Privacy Policy

Effective date: 23 January 2026. Last updated: 26 October 2026.

This policy explains what personal data the Miren Medic polyclinic collects through the mirenmedic.rs website and in connection with it: when you book an appointment, fill in a questionnaire, receive a report, write to us or simply visit the site. It says why we process it, who receives it, how long we keep it and what your rights are, under the Personal Data Protection Act of the Republic of Serbia.

Who the data controller is

Miren Medic (Poliklinika Miren)
Tax ID (PIB): 114492428 · Registration number: 67619919
Address: Vojvode Stepe 250, Belgrade, Serbia
Phone: +381 11 6359 130 · +381 64 9510 000
E-mail: info@mirenmedic.rs

For any question about your data and to exercise your rights, write to info@mirenmedic.rs, marked "Data protection".

What data we collect and why

Booking an appointment on the site: full name, e-mail, phone, a note, the chosen service, department, doctor or treatment and time slot, the language of the form and the campaign label from the address you arrived through (for example instagram). With the request we record the time of your consent, the IP address and browser details. Basis: steps taken at your request before a contract and performing the contract for health care. The choice of department or doctor can reveal a health detail; we process it with your explicit consent, which you give by ticking the box before sending, and in order to provide health care.
Patient record: the clinic keeps the full name, contact details, date of birth, address and notes. Basis: providing health care and the legal duty to keep medical records.
Questionnaire (medical history): full name, contact details, date of birth and answers about your health, before and after a treatment, with the time of consent, the IP address and browser details. This is health data, a special category of personal data. Basis: your explicit consent and providing health care.
Visit report: complaints, findings, therapy, recommendations and the follow-up plan. We send the report to you by e-mail as a protected link and record when, from which IP address and in which browser the link was opened. Basis: providing health care.
Contact form: name, e-mail, phone and the message. The message goes by e-mail to the clinic's mailbox and is not written into a database on the site. Basis: steps taken at your request. Please do not send findings or diagnoses through the form.
Reminders: before a booked appointment we send a reminder by e-mail to the address in the request. Basis: performing the contract.
Chat on the site (Tidio): loads only if you switch on functional cookies; what you write in the chat goes to the Tidio service and to us.
Visits to the site: like every web server, ours keeps technical records (IP address, time, page, browser) in order to run and stay secure. Basis: legitimate interest. Analytics and marketing only start with your consent (see "Cookies").

Who else receives data

Clinic staff: bookings, records, questionnaires and reports are seen only by employees with their own back-office account, each to the extent their work needs. Doctors and staff are bound by professional secrecy.
Hosting and maintenance: the site, the database and the forms run on a server of our hosting and maintenance provider, in a data centre in Germany (EU). The e-mails about a request, reminders and reports also go out through that server, and messages arrive in the clinic's mailboxes at its e-mail provider.
Cloudflare: on the booking and questionnaire forms it checks that you are not a robot (Turnstile), so it sees the IP address and browser details.
Google (Google Ireland Limited): Google Analytics, only if you switch on analytics cookies. Google receives visits and page addresses, without name, contact details or form contents.
Meta (Meta Platforms Ireland Limited): measuring our ads on Facebook and Instagram, only if you switch on marketing cookies. Meta receives page addresses and the fact that a booking was completed, but not your name or contact details.
The booking page address: when you reach the booking page through a link for a specific specialty, doctor or treatment, that label is in the page address, and after sending the address carries your request number. Before anything goes to Google or Meta, the site removes the chosen service, specialty, doctor, time and request number from the address, and sends the page you came from only as the site's address. So they know that the booking page was visited or a booking completed, but not with which doctor or why.
Tidio: the chat, only if you switch on functional cookies.
Backups: Daily backup copies of the database are also kept with an external backup service outside the European Union.
Competent authorities, only where the law requires it.

We never sell data or give it to anyone for advertising.

Transfers outside Europe

Google, Meta and Cloudflare are US companies and may process data outside Serbia and the European Union as well. Such transfers rely on those companies' standard contractual clauses and on the EU-U.S. Data Privacy Framework. Tidio may process chat data outside the European Union as well, under its own privacy rules.

How long we keep data

Bookings, records, questionnaires and reports: as long as the rules on health care and medical records require.
Contact form messages and e-mail correspondence: in the clinic's mailbox until the clinic deletes them; we delete them at your request.
Server records: 14 days, then they delete themselves.
Analytics and ad measurement: under Google's and Meta's own settings and rules.
Your cookie choice: 12 months.

Your rights

You have the right to access your data and get a copy, to have it corrected and completed, to erasure in the cases the law provides, to restriction of processing, to data portability and to object to processing based on legitimate interest. You can withdraw consent at any time, without affecting the lawfulness of processing before you withdrew it. Medical records are kept as long as the law requires, also when you ask for erasure. Send your request to info@mirenmedic.rs; to protect your privacy we may verify your identity before we answer. We reply without delay, within the time the law sets.

You can lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (Bulevar kralja Aleksandra 15, 11120 Belgrade; www.poverenik.rs).

Cookies

Strictly necessary: mn_cookie_consent remembers your choice for 12 months; the site also remembers in your browser's storage that you have seen a notice or an offer, so it is not repeated.
Functional (only with consent): the Tidio chat and what it stores in your browser.
Analytics (only with consent): _ga and _ga_Q0YHKDS8ZV, Google Analytics, up to 2 years.
Marketing (only with consent): _fbp on this domain and fr on facebook.com, Meta, up to 90 days.

Until you consent, the site does not contact Google, Meta or Tidio. Change your choice in the cookie settings in the site footer. More: Cookie policy.

Children

The site is not aimed at children under 15. For a child, the appointment is booked and the data given by a parent or guardian.

Security

The site only works over an encrypted connection (HTTPS). The back office is password protected, reports open only through a protected link, and health data is available only to the staff who need it for their work and to authorised staff of the hosting and maintenance provider.

Changes to this policy

When we change how we handle data, we change this page and the last-updated date at its top.