Privacy Policy – ExploreYourDoc Pro

Information on the processing of your personal data under Law No. 06/L-082 on the Protection of Personal Data

Last updated: 10.10.2026

The protection of your personal data is of particular importance to us. We therefore process your data exclusively on the basis of the statutory provisions, in particular Law No. 06/L-082 on the Protection of Personal Data of the Republic of Kosovo (Ligji Nr. 06/L-082 për Mbrojtjen e të Dhënave Personale). Where applicable, the EU General Data Protection Regulation (GDPR) applies in addition. In this Privacy Policy we inform you about the most important aspects of data processing in connection with the practice software ExploreYourDoc Pro, which is offered under the domains pro.shendetesia.com, pro.shendeti.online, proapp.shendetesia.com and proapp.shendeti.online.

The Albanian version of this Privacy Policy is the authoritative version.

1. Controller

Director: Lorian Atashi Commercial register number (Firmenbuch): FN 644542g Phone: +383 45 630 928 E-mail: [email protected]

2. Collection and processing of personal data

2.1 Data collected during registration

When you register as a provider on our platform, we collect the following data:

• Title, first and last name
• E-mail address
• Phone number
• Specialty and professional licence number
• Practice address (street, postal code, city)

2.1a Verification documents

To verify your eligibility, you upload the following documents during registration:

• Professional licence or registration confirmation from the competent professional chamber
• Authorisation to operate the practice or confirmation from the competent authority
• Photo ID (passport or identity card)

The uploaded documents are stored encrypted and used exclusively for verifying your identity and professional eligibility. After successful verification, the documents are deleted no later than 90 days. If the registration is rejected, they are deleted immediately.

2.2 Data processed when using the platform

When you use our platform, we process:

• Profile information and practice data
• Appointment data and booking information
• Communication data (e-mails, messages)
• Usage data and log data

2.3 Technical data

Each time you access our platform, the following data is recorded automatically:

• IP address (anonymised)
• Date and time of access
• Browser type and version
• Operating system
• Referrer URL

2.4 Testing the AI assistants

On our websites (pro.shendetesia.com, pro.shendeti.online), visitors can test our AI assistants – in the browser (voice chat) or by phone call. For this, you provide the URL of your practice website; for the call demo, also your mobile number. A demo assistant is created from publicly accessible website content. Conversations may be recorded and analysed to improve quality.

Data processed:

• Practice website URL and practice information derived from it
• Phone number (for the call demo)
• IP address and technical connection data
• Voice and chat content during the test conversation

Processors include: ElevenLabs (voice AI), Twilio (telephony), HubSpot (CRM, see section 2.5). Data may be transferred outside the Republic of Kosovo (e.g. to the USA); appropriate safeguards (e.g. standard contractual clauses) are used.

Please do not share any particularly sensitive categories of personal data (e.g. health data) during the test conversation. Use is voluntary – without the demo, this processing does not take place.

2.5 Follow-up contact after the demo

By using the demo, you confirm that we may contact you afterwards to follow up on your demo experience – for example regarding technical issues, open setup questions or feedback on the test.

Data processed:

• Phone number (for the call demo)
• Practice website and derived practice name
• Information on demo usage

To prepare and track the follow-up, we also store this information in our CRM (HubSpot, EU data centre). For details see section 4.5.

You may object to being contacted at any time – e.g. by e-mail to [email protected].

3. Processing of health data

Important notice on health data

Health data is sensitive personal data within the meaning of Law No. 06/L-082 and is subject to enhanced protection. ExploreYourDoc processes extensive health data in connection with the electronic patient record.

3.1 Role of ExploreYourDoc

ExploreYourDoc e.U. processes patient data (including health data) exclusively as a processor on behalf of the registered medical institutions (controllers). Responsibility for the lawfulness of the data processing lies with the respective provider (the practice).

3.2 Electronic patient record

The following categories of data are processed in the electronic patient record:

• Master data: name, date of birth, address, contact details, personal identification number
• Insurance data: health insurance, insurance number, insurance status (where available)
• Medical data: diagnoses (ICD codes), medical history, findings, course of treatment
• Documentation: medical letters, laboratory results, image files (X-rays, etc.)
• Prescriptions: medications, dosages, prescription history
• Billing data: services, fees, payment history

Retention period: The retention period of the medical documentation is determined by the practice as controller in accordance with the retention obligations under the health legislation applicable in the Republic of Kosovo.

3.3 Data processing agreement

With every provider that processes patient data via our platform, ExploreYourDoc e.U. concludes a data processing agreement under Law No. 06/L-082. It governs:

• Subject matter and duration of the processing
• Nature and purpose of the processing
• Type of personal data
• Categories of data subjects
• Rights and obligations of the controller
• Technical and organisational measures
• Use of sub-processors

3.4 Technical and organisational measures

To protect health data, we apply the following measures:

• Encryption of data in transit (TLS 1.3)
• Encryption of stored data (AES-256)
• Two-factor authentication for privileged user roles (owners, managers, doctors)
• Role-based access control
• Complete logging of all data access (audit log)
• Automatic session timeouts
• Hosting exclusively in EU data centres (ISO 27001, SOC 2 certified)
• Geo-redundant backups with daily backup

