Home
Privacy policy

Privacy policy

Privacy Policy on the Processing of Personal Data Invitro Diagnostics

This document is a brief presentation of the contents included in the personal data processing information form below, drawn up in accordance with legal provisions, without the intention of replacing that form.

Who are we?

Name: Invitro Diagnostics
Address: Republic of Moldova, Chișinău, Nicolae Testemițanu Street, 19/1
Executive Director: Marin BĂLĂNUȚĂ
E-mail: [email protected]
Phone: +373 22 903 999

What do we offer?

We respect your rights and respond to your requests within the legally established timeframes. Your data is processed in accordance with the way we, in turn, ensure the safety of personal data in our daily work.

Protecting your personal data is a particularly important goal. We take care of your data, managing it through encrypted channels, and we never sell or use it for any purpose other than the one for which you provided it to us.

We have a website, record data regarding system usage, keep history logs for security and online marketing purposes with targeted campaigns, and manage the data you provide.

After authentication, you may request information about your stored data or request its deletion.

The services we offer are medical services

Website
For security reasons, we keep a log of visitors to our website (IP address, pages visited). With the help of Google Analytics, we track the content you visit to offer you new, relevant content (cookies). Your browser will contain Facebook and Google Ads cookies, and as a result, you may later see Invitro Diagnostics ads through these platforms.
NewsletterBy filling in your email address and name, you can subscribe to our newsletter. We will inform you by email about offers, promotions, and news related to services offered by Invitro Diagnostics. Each email includes an unsubscribe link, should you wish to opt out. Your data will be stored for 365 days from your last interaction.
Subscription
If you subscribe to our services, your contact data and our service records will be kept in our CRM system for 3 years from the date of our last interaction.
Due to legal provisions, some of your personal data and data appearing on issued invoices will be retained for the period specified by these laws (at least 10 years, no more than 15 years from the date of the last invoice issued).

Detailed information on the processing of personal data

When drafting the provisions of this document, the company took into account, in particular, the General Data Protection Regulation (EU Regulation 2016/679), which came into effect on May 25, 2018 (“General Data Protection Regulation” or “GDPR”) adopted by the European Commission, the Law of the Parliament of the Republic of Moldova No. 133 of 08-07-2011 on the protection of personal data, and Government Decision No. 1123 of December 14, 2010 on the approval of Requirements for ensuring the security of personal data in processing within personal data information systems, as well as other international and national legislative acts regulating the protection, collection, processing, storage, destruction, and transmission of personal data.

Data management is based on a prior, voluntary, and appropriately informed declaration by individuals representing applicants for medical services, which includes the express consent of the applicants for the use of the personal data they provide or that is generated about them. In cases of data processing based on consent, applicants for medical services have the right to withdraw their consent at any time, without affecting the legality of the data processing carried out before withdrawal.

Any applicant for medical services, by providing their personal data, also assumes responsibility that the service will be used only as an applicant, both from the email address and by using the provided data. Considering this responsibility, any liability related to access to a certain email address and/or data rests solely with the applicant who registered the email address and provided the data.

Applicants for medical services guarantee that, when using the services, they have legally obtained the consent of the individuals in question for the processing of the personal data provided or made available by them in relation to the use of the services.

Within the service and in managing personal data related to it, the legal basis may be: the voluntary consent of the applicants for medical services, the legitimate interest of the data controller, and the guarantee of the fundamental rights to information and expression of opinion within the limits established by law.

Data Controller

Full Name: Invitro Diagnostics SRL
Address: Republic of Moldova, Chișinău, Nicolae Testemițanu Street, 19/1, MD-2025
Executive Director: Marin BĂLĂNUȚĂ
E-mail: [email protected]
Phone: +373 22 903 999
Website: www.invitro.md

Declaration of Consent for the Processing of My Personal Data

I voluntarily and explicitly consent to the processing of my data provided when visiting, subscribing, or registering on the electronic platforms of Invitro Diagnostics: www.invitro.md, Facebook ads, Google Ads.

By registering my data, I declare that I am over the age of 18 and have full legal capacity. I am a representative of a legal entity or another organization without legal personality and I am authorized, mandated by the person or organization to give consent for the processing and management of data as described in this information.

