Privacy Policy

Last updated: May 31, 2026

1. Data Controller

Toke Medical Center, Toke Medical Center, registered at Rr. Hadmi Garunja, Liqeni Thatë, Tirana, Albania. Data protection inquiries — tokemedicalcenter@gmail.com.

2. What Data We Collect

• Identification data: name, surname, date of birth, nationality, passport / ID number (only when required for medical records).
• Contact data: phone, email, address.
• Health data (special category, Art. 9 GDPR): medical history, photos, allergies, medications, intake forms, consent forms, treatment outcomes.
• Financial data: payment information processed by Bank transfer and on-site cash payments — we do not process credit-card payments online.
• Technical data: IP address, browser, device, pages visited (analytics).

3. Legal Basis

• Consent (Art. 6(1)(a) GDPR) — for marketing communications and special-category health data.
• Contract performance (Art. 6(1)(b)) — to deliver the medical services you booked.
• Legal obligation (Art. 6(1)(c)) — medical record retention requirements under Albanian law.
• Vital interests (Art. 6(1)(d)) — in medical emergencies.

4. How We Use Your Data

• Schedule consultations and procedures.
• Maintain medical records as required by law.
• Communicate appointment reminders, pre-op instructions, and follow-ups.
• Process payments and issue invoices.
• Improve our services (anonymized analytics).
• Send marketing material, only with explicit opt-in.

5. Data Sharing

We do not sell your data. We share data only with: medical staff treating you; laboratories or radiology providers when clinically necessary; payment processors; legal authorities when compelled by law; IT service providers under data-processing agreements (Art. 28 GDPR).

6. International Transfers

If your data is transferred outside the European Economic Area, we use Standard Contractual Clauses approved by the European Commission and additional safeguards.

7. Retention

Medical records: [X YEARS — typically 10+ per Albanian law]. Marketing data: until you withdraw consent. Technical/analytics data: 26 months max.

8. Your Rights (GDPR Articles 15–22)

• Access your data.
• Rectify inaccurate data.
• Request erasure ("right to be forgotten") — subject to medical record retention obligations.
• Restrict processing.
• Data portability.
• Object to processing.
• Withdraw consent at any time.
• File a complaint with the supervisory authority — in Italy: Garante per la Protezione dei Dati Personali (garanteprivacy.it); in Albania: Commissioner for the Right to Information and Personal Data Protection (idp.al).

To exercise your rights, contact tokemedicalcenter@gmail.com.

9. Cookies

See our Cookie Policy.

10. Security

We implement appropriate technical and organizational measures including encryption in transit (TLS 1.2+), access controls, audit logs, and staff training.

11. Changes to This Policy

We may update this policy. Material changes will be communicated via the website and (if you are an existing patient) email.

12. Contact

Toke Medical Center
Rr. Hadmi Garunja, Liqeni Thatë
Tirana, Albania
Email: tokemedicalcenter@gmail.com
Phone: +355 68 200 2860