Privacy Policy
Version 1.0 · Last updated 9 August 2026
The short version. Your dental X-rays and medical history are health data, and we treat them as such. We share them with one licensed dentist, only after you have said yes. They are stored in the European Union. We never sell them and never use them in advertising. Ask us to delete them and we will, without argument.
1. Who is responsible for your data
Smile Albania (“we”, “us”) is the data controller for the information you send us. Contact: privacy@smile-albania.com, Rruga e Dibrës, Tiranë, Shqipëri.
Once your records reach a partner clinic, that clinic becomes an independent controller for your clinical care under its own privacy policy. We will tell you which clinic before anything is shared.
2. What we collect
- What you tell us: name, email, phone number, country, preferred language, and what you write about your teeth.
- Health data: dental X-rays, photographs of your mouth, treatment plans, and anything you disclose about your medical history or medication.
- Messages: the content of your WhatsApp, email or Messenger conversations with us, including voice notes.
- How you found us: the advertisement or search that brought you here, and basic technical data such as browser type.
Dental images and medical history are special category health data under Article 9 of the GDPR. Everything else is ordinary personal data.
3. Why we hold it, and on what legal basis
- To get you a treatment plan — we share your records with a licensed partner dentist. Legal basis: your explicit consent (Article 9(2)(a)). We ask for it in plain words and record your answer.
- To arrange your treatment and travel — legal basis: performance of our agreement with you (Article 6(1)(b)).
- To answer your questions — legal basis: our legitimate interest in responding to people who contact us (Article 6(1)(f)).
- To keep a record that you consented — legal basis: our legal obligation to demonstrate compliance (Article 6(1)(c)).
We do not use your health data for marketing. Ever. Not even our own.
4. Automated messaging
Our WhatsApp assistant is an artificial intelligence system and tells you so when it first replies. It reads your messages in order to answer them and to record practical details such as your name and what treatment you are asking about.
It does not make any decision about your care. It cannot diagnose, cannot approve or refuse treatment, and hands anything clinical or urgent to a human colleague. No decision with legal or similarly significant effects is made about you by automated means.
You can ask to speak to a person at any point, and we will arrange it.
5. Who we share it with
- The partner clinic reviewing your case — only with your explicit consent, and only the clinic we have named to you.
- Our technology providers, who process data on our instructions under written agreements: our EU-based server host, our email provider, and the AI provider powering our messaging assistant.
- WhatsApp / Meta, if that is how you contact us. Your messages pass through their platform under their own privacy policy, which we do not control.
- Nobody else. We do not sell your data, we do not share it with advertisers, and we do not pass it to other clinics touting for business.
6. Where it is stored
Your records are stored on servers in the European Union. Where a provider processes data outside the EU, we rely on European Commission Standard Contractual Clauses or an adequacy decision.
7. How long we keep it
- X-rays and photographs: deleted 30 days after your enquiry closes, or immediately on request.
- Messages and enquiry details: up to 24 months, so we can pick up where we left off if you come back.
- Consent records: kept for as long as we are required to demonstrate that we acted lawfully, even after your other data is deleted. This is your protection as much as ours.
If you travel for treatment, the clinic keeps its own clinical records for the period required by Albanian medical law. That is separate from us and we cannot delete it.
8. Your rights
Under the GDPR you can ask us to:
- Give you a copy of everything we hold about you;
- Correct anything wrong;
- Delete it — and for health data we do this on request, without asking why;
- Restrict or object to how we use it;
- Send your data to you or someone else in a portable format;
- Withdraw your consent at any time, which stops any further sharing (it does not undo sharing that already happened lawfully).
Email privacy@smile-albania.com. We reply within 30 days, usually much sooner. There is no charge.
If you are unhappy with how we handled it, you can complain to the data protection authority in your own country, or to the Information and Data Protection Commissioner of Albania.
9. Security
Data is encrypted in transit. Access is limited to the people who need it. X-rays are deleted automatically once their retention period expires, rather than left to accumulate.
No system is perfect. If a breach occurs that puts your rights at risk, we will tell you and the relevant authority within 72 hours.
10. Cookies
This website sets no advertising or tracking cookies. If you arrive from an advertisement, the campaign reference travels with you so we know which advertisement worked. It is not linked to any profile and is not shared.
11. Children
Our services are for adults. We do not knowingly collect data about anyone under 18. If a minor contacts us, we stop and ask for a parent or guardian.
12. Changes
If we change this policy we update the version and date at the top. Material changes affecting how we use health data will be notified to anyone with an open enquiry.
13. Contact
Privacy and deletion requests: privacy@smile-albania.com
General enquiries: hello@smile-albania.com
Post: Rruga e Dibrës, Tiranë, Shqipëri