1. Who We Are

The data controller for this website is Dr. Vitaliy Sarancha, a medical practitioner operating in Zagreb, Croatia. Contact: [email protected]. Website: sarancha.com.

This Privacy Policy applies to all personal data collected through sarancha.com and its language versions (/hr/, /ru/, /uk/). Processing of personal data is carried out in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Croatian data protection legislation.

2. What Data We Collect and Why

Contact and consultation booking forms: When you submit a consultation request or contact form, we collect your name, email address, phone number (optional), and the content of your message. This data is used solely to respond to your enquiry and to schedule a consultation. Legal basis: Article 6(1)(b) GDPR — necessary for the performance of a contract or steps prior to entering into a contract.

Analytics: This website uses anonymised analytics tools (including Google Analytics) to understand visitor behaviour and improve site performance. Data collected includes pages visited, time on site, browser type, and approximate geographic location. No personally identifiable information is collected through analytics. Legal basis: Article 6(1)(f) GDPR — legitimate interests.

Technical data: Standard server logs may record your IP address, browser type, and access timestamps for security and operational purposes. Logs are retained for a maximum of 30 days. Legal basis: Article 6(1)(f) GDPR — legitimate interests.

3. How Long We Keep Your Data

Consultation booking data is retained for the duration of the therapeutic relationship and for a period of 5 years following its conclusion, in accordance with Croatian medical record retention requirements.

Contact form data not resulting in a consultation is deleted within 12 months of the initial contact.

Analytics data is retained in aggregated, anonymised form for up to 26 months.

4. Data Sharing and Third Parties

We do not sell, rent, or trade your personal data to any third party.

We may share data with the following categories of trusted service providers, who process data solely on our behalf and under binding data processing agreements: email service providers (for consultation confirmations); analytics service providers (Google Analytics — data is anonymised before processing); website hosting and technical infrastructure providers.

All third-party providers are contractually bound to process your data only in accordance with our instructions and in compliance with GDPR.

5. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights:

Right of access (Art. 15): You may request a copy of the personal data we hold about you. Right to rectification (Art. 16): You may request correction of inaccurate data. Right to erasure (Art. 17): You may request deletion of your personal data where no legal obligation to retain it exists. Right to restriction (Art. 18): You may request that processing be restricted in certain circumstances. Right to data portability (Art. 20): Where processing is based on consent or contract, you may request your data in a machine-readable format. Right to object (Art. 21): You may object to processing based on legitimate interests.

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days.

6. Cookies

This website uses cookies to ensure proper technical functioning and to collect anonymised analytics data. Strictly necessary cookies are used without requiring consent. Analytics cookies are set only with your consent, which you can manage through the cookie consent banner displayed on your first visit.

You may withdraw consent for analytics cookies at any time by clearing your browser cookies or adjusting your browser settings. Withdrawal of consent does not affect the lawfulness of processing based on consent before withdrawal.

7. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. All data is transmitted over encrypted connections (HTTPS). Access to personal data is restricted to authorised personnel only.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the Croatian Personal Data Protection Agency (AZOP) within 72 hours of becoming aware of the breach, and will inform affected individuals without undue delay where required by law.

8. Supervisory Authority

You have the right to lodge a complaint with the competent supervisory authority if you believe that processing of your personal data infringes GDPR. The competent supervisory authority for Croatia is:

Agencija za zaštitu osobnih podataka (AZOP)
Selska cesta 136, 10 000 Zagreb, Croatia
Tel: +385 1 4609 000
Email: [email protected]
Website: azop.hr

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The date of the most recent revision is shown at the top of this page. We encourage you to review this policy periodically.