I declare that at the time of registration and afterwards, I will not provide Invitro Diagnostics with any data that reveals a person’s racial or ethnic origin, political, religious or philosophical beliefs, social affiliation, health or sexual life, or information related to criminal convictions, coercive procedural measures, or administrative sanctions.

By giving this consent, I acknowledge that Invitro Diagnostics is entitled to contact me by phone and send me letters via email and/or regular mail, including invitations to events related to its field of activity.

My consent for data processing may be withdrawn at any time via the methods specified herein, for example, by sending a request to [email protected].

Legal Basis Based on Legitimate Interest

If you provide us with your data by filling in the form and show interest in Invitro Diagnostics, we will interpret this as a sign of initiating civil service provision relationships. In this case, the legal basis for processing your data, in accordance with the GDPR and the relevant national legislation of the Republic of Moldova, will be legitimate interest, and in some specific cases, for statistical, historical, or scientific research purposes, provided that personal data remains anonymous throughout and after the processing.
Due to this change in legal basis, the method of processing your data does not change; it only means that if, during the contract preparation phase, you do not request to terminate the procedure, your data will continue to be processed for the preparation of the contract.

Contractual Legal Basis

If you request services from Invitro Diagnostics, it will be done in accordance with the applicable civil legislation. In this case, under the GDPR and the national legislation of the Republic of Moldova, the legal basis for data processing will be the contract.
Due to this change in legal basis, the data processing method does not change; it only means that for the duration of the contract, withdrawal of consent for the use of the free version will have no effect, and your data will continue to be processed for the purpose of fulfilling the contract.

Once the contract is fulfilled or terminated, the legal basis for processing your data changes again, and processing will be based on legal provisions.

Following the Execution or Termination of the Contract, Based on Legal Provisions

With regard to data included in invoices, we are legally obliged to continue processing your personal data in accordance with legal requirements.

Your Rights

Below you will find your rights. According to the GDPR and national legislation, if you contact us regarding these rights, we are required to respond within a maximum of one month. However, we aim to respond as soon as possible.

Right to Information

You can request that we inform you about your personal data processed by us. You may also request access to this data.

You have the right to request information at any time by sending a registered letter with acknowledgment of receipt to our address, or by sending an email to [email protected].
The information request via letter will only be honored if you can be clearly identified based on the request.

The information request via email will only be considered if it is sent from your registered email address; however, this does not exclude the possibility that we may verify your identity by other means before fulfilling the request.

Your request may refer to: the data we process, its source, the purpose, legal basis, duration of processing, names and addresses of potential operators, data processing activities, and, in the case of transfers, details about the recipients and purposes of the data transmission.

Right of Access

If you request to know whether your data is being processed, and the answer is affirmative, you will receive access to the processing purpose, data categories, recipients, processing duration, your rights, legal remedies, data sources, automated decisions, and international data transfers.

Right to Rectification

At any time, you may request the correction or modification of your personal data via registered letter or email to [email protected].
You may also request the completion of incomplete personal data, considering the purpose of processing.

Right to Be Forgotten (Right to Erasure)

You may request the deletion of your personal data processed by us. A deletion request may be denied (i) for the exercise of freedom of expression and information, or (ii) if the processing is in the public interest (justified by law), or (iii) for legitimate private interest (e.g., the establishment, exercise, or defense of legal claims).

Rejection of a deletion request will be communicated along with the reasoning. Once your data is deleted, it cannot be restored.

You may unsubscribe from newsletters using the link included in their content.

Right to Restrict Processing

If you have doubts about the accuracy of your personal data, you may request restriction of processing. In such a case, restriction applies for the period required to verify the accuracy of your data.

If you challenge the correctness of the data, we will mark it accordingly. However, if the inaccuracy cannot be confirmed with certainty, we will not act.

You may also request data restriction if the processing is unlawful, but you oppose deletion and instead request limited use.

This right may also be exercised if the purpose of the processing has been fulfilled but you wish to continue processing for the establishment, exercise, or defense of legal claims.

If you object to processing, we will restrict your data until it is determined whether the controller’s legal grounds override yours.

Right to Data Portability

You may request the transfer of your personal data, processed automatically, to you or another operator in a commonly used, structured format supported by Invitro Diagnostics software (XML/XLS/CSV).

