Privacy Policy
Last updated: 13 October 2026
1. Who we are
Fidus (“we”, “us”) is a dental tourism service based in Tirana, Albania. We help patients, mainly from Italy and other European countries, find suitable partner dental clinics in Albania and organise their trip, accommodation and support before and after treatment. We also sell oral care products through our online shop to customers in Albania. We operate the website https://fidusmed.com and are the controller of the personal data described in this policy.
Dental treatment itself is provided by independent, licensed partner clinics, which are separate controllers for the medical records they create.
- Location: Tirana, Albania
- Email: info@fidusmed.com
- Phone: +355 68 404 9980, +39 344 656 0619
2. Legal framework
We process personal data in accordance with Albanian Law No. 124/2024 “On the Protection of Personal Data” and, because we offer our services to people in the European Union, with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”).
We follow the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.
3. What data we collect
| Category | What it includes | How we get it |
|---|---|---|
| Contact data | Name, email, phone number, country, preferred language, your messages | When you email, call or message us, including on WhatsApp, Facebook or Instagram |
| Health data | Description of your dental problem, medical and dental history, medications, allergies, X-rays, scans, photos of your teeth, treatment plans and quotes | Only if you choose to send them to us so we can find a suitable clinic and treatment |
| Travel and stay data | Arrival and departure dates, flight or ferry details, hotel preferences, number of companions | When you ask us to organise your trip and stay |
| Online shop orders | Name, phone number, email, delivery address in Albania, products ordered, order value | When you place an order in our shop |
| Testimonials | Your name, photo or video and your review | Only with your consent, if you agree to share your experience |
| Technical data | IP address, browser and device type, date and time of visit, pages visited, cart contents | Automatically, from our website and necessary cookies |
4. Why we use your data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Answering your questions | Steps taken at your request before a contract, or our legitimate interest in replying to enquiries |
| Reviewing your health information, sharing it with partner clinics and obtaining treatment proposals | Your explicit consent (Art. 9(2)(a) GDPR) |
| Organising your trip, transfers and accommodation | Performance of a contract with you |
| Follow-up support before and after treatment | Performance of a contract and, for health information, your explicit consent |
| Processing and delivering online shop orders | Performance of a contract with you |
| Publishing testimonials | Your consent |
| Invoicing, accounting and tax | Legal obligation |
| Running and securing the website | Our legitimate interest in a working and secure website |
| Defending legal claims | Our legitimate interest |
You can withdraw your consent at any time. If you withdraw consent for health data, we will stop sharing it and delete it, unless we must keep it by law, but we may then be unable to help you with your treatment.
We do not sell your data, we do not send marketing messages without your consent, we do not use analytics or advertising tracking tools, and we do not make automated decisions that have legal effects on you.
5. Partner clinics
With your consent, we share your health information with the partner clinic or clinics you choose or that we suggest, so they can assess your case and prepare a treatment plan. Once you become a patient of a clinic, that clinic is responsible for your medical records under its own privacy policy and the law. We only receive from the clinic the information needed to organise and support your stay.
6. Cookies and third-party content
Our website uses only cookies that are necessary for it to work, such as for the shopping cart, wishlist and website security. We do not use analytics, advertising or tracking cookies.
- Google Maps – our contact page shows an embedded map. When the map loads, Google may receive your IP address and set cookies under its own privacy policy.
- Google Fonts – fonts may be loaded from Google’s servers, which receive your IP address.
- WhatsApp, Facebook and Instagram – if you contact us there, the conversation takes place on Meta’s services under Meta’s own privacy policy. For sensitive health information, we recommend email.
You can block or delete cookies at any time in your browser settings, but the shopping cart may then not work.
7. Who we share data with
- Partner dental clinics – as described in section 5, with your explicit consent.
- Hotels, transfer and travel providers – the data needed to book your stay and transport.
- Delivery partners – your name, phone number, address and the amount due, for online shop orders in Albania.
- Technical providers – our website hosting provider, our web developer Park Studios for website maintenance, and our email service provider. They act only on our instructions.
- Accountants and advisers – under a duty of confidentiality.
- Public authorities – when the law requires it.
8. International transfers
If you live in the European Union, your data is transferred to Albania so that we and our partner clinics can provide the services you request. This transfer is necessary for the contract you request and, for health data, is based on your explicit consent. Some technical providers, such as Google and Meta, may also process data in other countries, including the United States, on the basis of an adequacy decision or appropriate safeguards such as standard contractual clauses.
9. How long we keep your data
| Data | Retention period |
|---|---|
| Enquiries that do not lead to treatment | 1 year after the last contact |
| Health information you send us | Until your treatment and follow-up are completed, and no longer than 2 years after the last contact, unless you ask us to delete it earlier |
| Travel and accommodation bookings | 2 years after your stay |
| Online shop orders and invoices | 10 years, as required by Albanian accounting law |
| Testimonials | Until you withdraw your consent |
| Website server logs | 6 months |
After these periods, data is securely deleted or anonymised.
10. Security
Because we handle health information, we apply strict measures to protect it, including restricted access for authorised staff only, confidentiality obligations, secure storage of medical files and an encrypted connection (HTTPS) on our website. If a data breach is likely to put your rights at risk, we will notify the competent supervisory authority within 72 hours and, where the risk is high, inform you without undue delay.
11. Your rights
Under the GDPR and Law No. 124/2024 you have the right to:
- access your personal data and receive a copy;
- correct inaccurate or incomplete data;
- erasure, where we no longer need the data and are not legally required to keep it;
- restrict processing in certain cases;
- object to processing based on our legitimate interests;
- data portability for data you gave us under a contract or consent;
- withdraw consent at any time, without affecting earlier processing.
To exercise your rights, email info@fidusmed.com with the subject “Personal data request”. We may ask you to confirm your identity. It is free of charge and we will reply within one month.
12. Children
Our services are intended for adults. Health information about a minor may be sent to us only by a parent or legal guardian.
13. Complaints
If you believe your data is processed unlawfully, please contact us first so we can resolve it. You also have the right to lodge a complaint with a supervisory authority:
- In Albania: Commissioner for the Right to Information and Personal Data Protection, Rr. “Abdi Toptani”, Nd. 5, Tirana – www.idp.al
- In Italy: Garante per la protezione dei dati personali – www.garanteprivacy.it
- In another EU country: the data protection authority of the country where you live or work.
14. Changes
We may update this policy when the law or our practices change. The current version is always published on this page with the date of the last update at the top.