# Data protection for medical & dental clinics Source: https://conformitate.md/en/industries/medical-clinics Updated: 2026-10-15 Medical & dental clinics Data concerning health is a special category: processing it is prohibited except as allowed by art. 9(2), such as health care. As the controller, the clinic informs patients, keeps records of processing activities and secures the data. An impact assessment is mandatory for processing on a large scale, and a data protection officer where it is the clinic’s core activity. ![A medical clinic's reception with patient files kept safe](/_astro/clinici-medicale-1200.BubO_EP7.webp) ## Industry-specific risks ### Special categories of data on a large scale Medical records, X-rays and test results are data concerning health. Where they are processed on a large scale, the clinic carries out a data protection impact assessment before the processing begins. [art. 9](https://conformitate.md/en/law-195-2024/article-9 "Processing of special categories of personal data") [art. 35](https://conformitate.md/en/law-195-2024/article-35 "Data protection impact assessment") ### Results sent by messaging apps Results sent by Viber or email without appropriate security measures can reach an unauthorised person, and that disclosure is a personal data breach. [art. 4](https://conformitate.md/en/law-195-2024/article-4 "Definitions") [art. 32](https://conformitate.md/en/law-195-2024/article-32 "Security of processing") [art. 33](https://conformitate.md/en/law-195-2024/article-33 "Notification of a personal data breach to the Centre") ### Unrestricted access to records The clinic must ensure that, by default, patients’ data cannot be accessed by an unlimited number of persons without the individual’s intervention, and that staff process it only on the clinic’s instructions. [art. 25](https://conformitate.md/en/law-195-2024/article-25 "Data protection by design and by default") [art. 32](https://conformitate.md/en/law-195-2024/article-32 "Security of processing") ## Data you process Medical records Diagnoses and treatments X-ray images Laboratory results IDNP and insurance policy Data of patients who are minors ## Your obligations under Law No. 195/2024 1. Processing data concerning health only in one of the situations the Law provides for, such as health care provided under professional secrecy [art. 9](https://conformitate.md/en/law-195-2024/article-9 "Processing of special categories of personal data") 2. Informing patients at the time their data is collected [art. 13](https://conformitate.md/en/law-195-2024/article-13 "Information to be provided where personal data are collected from the data subject") 3. Records of processing activities: the exemption for fewer than 250 employees does not apply to data concerning health [art. 30](https://conformitate.md/en/law-195-2024/article-30 "Records of processing activities") 4. Security measures appropriate to the risk, including control of access to records [art. 32](https://conformitate.md/en/law-195-2024/article-32 "Security of processing") 5. A data protection impact assessment where data concerning health is processed on a large scale [art. 35](https://conformitate.md/en/law-195-2024/article-35 "Data protection impact assessment") 6. A data protection officer where the core activity consists of processing data concerning health on a large scale [art. 37](https://conformitate.md/en/law-195-2024/article-37 "Designation of the data protection officer") ## Documents we deliver Every document is tailored to your activity, not copied from a template. Privacy notice for patients [art. 13](https://conformitate.md/en/law-195-2024/article-13 "Information to be provided where personal data are collected from the data subject") Records of processing activities [art. 30](https://conformitate.md/en/law-195-2024/article-30 "Records of processing activities") Data protection impact assessment, where processing is on a large scale [art. 35](https://conformitate.md/en/law-195-2024/article-35 "Data protection impact assessment") Medical records access policy [art. 24](https://conformitate.md/en/law-195-2024/article-24 "Responsibility of the controller") [art. 32](https://conformitate.md/en/law-195-2024/article-32 "Security of processing") Personal data breach log [art. 33](https://conformitate.md/en/law-195-2024/article-33 "Notification of a personal data breach to the Centre") Contracts with processors [art. 28](https://conformitate.md/en/law-195-2024/article-28 "Processor") How we work ## From the first conversation to a complete compliance file 1. 1 ### Free consultation 15 minutes online or by phone. We learn what your company does and what personal data it processes. 2. 2 ### Assessment We take stock of your data, processes and existing documents. You receive a gap report. 3. 3 ### Documentation We draft the records, policies and privacy notices tailored to your activity. 4. 