Right to Object

You may object to the processing of your personal data if:
(i) the processing is necessary solely for fulfilling our legal obligations or exercising our legitimate interest;
(ii) the purpose is direct marketing, surveys, or scientific research;
(iii) the purpose is the performance of a task carried out in the public interest.

We will assess the legality of your objection and, if it is well-founded, cease processing, block the data, and inform relevant parties of the objection and the measures taken.

Purpose of Data Processing

Protection of your rights.
Identifying you and maintaining contact with you.
Verifying your legal entitlements.
Personalizing the system and marketing messages sent to you. Ensuring relevant messages based on your interests and decision-making goals — especially if you have additional targeting preferences.
Customer support.
Consultancy.
Presentation of services.
Responding to inquiries.
Compiling statistics, conducting analysis, and preparing decisions — to guide the development of content and products that are actually read.
Product development.
Delivering services, ensuring their quality, and maintaining safety conditions as outlined in the general terms of service.
Fulfilling our legal obligations.
Exercising our legitimate interests.

Invitro Diagnostics is considered the data controller for its clients in relation to employees and the website (registration, login, newsletter, cookies).

Processed Data

We process only the data you provide — data that is relevant and genuinely managed by you:

Name
Email
Phone number
Home address (for home visits)
Legal or postal billing address (for legal entities)

We record certain data for security reasons:

Pages/features viewed
IP address
Browser cookies

We build a marketing profile:

What problems are you trying to solve? Why do you need these services?
What are your main decision-making goals?

The profile is based on the data you provide. Our goal is to send messages that are truly interesting and relevant. We also dislike receiving impersonal or irrelevant messages.

Call History

Call metadata (who–when–with whom)
Incoming calls to our central number are recorded for security purposes after an automatic message. In case of complaints, company management may randomly review selected calls to improve client communication during team coaching.

Website Analytics

We inform you that to track visitors on our website www.invitro.md, analyze their behavior, generate statistics, and measure ad performance, we use:

Google Analytics
Google Remarketing
Google Ads Conversion Tracking
Facebook Remarketing

These programs place cookies in your browser that collect data about individual users. By accessing www.invitro.md, you consent to the use of Google Analytics, Google Remarketing, Google Ads Conversion Tracking, and Facebook Remarketing, including the tracking and analysis of your behavior and use of all features offered by these tools.

You can disable cookies at any time via your browser settings, as explained below. These tools are configured to comply with the requirements of data protection authorities.

Google Analytics

Invitro Diagnostics primarily uses Google Analytics for statistical purposes, including evaluating campaign effectiveness. The tool collects information about the number of visitors and the time spent on the site. It identifies your IP address to determine whether you're a new or returning visitor and tracks activity on specific fields or pages.

Google Remarketing

In addition to standard data, Google Remarketing collects DoubleClick cookies. These cookies enable remarketing services, ensuring that visitors of Invitro Diagnostics see its ads again on other platforms. Ads are published across the internet through external providers like Google.
Invitro Diagnostics and third-party providers (e.g., Google) use first-party cookies (Google Analytics) and third-party cookies (DoubleClick) to tailor and optimize ads based on previous visits.

Google Ads (AdWords Conversion Tracking)

This tool helps Invitro Diagnostics measure the effectiveness of its Ads campaigns using cookies stored for 30 days on the user's device.

Facebook Remarketing

We use the Facebook remarketing pixel to increase ad efficiency and create remarketing lists. After visiting our site, third parties like Facebook may show you Invitro Diagnostics ads.
These lists cannot identify individuals and do not contain personal data — they only identify browser software.

Blocking Cookies

You can manage or block cookies through your browser’s settings. Typically found under:
Tools > Settings > Privacy

If you do not want Google Analytics to generate reports on your visits, you can download the Google Analytics Opt-out Browser Add-on. This prevents the tool’s JavaScript from sending information to Google. If installed, you will also be excluded from content experiments.

To block Google Analytics, visit the Google Analytics opt-out page and download the browser extension. For help with installation or removal, consult your browser’s Help menu.

