MedicaElite
RO

Privacy policy

Last updated: 17 October 2026

This policy explains what personal data we process when you use the medicaelite.com website and the MedicaElite service, why we process it, how long we keep it and what your rights are. MedicaElite is a service of KOBRA CAPITAL LLC, which is the controller of your data.

  1. 1. Who we are and how to contact us

    MedicaElite coordinates written medical opinions from partner hospitals and is provided by KOBRA CAPITAL LLC ("we"). For any question about your data or to exercise your rights, you can write to us at info@medicaelite.com, through the form on the website or on WhatsApp, with the green button on every page. We reply within one month of receiving your request.

  2. 2. What data we process

    • Data from the contact form: your name, phone number, email address, preferred contact method, the hospital you chose (if you asked for a quote from a specific hospital) and the consents you ticked, with the exact wording and date of each consent.
    • Data you give us later, by phone, on WhatsApp or through the secure page: medical documents (medical letters, results, imaging), the diagnosis and other information about your health that is needed to request the opinions. This is health data, a special category of data.
    • Technical data about your visit: IP address, browser type and the pages you open, logged by our hosting provider so the website works and stays secure.
    • Marketing data, only if you accept marketing cookies: where your visit came from (for example the advert you clicked) and the Meta and Google click identifiers.

    The contact form does not ask anything about your illness. Please don't send us medical documents on WhatsApp or by email; we send you a link to a secure page.

  3. 3. Why we process it and on what legal basis

    • To contact you and answer your request: based on your consent and on steps taken at your request before working together (Art. 6(1)(a) and (b) of Regulation (EU) 2016/679, the GDPR).
    • To request medical opinions and quotes from the hospitals you choose: based on your explicit consent for health data (Art. 9(2)(a) GDPR). We never send your file to a hospital without your approval.
    • To send you useful information by email from time to time: only if you ticked that option (Art. 6(1)(a)). You can unsubscribe at any time.
    • To measure our adverts: only with your consent to marketing cookies (Art. 6(1)(a)).
    • To protect the website against abuse and defend our rights in a dispute: based on our legitimate interest (Art. 6(1)(f)).
    • To meet the legal obligations that apply to us (Art. 6(1)(c)).

  4. 4. Who we share data with

    • The partner hospitals you approve, so they can send you their opinions and quotes. Each hospital processes the data as an independent controller under its own rules.
    • Providers that help us operate: website hosting (Vercel), Google (Google Sheets and Gmail), where we keep contact requests and receive notifications, and, only with your consent, Meta and Google to measure adverts. They process the data only on our instructions.
    • If you ask for help with travel, the licensed travel agency we work with and, if needed, an interpreter: only the data needed for the booking or translation.
    • Authorities, only when the law requires it.

    We do not sell your data and do not use it for automated decisions that affect you.

  5. 5. Transfers outside the European Union

    Some partner hospitals are outside the European Union. Israel is covered by a European Commission adequacy decision. We send your file to hospitals in Türkiye only with your explicit consent, after explaining that the same safeguards as in the EU do not apply there (Art. 49(1)(a) GDPR). US providers (Vercel, Google, Meta) receive data under the EU–US Data Privacy Framework or the standard contractual clauses approved by the European Commission.

  6. 6. How long we keep data

    • Contact requests and medical documents: while we work together and for at most 12 months after the last activity, then we delete them. We delete them sooner if you ask.
    • Proof of your consents: as long as needed to be able to show it, usually 3 years after we stop working together.
    • Email subscription: until you unsubscribe.
    • Technical access data: a few weeks at most, according to the hosting provider's settings.

    Copies downloaded by hospitals are kept by them under their own rules; we tell you how to ask them to delete them.

  7. 7. Your rights

    • To find out what data we hold about you and get a copy.
    • To have wrong data corrected.
    • To have your data deleted.
    • To restrict the processing.
    • To receive your data in a structured format or have it sent to another controller.
    • To object to processing based on our legitimate interest.
    • To withdraw your consent at any time, without affecting processing carried out before.

    You can complain to the Romanian data protection authority (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, www.dataprotection.ro.

  8. 8. How we protect data

    We use encrypted connections (HTTPS), restricted access, encrypted storage of documents and expiring links for sending them to hospitals. Only the people handling your file can access it.

  9. 9. Patients under 18

    For patients under 18, the request and consents are given by a parent or legal representative.

  10. 10. Changes

    We may update this policy. The date of the last update is shown above; we tell you about important changes before they apply.