Privacy Policy

I. General Information

This Privacy Policy has been compiled by DERMANETA DOOEL Skopje, in order to provide clear and transparent information about how the personal data of users who access and use telemedicine services through the digital platform dermaneta.com is collected, processed, stored and shared. DERMANETA DOOEL Skopje acts as the Controller of personal data in accordance with the Law on Personal Data Protection of the Republic of North Macedonia.

II. Definitions of Key Terms

Within the framework of this Privacy Policy, the following terms have meanings according to their legal and factual function in the telemedicine system and the law:

“Doctor - Person for medical consultations” means a healthcare professional who is registered in the appropriate register of healthcare professionals and who holds a valid work license issued by the competent health chamber. This person is qualified and has relevant professional experience in the specific medical field from which he or she provides expert advice. The doctor provides advisory health services exclusively through the Platform, in accordance with the Law on Health Care and the by-laws on telemedicine.

“Personal Data Subject” refers to a natural person who voluntarily and with consent enters their personal and health data through an electronic questionnaire available on the Platform for the purpose of receiving telemedical advice from a Doctor - Medical Consultation Person, for a certain fee. By accepting the terms of use and this Privacy Policy, the Subject consents to the processing of their data in accordance with applicable laws.

“Platform Administrator” is the legal entity DERMANETA DOOEL Skopje, owner and manager of the Platform dermaneta.com, which acts as the Controller of personal data in accordance with the Law on Personal Data Protection. The Administrator, independently or through authorized persons, ensures the smooth functioning of the Platform, technical support, profile management, and mediation between users and doctors through digital data exchange, including through electronic payment for the use of telemedicine services.

“Telemedicine Services” refer to advisory activities carried out by a Doctor - Medical Consultation Person within the framework of the health treatment of the users of the Platform. These services include online communication, exchange of medical information, images, opinions and recommendations that aim to improve the health information, monitoring, diagnostic thinking and general health care of the user. Telemedicine services are not a substitute for a physical examination, but represent an additional channel of medical support, enabled through the Platform under the management of the Administrator.

III. Information About the Data Controller

The controller of personal data, i.e. the legal entity that processes personal data during registration and use of the Platform's services, is the Consulting and Services Company DERMANETA DOOEL Skopje, with its registered office at ul. “Shidska” no. 26 / 6-3 in Skopje – Gjorge Petrov, Republic of North Macedonia, EMBS: 7946660. DERMANETA DOOEL Skopje, as Platform Administrator dermaneta.com, acts as the Controller of personal data in accordance with the Law on Personal Data Protection and is responsible for providing technical and organizational measures for their protection.

Additionally, the doctor – Persons for medical consultations who is registered and engaged on the Platform, processes personal data of users that they voluntarily submit within the framework of performing a medical consultation. The doctor acts as an independent controller of the data in relation to the information available to him during the consultation.

IV. Purpose and Legal Basis of the Processing

The processing of personal data by the Platform Administrator is carried out with the sole purpose of enabling functional, safe and legally compliant use of telemedicine services through the DERMANETA DOOEL Skopje platform.

Specifically, the purpose of the processing includes mediating in the provision of medical information and advisory health services by a licensed health professional, enabling technical and administrative access to the platform, managing user profiles, supporting communication and consultation.

The legal basis for the processing of personal data by DERMANETA DOOEL Skopje is the fulfillment of the agreed obligations arising from the legal relationship established by the use of the Platform by the subjects of personal data, in accordance with the Law on Personal Data Protection of the Republic of Macedonia.

In addition, the medical data that users voluntarily submit to the Doctor - Persons for medical consultations, are processed exclusively for the purpose of providing the service for which the user has consented and submitted a request, i.e. for the purpose of providing counseling within the framework of health treatment. This processing is in accordance with the Law on Personal Data Protection of the Republic of Macedonia, which allows the processing of special category data within the framework of healthcare.

The Doctor – Person for medical consultations is obliged to apply all prescribed technical and organizational measures for the protection of personal data. These measures include, but are not limited to: limiting access only to authorized persons through authentication with individual passwords, use of antivirus and security software equipment. The detailed obligations of the doctors are regulated by an individual agreement with DERMANETA DOOEL Skopje.

V. Collection of Personal Data

Within the framework of the registration and use of the services offered through the Platform, DERMANETA DOOEL Skopje collects, processes and stores personal data and images that are necessary to fulfill the purposes set out in this Policy. The data collected during the registration of a user profile include: name and surname, email address, telephone number, gender, date of birth and password. These data are necessary for identification, communication and enabling access to the platform and services.

During the use of telemedicine services, especially during consultations with a doctor, users may voluntarily submit health data, including information about symptoms, previous diagnoses, images, laboratory results, and other medical documents relevant to the consultation. This data is processed by the Doctor - Person for medical consultations exclusively for the purpose of performing the medical advisory service within the framework of healthcare.