Principles of Data Processing

The Operator processes personal data in accordance with the principles of good faith and transparency, as well as with current legal provisions and those contained in this notice.
Personal data necessary for the use of services will be processed exclusively based on the explicit consent of medical service applicants and only for the defined purpose.
The Operator will process personal data strictly for the purposes stated in this notice and applicable legislation. The scope of personal data is proportional to the purpose and does not exceed it (data minimization).
Invitro Diagnostics does not process data of individuals under the age of 18 as a service provider.
Except for the external providers and operators mentioned herein, the Operator does not transmit processed personal data to third parties. Exceptions include anonymized statistical data, which cannot identify medical service applicants and are therefore not considered personal data processing or data transfer.
In certain cases — such as requests from courts or investigative authorities due to copyright infringement, financial disputes, or violations of the Operator’s interests — personal data may be provided to third parties if credible evidence justifies it.
The Operator may collect activity data from users that cannot be linked to registration data or other web services.
The Operator will inform medical service applicants and third parties to whom personal data was transferred about any corrections, limitations, or deletions of such data — unless this notification would violate the data subjects’ rights or the purpose of processing.
The Operator ensures the safety of personal data through technical and organizational measures that prevent accidental loss, deletion, unauthorized access, use, modification, or transfer. This obligation also applies to third-party recipients of the data.
According to the GDPR, the Operator is not obligated to appoint a Data Protection Officer.
Responsibility for compliance with principles lies with the Operator.

Confidentiality of Processing

Data collected by Invitro Diagnostics is processed confidentially. All necessary steps are taken to ensure data security, and processing is limited to the operational needs of the website, including sending emails or SMS to the contact details you provided, via telecommunications providers.

Invitro Diagnostics will never sell or lend your personal data for third-party marketing purposes. If legally required by subpoena, court order, or legal proceedings, Invitro Diagnostics will provide relevant personal data in strict accordance with applicable legislation.

Invitro Diagnostics also reserves the right to assert and defend its legal rights before courts.

For secure data processing, Invitro Diagnostics selects IT systems in such a way that data remains accessible only to authorized personnel, preserves authenticity, and prevents unauthorized modifications or access.

If requested by authorities or required by law, Invitro Diagnostics may transfer data and will notify users via newsletter, provided the notification does not contradict legal or judicial restrictions.

Employee Access to Personal Data

Our employees are granted access only to personal data necessary for fulfilling their job responsibilities. All accesses are logged, and permissions to export or save data are highly restricted.

Data Retention Period

Under GDPR and national laws, data is retained for defined periods based on data categories.

As a rule:

Detailed security logs are retained for at least 90 days.
Other logs are stored for a minimum of 365 days.
Personal data is kept for at least 365 days after the last interaction, unless longer periods are required by law or contract.

For specific details on certain data categories, purposes, and retention periods, refer to the chapter “Our Services.”

Data Transfers

We are legally obliged to transfer all personal data stored by us to competent authorities upon lawful request or final legal decision. We are not liable for the consequences of such legally mandated transfers.

If the operation or management of our services is partially or fully assigned to a third party, we may transfer your stored personal data — with prior notice but without your explicit consent — ensuring that your rights remain equal to those outlined in this notice. You will be given the opportunity to object to the transfer. If you object, the transfer will not occur.

To ensure lawful data transfers and inform affected individuals, the Operator maintains a transfer registry including: date, legal basis, recipient, categories of personal data, and any other details as required by law.

Updating Information and Legal Compliance

This notice is regularly reviewed and updated in accordance with legal changes and authority requests. The latest version is always available in the “Terms and Conditions” section of the Invitro Diagnostics website.

Definitions

Data processing: Any operation involving personal data, regardless of method, including collection, recording, structuring, segmentation, storage, transformation, alteration, use, querying, display, communication, transfer, restriction, deletion, or destruction.
Personal data or data: Any information through which a natural person is — directly or indirectly — identifiable or submits such data into the system.
Data processor: A service provider that processes personal data on behalf of the controller. For the systems mentioned in this document, the data processor is Invitro Diagnostics SRL.
GDPR: General Data Protection Regulation (Regulation (EU) 2016/679), effective from May 25, 2018, as adopted by the European Commission, and national law No. 133 of July 8, 2011, of the Republic of Moldova on personal data protection, and Government Decision No. 1123 of December 14, 2010.

Republic of Moldova, Chișinău, 2023

Notification

Add services