4. Use of third-party providers

4.1 RaiAccept – Raiffeisen Bank Kosovo (payment processing)

4.2 Twilio (communication, telephony, video)

Provider: Twilio Inc., San Francisco, CA, USA

Purpose: SMS appointment reminders and confirmations, transactional e-mails (SendGrid), video consultations between practice and patient, optional AI phone assistant for scheduling appointments

Data processed: phone number, e-mail address, name, appointment details; for video: audio/video transmission (encrypted); for AI phone: voice recording and transcript only to the extent required for the function

Transfer outside Kosovo: USA – with appropriate safeguards (e.g. standard contractual clauses)

Privacy: twilio.com/legal/privacy

4.3 Google Firebase (push notifications)

Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland

Purpose: push notifications in mobile applications (if used)

Data processed: device token, notification metadata (no medical content)

Privacy: policies.google.com/privacy

4.4 Hosting and infrastructure

Vercel

Provider: Vercel Inc., Walnut, CA, USA Region: edge network with EU regions (primarily Frankfurt) Transfer outside Kosovo: with appropriate safeguards (e.g. standard contractual clauses) Privacy: vercel.com/legal/privacy-policy

MongoDB Atlas

Provider: MongoDB Inc., New York, USA Region: EU (Frankfurt, Germany) Certifications: ISO 27001, SOC 2 Type II, HIPAA-ready Encryption: AES-256 (at rest), TLS 1.3 (in transit) Privacy: mongodb.com/legal/privacy-policy

Amazon Web Services (AWS)

Provider: Amazon Web Services, Inc., Seattle, USA Region: EU (Frankfurt, Germany) Certifications: SOC 2 Type II, ISO 27001, ISO 27018, C5 Function: backend servers (API), document storage (Amazon S3) Privacy: aws.amazon.com/privacy

4.5 HubSpot (CRM / demo follow-up)

Note on data location: All personal data, in particular patient records and health data, is stored exclusively in EU data centres (Frankfurt, Germany). This constitutes a transfer outside the Republic of Kosovo, which takes place with appropriate safeguards (see section 9). Patient data is not stored in countries outside the EU.

5. Cookies and tracking

5.1 Necessary cookies

We use technically necessary cookies that are required to operate the platform:

• Session cookies for authentication (access token, refresh token)
• Device recognition cookie for session management (deviceId, 1 year)

5.2 Cookie settings (local storage)

We store your selection in the cookie banner locally in your browser (localStorage under the key eyd-pro-cookie-consent) so that we can take your consent into account on future visits. No personal profiles are created in the process.

5.3 Vercel Analytics & Speed Insights

With your consent, we use Vercel Analytics and Vercel Speed Insights (Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA) to measure the use of our website and improve loading speed.

Data processed: page views, referrer, device and browser information, performance metrics (e.g. Core Web Vitals). Vercel Analytics sets no cookies; the scripts are only loaded after you have given your consent via our cookie banner.

Transfer outside Kosovo: USA – with appropriate safeguards (e.g. standard contractual clauses)

Privacy notice: vercel.com/legal/privacy-policy

6. Your rights

Under Law No. 06/L-082 you have, in principle, the following rights:

• Right of access: you can request information about your personal data being processed.
• Right to rectification: you can request the correction of inaccurate data or the completion of your data.
• Right to erasure: you can request the deletion of your data unless statutory retention obligations prevent this.
• Right to restriction: you can request the restriction of the processing of your data.
• Right to data portability: you can receive your data in a structured, commonly used format.
• Right to object: you can object to the processing of your data.
• Withdrawal of consent: you can withdraw consent you have given at any time with effect for the future.

To exercise your rights, please contact: [email protected]

7. Data security

We apply extensive technical and organisational security measures to protect your data against unauthorised access, loss or destruction:

• SSL/TLS encryption of all data transmissions
• Encrypted data storage
• Two-factor authentication
• Regular security updates
• Access control according to the principle of least privilege

8. Retention period

We store your personal data only for as long as necessary to fulfil the purposes of processing or as required by statutory retention periods:

• Contract data: 7 years after the end of the contract (tax and accounting retention obligations)
• Invoice data: 7 years (tax and accounting retention obligations)
• User account: until deleted by the user or until the end of the contract
• Log data: 12 months
• Verification documents: no later than 90 days after successful verification; immediately if rejected

After the retention period expires, the data is deleted or anonymised.

9. Transfer of data outside the Republic of Kosovo

Our infrastructure is hosted in EU data centres (AWS, MongoDB Atlas). In addition, we use service providers based in the USA (Twilio/SendGrid, Vercel). Payments via RaiAccept are processed by Raiffeisen Bank Kosovo; this may involve processing within the Raiffeisen Bank International group in the EU. Personal data is therefore transferred outside the Republic of Kosovo.

Such a transfer only takes place if:

• the recipient country ensures an adequate level of data protection, or
• appropriate safeguards are in place, in particular standard contractual clauses, or
• another legal basis permitted under Law No. 06/L-082 applies.

10. Right to lodge a complaint

You have the right to lodge a complaint with the competent data protection supervisory authority:

Agjencia për Informim dhe Privatësi (AIP) – Information and Privacy Agency Prishtinë, Republic of Kosovo Website: aip.rks-gov.net

11. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy as necessary to adapt it to changes in the legal situation or to changes in our services. You can always find the current version on this page. We will inform you separately of any material changes.

Contact

If you have questions about data protection or wish to exercise your rights, please contact:

Phone: +383 45 630 928 E-mail: [email protected]