Privacy notice for patients and clients

Who is responsible for your data

The controller of your personal data is the establishment you book with. It determines why and how your data is used in connection with the requested appointment and the provision of the service.

The processor is the platform provider — SYNTOPIA EOOD, UIC 208876257, Varna 9000, Chayka district, bl. 9, ent. B, fl. 3, apt. 25, Bulgaria. We process your data on behalf of the establishment and under its documented instructions, on the basis of a data processing agreement.

For questions about the booking itself, the service or exercising your data rights, please contact the establishment you booked with. For technical questions about the platform you can write to privacy@tochnow.com.

What data is processed when you book

When you book an appointment through the booking page, the following data is typically processed:

• name — to identify you at the visit;
• phone number — to contact you about the appointment;
• email address — for confirmation, changes, cancellation and appointment reminders;
• booking details — date, time, selected service and specialist, where applicable;
• a short contact note, if the form allows one and you choose to fill it in.

The note field is not intended for health or medical information. Please do not enter data about your health condition, diagnoses, symptoms, complaints or other sensitive information. If needed, discuss these matters directly with the specialist during your visit.

The public booking form does not collect date of birth, national identification number or card details, unless the specific form explicitly states otherwise.

On what legal basis

The establishment processes your data in order to manage the requested appointment and provide the service you asked for — Art. 6(1)(b) GDPR.

Where the booking is in a healthcare context — for example at a dental, medical, physiotherapy or similar practice — the mere fact of booking or the type of the selected service may reveal health information. In those cases the establishment processes the data under its own responsibility on the basis of Art. 9(2)(h) GDPR — for the purposes of the provision of health care or the management of health services.

This is not consent-based processing and does not require a separate consent checkbox in the booking form.

How the data is protected

TochNow applies technical and organisational measures to protect the data, including encryption, access restrictions, technical event logging and encrypted connections for data in transit.

The Provider's access to your data is technically restricted:

• name and email address — technically readable by the Provider so that the platform can send, on behalf of the establishment, emails related to your booking, such as confirmation, changes, cancellation and reminders;
• phone number — stored by default in a way that the Provider has no technical ability to read it. If the establishment has enabled SMS reminders, the Provider separately processes a technically readable copy solely to send service SMS reminders about the booking. Every SMS contains a link to opt out of future SMS reminders;
• contact notes — encrypted to the establishment; the Provider has no technical ability to read them.

More information about the security measures is available in the platform's Privacy Policy.

SMS reminders

If the establishment has enabled SMS reminders, your phone number may be used to send a service SMS reminder about the booked appointment.

SMS reminders relate to the booking and are not used for marketing. The SMS must not contain a diagnosis, treatment, reason for the visit or free-text medical information.

You can opt out of future SMS reminders via the link in every SMS. Opting out does not cancel the booking and does not prevent the establishment from contacting you in another necessary way in connection with the requested appointment.

How long the data is kept

Booking data is kept in line with the periods set out in the Privacy Policy and the agreed service settings.

Working period for the current version: booking data is kept for up to 2 years from your last booking with the respective establishment, after which it is deleted or anonymised, unless a shorter period, a technical archive/backup period, a security incident, a legal dispute or a legal obligation applies.

TochNow stores appointment booking data, not medical records. Establishments carrying out healthcare activities keep and store medical documentation in their own systems in line with the applicable statutory periods. TochNow is not a medical record.

Your rights

As a data subject you have the rights under Art. 15–22 GDPR, including the right of access, rectification, erasure, restriction of processing, portability and objection, where applicable.

You exercise your rights through the establishment you booked with, because it is the controller of your data. Contact it using the details published on its booking page. TochNow assists the establishment in fulfilling your requests where necessary.

You also have the right to lodge a complaint with the supervisory authority:

Commission for Personal Data Protection (CPDP), Bulgaria
Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
Phone for complaints, reports and questions: +359 2 915 3519
www.cpdp.bg · kzld@cpdp.bg

Managing your booking via the link in the email

The emails about your booking may contain a personal link for managing the booked appointment. It is time-limited and gives access only to managing that booking, for example viewing, changing or cancelling it.

Do not forward this link to third parties. Anyone with access to the link can act on the respective booking within the settings allowed by the establishment.

Contacting the Provider

For questions to SYNTOPIA EOOD in its capacity as processor:

• Data protection email: privacy@tochnow.com
• General enquiries email: office@tochnow.com
• Phone: +359 878 869 085
• Postal address: Varna 9000, Chayka district, bl. 9, ent. B, fl. 3, apt. 25, Bulgaria

To exercise your GDPR rights, first contact the establishment you booked with — it is the controller of your personal data.