The Platform, through automated technical processes, also collects technical data for each access to the system, such as: IP address, device type and model, browser type, operating system, date and time of access, as well as activity logs. This information is used for security, technical and analytical purposes, in order to maintain the stability, security and functionality of the Platform.

Additionally, during the course of conducting the health consultation, the doctor may collect other relevant data in a form that the nature of the service allows (verbally via video call, in writing via a form, or electronically via attached documents and images). The processing of this health data is carried out based on the user's request and consent.

By way of exception, and only if necessary for the purpose of handling a formally filed complaint or legal proceedings related to a service provided, the Platform Administrator may obtain limited access to health data that were initially provided directly to the Doctor. In such cases, the processing is carried out solely on the basis of the explicit consent of the data subject or on the basis of a legal obligation, and is subject to the principles of minimization, confidentiality and necessity.

VI. Financial Data

DERMANETA DOOEL Skopje, as the Administrator of the Platform, does not process, store or have access to data related to payment cards or bank accounts of users. All payments made for the use of telemedicine services available through the Platform are processed exclusively through authorized and licensed financial institutions – payment processors.

During the payment procedure, personal data subjects voluntarily enter payment card or bank account data directly on the authorized payment processor's interface. DERMANETA DOOEL Skopje does not store, has no insight into, and does not perform any further processing of this data. It is not available to a doctor or who is involved in conducting medical consultations.

Authorized payment processors with which DERMANETA DOOEL Skopje cooperates are obliged to apply the highest standards for the protection of personal and financial data, including PCI-DSS standards for card payment security, data encryption, protection against unauthorized access and real-time access controls. The administrator, through the cooperation agreement, ensures that all legal and technical obligations of financial institutions are in accordance with the applicable regulations of the Republic of North Macedonia.

VII. Data Sharing

Only DERMANETA DOOEL Skopje has access to the data, and it is shared only with the doctor who is directly involved in providing the service, according to strictly defined criteria and in accordance with personal data protection regulations. Sharing data with state institutions is permitted only based on a court order or other legal obligation.

VIII. Data Security with IT

DERMANETA DOOEL Skopje applies appropriate technical and organizational measures to protect personal data from unauthorized access, misuse, loss or unauthorized disclosure. These measures include, but are not limited to, the use of SSL encryption for data transmission, the implementation of two-factor authentication for access to administrator profiles, limiting access to personal data only to authorized persons, protection of servers through firewall systems, as well as regular security checks, updates and testing of the platform.

Although DERMANETA DOOEL Skopje makes every effort to ensure a high level of security in accordance with industry standards and legal regulations, users are informed that no technical or organizational measure, nor any electronic communication or storage system, can guarantee absolute security.

In this sense, the Administrator does not assume responsibility for damages that may arise as a result of a security incident beyond its reasonable control or arising as a result of actions of third parties, malicious software or technological weaknesses that could not have been foreseen or prevented by standard means.

IX. Data Storage Period

Personal data collected and processed through the Platform are stored in accordance with the purposes for which they were collected and in accordance with the User's health condition. Data related to a specific medical consultation, including health information, attached medical documents, images and communication with the doctor, are stored depending on the User's health condition.

Exclusively for administrative and evidentiary purposes, the following basic information is retained: user's name and surname, email address, telephone number, type of consultation, date and time of the consultation, status of the consultation, as well as technical activity logs. This data is kept for a maximum of five years from the date of the last consultation.

After the expiration of the retention period, all data is automatically and irreversibly deleted from the system, unless there is a legal obligation for their further storage or a legitimate interest of a party in pursuing legal proceedings in accordance with applicable regulations.

X. Rights of Personal Data Subjects

Every user has the right to access their personal data, the right to correct inaccurate or incomplete data.

X.1. Rights of Personal Data Subjects

Every user who appears as a subject of personal data has the right, in accordance with the Law on Personal Data Protection, to exercise the following rights regarding the processing of their data:

Right of access: The user has the right to obtain confirmation as to whether his or her personal data is being processed and access to information about the purpose of the processing, the categories of data, the recipients, the retention period, the existence of automated decision-making (including profiling), the source of the data and any possible transfer to third countries.

Right to rectification: The user has the right to request correction or completion of inaccurate, incomplete or outdated personal data relating to him.

XI. Log Documents and Cookies – IT Consultation

Cookies and other technical means are used to improve the functionality of the platform, monitor performance and analyze usage. This data is not used for profiling and can be managed through your browser settings.

XII. Business Transitions

In the event of a change in ownership or company structure, personal data may be transferred to a new entity provided that all user rights and obligations under this policy are respected.

XIII. Changes to the Privacy Policy

Any policy changes will be posted on the platform, and users will be notified electronically. The new changes come into force from the moment of their publication.

XIV. Agreed Local Jurisdiction

The Basic Civil Court Skopje in Skopje, Republic of North Macedonia is competent for all disputes arising from or related to the application of this Policy.

For questions related to the privacy policy for the processing of personal data, you can contact: dermanetainfo@gmail.com

For questions related to privacy policy, please contact: dermanetainfo@gmail.com