Privacy policy

• Legal entity and data controller: BOLDEANU MEDICAL S.R.L.
• Romanian tax identification number (CUI/CIF): 50030490
• Trade Register number: J2024000294096
• Registered office: Bulevardul Dorobanților nr. 470, Brăila, Brăila County, Romania
• Registration date: 30 April 2024
• Contact: contact@oncodots.com

• Account and access data: email address, role, authentication, invitations, relationships, and permissions needed to operate the account; your plain-text password is not available to us.
• Health and organisation data: for example symptoms, medication, appointments, consultation questions, and other information that you enter into application features.
• Usage data: events such as opening or completing flows, saving, sharing, errors, and other signals needed to understand whether the product works, when the applicable measurement is enabled.
• Technical and security data: limited device, session, browser, and service-operation information to the extent needed to operate and secure the application.

• To provide the features you use: journal, symptoms, medication, appointments, questions, Care Circle, and other OncoDots tools.
• To maintain continuity in your application journey where a feature needs history or context to work properly.
• To measure product quality: which features are used, where errors or abandonment occur, which content is useful, and where needs are not being met.
• For security, abuse prevention, technical support, and compliance with applicable obligations.

We do not ordinarily send raw medical content, medical questions, diagnoses, medication names, or clinical notes to generic advertising or analytics tools. Where possible we separate identity from data used for measurement and restrict access according to purpose. We do not sell personal data or health data.

OncoDots measurement uses controlled events to understand what works and what needs improvement. Consent to this measurement is not automatically consent to profiling based on health data. If OncoDots introduces behavioural personalisation using health data or other sensitive profiles, it will have a separate justification, notice, and control where required by law.

Ordinary product data does not automatically become clinical-study data. Before a study or person-level research reuse begins, we separately establish the purpose, legal basis, applicable special-category condition, participant information, approvals and consent where required, as well as access, pseudonymisation, and retention rules.

• Care Circle: only people whom you invite and within the permissions that you grant.
• Infrastructure and service providers: only to operate the application and under applicable contractual data-protection obligations.
• Meta Platforms: if you choose Facebook sign-in, for the account connection described below. Separately, only if you allow Meta Pixel, for PageView on a few public institutional pages; the Pixel is blocked inside accounts, on medical pages, and on private links.
• Researchers or partners: they do not automatically receive access to individual user data. For a future project, we prefer aggregate statistics or anonymised data; any person-level pseudonymised access requires a separate project with documented purpose, roles, legal basis, and safeguards.
• Authorities: where we have a legal obligation.

Authentication sessions use cookies needed to operate the service. Meta Pixel (ID 1053477680932970) loads only after the applicable optional choices are accepted or campaign measurement is enabled separately. The Pixel is limited to approved public pages and is blocked inside accounts, on medical pages, and on private links. OncoDots may retain first-party source and campaign information that led to account creation; later medical activity inside the account is not sent to Meta for this attribution. Preferences can be changed in Settings → Privacy.

• If you explicitly agree in Settings → Privacy, your treatment adherence patterns (dose confirmations) may feed group statistics for adherence studies.
• We only publish aggregate figures from groups of at least 10 people — never individual data, never names.
• Consent is versioned: if a study's purposes change, we ask for a fresh agreement; the old one stays on record.
• You can withdraw at any time from the same place. Withdrawing stops your data from being used in any future analysis; group figures already published cannot be traced back to you.
• Your consent history is technically protected: a withdrawn agreement can no longer be modified by anyone, not even re-dated.

Data needed for account history and features may be retained while necessary for the service and applicable obligations. Technical telemetry or raw analytics events may have shorter periods. Study data has its own retention rules. We use HTTPS/TLS, access controls, and role separation; operational access is limited to people and providers with a justified need.

• Access to and information about your data.
• Rectification of inaccurate data.
• Erasure or restriction where the legal conditions are met.
• Portability where this right applies.
• Objection and withdrawal of consent for processing based on those mechanisms, without affecting the lawfulness of processing before withdrawal.
• The right to lodge a complaint with the competent supervisory authority.

Contact us at contact@oncodots.com. We respond to personal-data requests within the period required by GDPR, normally no more than one month.

• Authentication is managed through Supabase. Your chosen provider may send us your account identifier, email address and basic profile information, such as your name and picture, depending on available data and the permissions you grant. Information received is stored in the authentication record to identify and connect your account.
• The provider learns that you are connecting to OncoDots. Your Facebook or Google password stays with the provider; OncoDots does not request or receive it.
• The sign-in flow does not send Facebook or Google any symptoms, medication, appointments or other health data entered into OncoDots. Social sign-in does not enable consent to Meta Pixel.
• You can request deletion of your account and associated data by following the Account and data deletion instructions linked below. Removing the connection in Facebook or Google does not automatically delete your OncoDots account.