’s personal data, without undue delay, as provided by the law;
the right to restrict processing – the right to obtain from the data controller the restriction of the processing activities, provided that the legal conditions are fulfilled;
the right to data portability, namely (i) the right to receive the personal data in a structured way, in a commonly used and easy-to-read format, as well as (ii) the right to have such data transmitted by Synevo to another data controller, provided that the legal conditions are fulfilled;
the right of opposition – the right to oppose at any time, for justified and legitimate reasons related to a particular situation, to the processing of a data subject’s data, except in cases where there are legal provisions stating otherwise; as far as direct marketing activities go, data subjects have the right to object to such processing at any time.
the right not to be subject to an automated individual decision – the right not to be subject to a decision based solely on automatic processing, including profiling, which produces legal effects that concern or similarly affect a data subject to a significant extent;
the right to lodge a complaint with the National Supervisory Authority for the Processing of Personal Data to exercise and defend any rights guaranteed by the relevant legislation, notwithstanding the possibility of addressing the competent courts of law.
the right of the data subject to withdraw their consent when processing activities are based on it; the withdrawal of the consent does not affect the legality of the processing carried out based on such consent before its withdrawal.

Please note that if consent is withdrawn in compliance with the applicable legal provisions, when such consent was previously given for direct marketing activities, Synevo, after acknowledging this fact, will no longer send you direct marketing communications. Although you will no longer receive such communications, Synevo may still legally process your personal data

on other grounds and for other purposes such as the fulfilment of certain legal obligations incumbent upon it, the performance of contracts or for a legitimate interest of Synevo (e.g. to improve services, settle complaints received, defend rights and interests).

Furthermore, if the data is transferred outside the EEA ("European Economic Area"), the data subjects whose Personal Data are transferred, may request information from the data controller regarding the transfer guarantees.

To exercise the rights mentioned above, you can send a request to the following contact details:

Address: Bdul. Pache Protopopescu, Nr. 81, floor 2, room 3, district 2, 021408 Bucharest
Attn: Compliance Department
E-mail: datepersonale@synevo.ro

Also, for any additional information on how Personal Data are processed, please contact the Data Protection Officer at the e-mail address: datepersonale@synevo.ro. And if you want to read the electronic version of the Extended Privacy Notice regarding the processing of personal data from collection centres, you can access it here.