Privacy Policy
1. Data controller
The controller of personal data is LinkConnect Ltd. (Линк Кънект ЕООД), with the data-protection contact listed on the contact page. This policy describes how we process personal data under Regulation (EU) 2016/679 (GDPR).
2. What data we collect
For patients: name, email, telephone, age group, appointment preferences and an optional short note. For students: identification and verification data, including proof of student status. We do not require — and ask you not to enter — a national identification number, medical history or diagnoses.
3. Purposes and legal bases
We process data to: provide the service (performance of a contract), ensure security and prevent abuse (legitimate interest), meet accounting obligations (legal obligation), and run analytics where consent has been given.
4. Retention
Your account data is kept while your account is active; you can delete it at any time from your settings, upon which your data is deleted or anonymized. We apply the following periods: appointment and visit records (including free text) are anonymized after up to 24 months; patient–student messages are kept for up to 24 months; dental X-rays are deleted once the request closes and at the latest 6 months after upload (see “Dental images and health-related data”); notification logs for 12 months; audit logs for 24 months; analytics data for 14 months. Accounting data is kept for the statutory periods. After the applicable period, data is deleted or anonymized. Waitlist signups (email and any telephone number) are deleted within 30 days of the alert being sent, or 12 months from signup if no match occurs.
5. Recipients
We use processors for hosting and the database, the payment provider (Stripe) for student subscriptions, and an email delivery provider. We do not sell personal data and do not share it with advertising networks.
6. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP). You can export your data and delete your account from your settings.
7. Security
We apply technical and organizational measures: encrypted connections, row-level access control in the database, signed expiring links for confidential documents, an audit log of administrative actions, and the principle of least privilege.
Dental images and health-related data
When sending a request, patients may choose to upload dental X-ray images (radiographs) and to describe their complaint. Such information can reveal data concerning health, which is a special category of personal data under Article 9 GDPR. We process it ONLY on the basis of your explicit consent, and solely to let the specific student you contact pre-assess your case before offering one of their limited faculty appointment slots. X-rays are stored privately with encryption, strictly restricted access and access logging; they are shared only with the student to whom you send the request, are never made public, and are deleted automatically once the related request is closed (after the appointment takes place, or if the request is declined, cancelled or expires) and no later than 6 months after upload, as well as at any time on your request. Providing an X-ray is always optional.
Telephone number for waitlist alerts
If no student matches your search, you can join a waitlist with your email. Giving a telephone number is optional and is never required to join: the list works on email alone. If you do give one, you must separately tick the consent box, and we record when that consent was given. The number is used for a single purpose — to alert you when a student offering the treatment you looked for becomes available in your city. All waitlist alerts are currently sent by email; the number would be used only if we add Viber or SMS alerts, and for nothing else. We do not use it for marketing, do not call you, and do not pass it to students or to anyone else other than the messaging provider that delivers the alert. You may withdraw consent at any time, and ask us to delete your waitlist entry, using the contact details in this policy. We delete the entry, including the number, within 30 days of sending your alert, or within 12 months of signing up if no suitable student ever appears — whichever comes first.