4 ### Implementation We walk you through the documents and leave a written note for employees; on request, we hold a briefing session for them. For a typical medical clinic The Essential package + extra work, 18,900 MDL This is an estimate for a typical organisation in the industry, with up to 20 people working with the data. The exact price depends on what you do with the data. [Calculate the exact price →](https://conformitate.md/en/tools/price-calculator?profil=clinici-medicale) Packages ## Fixed prices, no surprises Choose a package by how your company processes data, not by headcount. Prices start from the lawyer's work, and a package costs less than its modules bought separately. ### Essential 5,900 MDL Module value: 18,500 MDL · you save 12,600 MDL Up to 3 processing activities · 2 privacy notices · 2 processor contracts For a small company with simple processing: a shop, an office, an accounting firm, a homeowners' association. - Data inventory and gap report - Records of processing activities, with the legal basis and retention period of each - Data protection policy and a description of the security measures - Privacy notices for each group of people: clients, employees, patients - Contracts with processors, new or reviewed - Internal rules for data subject requests and for personal data breaches - The confidentiality commitment and the written note for employees Online · delivered in 10 working days · 1 round of revisions · 14 calendar days of email questions [Choose Essential →](https://conformitate.md/en/industries/medical-clinics?pkg=essential#oferta) ### Extended Most popular 19,900 MDL Module value: 44,000 MDL · you save 24,100 MDL Up to 8 activities · 5 notices · 5 contracts · website, cameras, sensitive data For a small or medium company with varied processing: a clinic, an online shop, surveillance cameras, cloud services abroad. - Everything in Essential, with higher limits - Website privacy policy and cookie review - Video surveillance: notice, sign text, internal rules - Sensitive data in one activity (for example, medical records) - Transfers outside Moldova, one group of destinations - We check whether you need an impact assessment and a data protection officer Online · delivered in 20–30 working days · 2 rounds of revisions · 45 calendar days of email questions [Choose Extended →](https://conformitate.md/en/industries/medical-clinics?pkg=extended#oferta) ### Custom from 45,000 MDL No limits · analysis at your premises For clinic networks, banks and microfinance companies, groups of companies, public bodies, or companies that must appoint a data protection officer. - Everything in Extended, with no limits - Data protection impact assessments, as many as needed - Review of data flows and IT systems - Joint controller agreements, profiling, complex transfers Priced after analysis, at module prices [Request a quote →](https://conformitate.md/en/industries/medical-clinics?pkg=custom#oferta) Not sure which package fits? [Calculate the price →](https://conformitate.md/en/tools/price-calculator) [Request a free 15-minute consultation →](https://conformitate.md/en/industries/medical-clinics?pkg=consult#oferta) Documents are drafted in Romanian; an authorised translation into Russian or English is charged separately, at the translator's rate. ## Case studies and checklist [ Case study Illustrative example ### Case study: medical clinic A dental clinic in Chișinău with three surgeries. Every member of staff, reception included, had access to every patient file, test results were sent to patients over Viber, and the clinic kept no record of processing activities. On their first visit, patients filled in a questionnaire with their contact details and medical history without being told who would process the data or why. Result Access to patient files is now granted by role, results are sent through a secure channel, patients receive a privacy notice, and the clinic has a record of processing activities, confidentiality undertakings signed by its staff, a breach register and a team briefed on its obligations. ](https://conformitate.md/en/case-studies/medical-clinic) FAQ ## What clients ask us ### Does my clinic need a data protection officer? Yes, if the clinic’s core activity consists of processing data concerning health on a large scale. Designation is also mandatory for public medical institutions, as public institutions. In other cases designation is optional, unless normative acts require it. The Law sets no numerical threshold for ‘large scale’, so each clinic’s situation is assessed case by case. [art. 37](https://conformitate.md/en/law-195-2024/article-37 "Designation of the data protection officer") ### Can we send test results by WhatsApp? The Law does not prohibit any particular channel, but it requires security measures appropriate to the risk, and data concerning health is a special category. If results reach an unauthorised person, the clinic documents the breach and notifies the National Centre for Personal Data Protection, unless the breach is unlikely to result in a risk to the rights and freedoms of patients. [art. 32](https://conformitate.md/en/law-195-2024/article-32 "Security of processing") [art. 33](https://conformitate.md/en/law-195-2024/article-33 "Notification of a personal data breach to the Centre") ### How long do we keep medical records? Law No. 195/2024 sets no retention periods for medical records. Data is kept only for as long as the purpose for which it was collected requires, and the periods set by health legislation are legal obligations of the clinic. After that, the data is no longer kept in a form that permits the patient to be identified. [art. 5](https://conformitate.md/en/law-195-2024/article-5 "Principles relating to processing") [art. 6](https://conformitate.md/en/law-195-2024/article-6 "Lawfulness of processing") --- Provider: conformitate.md · RIGHT CONSULT COMPANY (IDNO 1022600002005) · MD-2072, mun. Chișinău, sect. Botanica, str. Grenoble 259/6, of. 57 Phone: +373 767 27 667 · Email: contact@conformitate.md Prices: https://conformitate.md/en/pricing