Privacy policy

This policy explains which of your personal data Poliklinika Barbel collects through the barbel.hr website and in contact with you, why it processes them, how long it keeps them and which rights you have.

Data controller

The data controller is Poliklinika za plastičnu, rekonstruktivnu i estetsku kirurgiju, opću kirurgiju, anesteziologiju, reanimatologiju i intenzivnu medicinu s liječenjem boli BARBEL (hereinafter: Poliklinika Barbel), a healthcare institution, Pavla Štoosa 28, 10000 Zagreb, OIB 23130971858, MB 01481924.

Contact: Send a message, phone +385 1 23 06 100.

For questions about the protection of personal data and to exercise your rights, write to the clinic's email address marked “Personal data protection”, or send a letter to the address above. Such requests are handled by the person responsible for personal data protection at the polyclinic.

What data we process and why

The “Get in touch” form

In the form on the Get in touch page you enter your name, mobile number, message and, if you wish, your email address. Before sending, you tick a box with the text: “I agree that Poliklinika Barbel may use my data to reply to my enquiry and arrange an appointment, and keep it in its patient records, in accordance with the Privacy policy.”

• The message is sent by email to the clinic's email address. The website does not save it in its database.
• Providing the data is not a legal obligation, but without your name and mobile number we cannot reply to you or arrange an appointment.
• The form is for a text enquiry only. Bring test results and photographs to the examination.
• To protect against misuse, the website keeps a protected one-way summary (hash) of your IP address and the hour of sending for one hour, in order to limit the number of messages, and a summary of the form token for six hours to prevent double submission. The IP address and the content of the message cannot be read from these records.

If you describe your health problems in the message, this is health data. We process it only to reply to your enquiry and prepare the examination, and only staff bound by professional secrecy have access to it.

Phone, email and WhatsApp

We use the data you give us yourself by phone, email or WhatsApp message only to reply to your enquiry and arrange an appointment. The WhatsApp link opens that service's app; messages sent that way are transmitted by WhatsApp (Meta) under its own privacy policy, which we cannot influence. For that reason, please do not send test results, photographs or other sensitive data in a message; bring them to the examination.

When you become a patient

If you come for an examination after your enquiry, we process your data to provide healthcare and to meet legal obligations, and we keep medical records as required by healthcare regulations. Doctors and other staff are bound by medical and professional secrecy.

Technical server logs

The server on which the website is hosted records the usual technical access logs (IP address, time, requested page, type of browser) for security and troubleshooting. These logs are not linked to your enquiry.

Legal basis

• Replying to an enquiry and arranging an appointment (name, contact details, content of the enquiry): steps we take at your request before providing a service, Article 6(1)(b) of the General Data Protection Regulation (GDPR).
• Health data in an enquiry: your explicit consent given by ticking the box in the form (Article 9(2)(a) GDPR), and for enquiries by phone, email and WhatsApp, preparation of healthcare under an obligation of professional secrecy (Article 9(2)(h) and 9(3) GDPR). You can withdraw consent at any time; withdrawal does not affect the lawfulness of processing before withdrawal.
• Providing healthcare and keeping medical records: Article 9(2)(h) and Article 6(1)(c) GDPR, the Health Care Act (Zakon o zdravstvenoj zaštiti), the Act on Data and Information in Health Care (Zakon o podacima i informacijama u zdravstvu) and the Patients' Rights Protection Act (Zakon o zaštiti prava pacijenata).
• Technical logs and protection against misuse: our legitimate interest in the website working securely (Article 6(1)(f) GDPR).
• Visit statistics: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.

We do not make decisions based solely on automated processing and we do not create profiles.

How long we keep data

• An enquiry that does not lead to an examination is kept while the arrangements are under way and for a reasonable time afterwards, in case you get in touch again; after that we remove it from our records.
• If you come for an examination, the data from the enquiry becomes part of your medical records, which we keep for the periods set by the Act on Data and Information in Health Care and its implementing regulations.
• The summary of the IP address from the form is deleted after one hour, and the summary of the form token after six hours.
• Technical server logs are kept for the limited time needed for security and troubleshooting.
• Visit data tied to an individual browser in Google Analytics is kept for 14 months; aggregate reports (without data about individuals) are kept permanently.

Who else has access

We do not sell your data, we do not use it for advertising and we do not give it to third parties, except:

• to competent authorities and health registers when the law requires it;
• to processors that provide website hosting and email services for us; they process the data only on our instructions and under a duty of confidentiality.

We ourselves do not transfer your data to countries outside the European Economic Area, except for visit data that Google Analytics processes with your consent (see Cookies). If you contact us through WhatsApp or open a link to Google Maps or YouTube, your data is processed by the provider of that service as an independent controller, under its own privacy policy.

Cookies

The barbel.hr website does not create profiles of visitors and does not show personalised ads. Google cookies for visit statistics and ad measurement are set only with your consent.

Necessary cookies (consent not required):

• PHPSESSID – technical session of the content management system; lasts at most 7 days;
• PH_HPXY_CHECK – server security check; deleted when the browser is closed;
• bb_privola – remembers your answer to the cookie notice (“I accept” or “I do not accept”); lasts 6 months.

Visit statistics and ad measurement – only with your consent. If you click “I accept” on the notice, we use Google Analytics 4 (Google Ireland Limited) to find out which pages are read and on which devices, and Google Ads (Google Ireland Limited) to measure how many visitors came through our ads on Google and how many of them then sent an enquiry or called the clinic. Ad personalisation is switched off. The IP address is passed to Google to determine an approximate location (country, city), but it is not stored. The cookies _ga and _ga_3NDVVM1HSG are then set (they last up to 2 years; they recognise the browser by a random number, not by your name or contact details) and _gcl_au (lasts 90 days), and, if you came to the website by clicking our ad, also _gcl_aw and _gcl_gs (they last 90 days). Until you click “I accept”, or if you click “I do not accept”, Google Analytics and Google Ads are not loaded at all and no data goes to Google. Google may also process data on servers outside the European Economic Area, on the basis of standard contractual clauses and the EU–US Data Privacy Framework.

You can use the website fully without consent. You can withdraw or change your consent at any time through the “Cookie settings” link in the footer of the page; when consent is withdrawn, the _ga and _gcl cookies are deleted from your browser and measurement stops immediately. Withdrawal does not affect the lawfulness of processing before withdrawal.

Fonts are hosted on our server and are not loaded from Google. The map on the page is an ordinary image. Google Maps or YouTube open only when you click a link, and Google's privacy policy then applies.

Security

The website runs over HTTPS, so everything you enter is encrypted on its way to our server. Only staff who need it for their work and who are bound by confidentiality have access to your data.

Your rights

In relation to your data you have the right to:

• access the data we hold about you;
• have inaccurate data corrected;
• have your data erased, except for data we are required by law to keep (e.g. medical records);
• restrict processing;
• receive the data you gave us yourself in a portable format;
• object to processing based on our legitimate interest;
• withdraw consent at any time.

Send your request to the clinic's email address marked “Personal data protection”, or by letter to our address. We will reply within one month at the latest; if the request is complex, we will tell you about any extension of the deadline. To protect you, we may ask you to confirm your identity.

Complaint

If you believe that we process your data contrary to the regulations, you can lodge a complaint with the supervisory authority: the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Selska cesta 136, 10000 Zagreb, azop.hr. We would be glad if you contacted us first so that we can try to resolve the problem.

Changes

We may change this policy. The current version is always published at this address.

This policy applies from 4 October 2026.