Solutions · Medical clinics

AI consulting & training for medical clinics.

Choosing a starting point and preparing the team. This page places the service mechanics alongside the rules that apply in medical clinics — without claiming a project we have not done.

Discuss your scenario

Starting point

What medical clinics look like before any software

The reception desk is a triage point that is not allowed to do triage. The person on the phone decides, in thirty seconds, which speciality matches what the patient describes, whether a referral is needed, whether the service is covered and when the first free slot is. They do this for ten different schedules, each with its own days and rooms. All their work is a routing problem — and it is the only link in the clinic where clinical information appears without a medical act behind it.

In a clinic, two worlds live in parallel for the same service. The insured route goes through the family doctor, through a referral note and, for high-performance investigations, through an appointment in the national system. The paid route starts directly on the phone. The same investigation, the same equipment, two patients who reach it by completely different routes, with different documents and different deadlines. A services page that describes only one of the routes leaves half of the visitors without an answer.

The data flow that matters is not the appointment, it is the result. Analyses and investigation reports are produced after the visit and must reach the person. Each clinic solves this differently: by email, through the messaging channel from which the patient wrote, through a portal, or “come and collect it”. It is the only architecture decision that moves a document with a diagnosis outside the clinic, and usually it is the only one that nobody has made explicitly — it happened because it was the shortest path.

The service catalogue of a clinic is a coded object: each item has a code, a name, a unit of measure and a tariff, and the names are written in the language of the nomenclature, not in the language of the patient. On the website, this usually becomes a flattened list, without code and without unit. From this come two separate conversations — one on the phone about what the name means, the other at the cashier about why the amount is not the one on the page.

Many clinics record calls to the reception desk. The stated reason is quality, the mechanism is a checked function in the telephone exchange. But a recording in which a person describes their symptoms is health data in an audio file, kept in a system chosen by the telephony provider, not by the clinic, often without a deletion term and without anyone having written anywhere that this processing exists.

A statement and its sources

Regulile

What applies in medical clinics, with the article it comes from

Each rule below carries the normative act that imposes it. Verification does not require you to take our word for it.

Almost everything that passes through the clinic is a special category of data

The processing of health data is prohibited as a rule, and lawfulness comes from a specific exception, not from a general basis. The definition covers any data related to physical or mental health, including data resulting from the provision of healthcare services and revealing the person’s condition. In a clinic, this means the laboratory result, the investigation report, the referral, the reason for attendance noted at reception, and sometimes only the name of the speciality to which the patient is scheduled. Genetic data and biometric data used for unique identification have their own definition and fall under the same prohibition.

SourceLaw 195/2024, art. 9 para. (1), art. 4 (definitions of “health data”, “genetic data”, “biometric data”); Regulation (EU) 2016/679, art. 9 para. (1)

Access is granted in the amount necessary for the decision, not by role

Two rules say the same thing from different directions, and together they make the principle of least privilege a legal obligation, not a good practice. The exception allowing processing for diagnosis and treatment applies only when the data are processed by or under the responsibility of a professional subject to the duty of professional secrecy. And the disclosure of confidential information without the patient’s consent is permitted in order to involve other specialists in the curative process, but only to the extent necessary for making an appropriate decision. A system in which any medical staff account can see any record complies with neither of the two.

SourceLaw 195/2024, art. 9 para. (2) lit. h) and para. (3), art. 32 para. (1); Law 263/2005, art. 12 para. (2) and para. (4) lit. a)

A system cannot decide the patient’s clinical path on its own

The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly affects them to a significant extent. And decisions falling under the exceptions to this rule cannot be based on special categories of data unless the exception of explicit consent or that of substantial public interest applies, with appropriate safeguards in place. Even when an exception applies, the controller must ensure at least the right of the person to obtain human intervention, to express their point of view and to contest the decision. Concretely: a system can collect what the patient says and route them to a human; it cannot complete the question “what do you need?” on its own.

SourceLaw 195/2024, art. 22 para. (1), (3) and (4); art. 9 para. (2) lit. a) and g)

The laboratory, the switchboard, the online diary and the external call centre are all in the chain

Every provider that handles the data on behalf of the clinic is a processor and requires a written contract setting out the subject matter, duration, nature, purpose, type of data and categories of data subjects, with documented instructions, staff bound by confidentiality, a prohibition on subcontracting without authorisation, assistance with patients’ requests and deletion or return at the end. But if a partner determines the purposes and means together with the clinic — not merely executes them — they are joint controllers and need an agreement that transparently allocates responsibilities, the essence of which is brought to the patient’s attention. And if the provider stores data outside the European Economic Area, an adequacy decision or appropriate safeguards are needed, such as standard data protection clauses.

SourceLaw 195/2024, art. 28 para. (2)–(4) and (8); art. 26 para. (1)–(3); art. 44 para. (2); art. 46 para. (2) lit. c)

The impact assessment has a threshold, and the prior consultation has a deadline

The impact assessment is required especially for large-scale processing of special categories of data, for systematic and comprehensive evaluation based on automated processing that underpins decisions with significant effects, and for systematic large-scale monitoring of a publicly accessible area. “Large scale” is not a loose term: the European benchmark says that the data of a single doctor’s patients do not fall within it — a network of clinics, by contrast, arguably does and must be assessed. If the assessment shows a high risk that the clinic cannot mitigate, consultation with the Centre follows before processing, and the Centre responds within at most eight weeks, a period that may be extended by six. That is a duration to be built into a project plan, not discovered at the end.

SourceLaw 195/2024, art. 35 para. (1), (3) and (7), art. 36 para. (1) and (2), art. 37 para. (1) lit. c); Regulation (EU) 2016/679, recital (91)

Patients’ requests have a deadline written into the law, and access to their own file is guaranteed twice

The controller provides the information on action taken following a request without undue delay and within at most one month of receipt; the period may be extended by two months, with the person informed within the first month. The information and measures are provided free of charge. Separately, the patient law requires providers to ensure the patient’s unrestricted access to information concerning their own medical data, to results and investigation files, with a written summary issued at discharge, and the patient may obtain a copy of any part of their own files. A clinic whose system cannot produce that export breaches a deadline, not just an expectation.

SourceLaw 195/2024, art. 12 para. (3) and (5), art. 15; Law 263/2005, art. 11 para. (4)

Mecanica

What AI consulting & training does, in concrete terms

The same capabilities that appear on the service page, where each has its own file and back-end line.

We request the primary document for each statement

A register with one statement per line: the primary document, the date, where it is found, whether it is publishable. The document that repeats the statement does not count as a source. Applied to us, the register eliminated three non-existent awards and confirmed three real ones, one of them through an original email found in the archive — a private source, showable on request, which no public search could have produced.

We measure production, not what the documentation says

The verification commands are included in the deliverable, so anyone can repeat them without us. When the document and the measurement do not agree, the measurement is right: while preparing this work, we found an internal document that declared a file about 16% smaller than it was, and an infrastructure diagram that described a server we had moved away from.

We declare what we could NOT measure

In our own accessibility and performance audit, the limitations section comes before the results and lists five things: render indicators the tool did not expose, keyboard activation the automation could not reproduce faithfully, the absence of screen reader tests, the inability to emulate the reduced motion preference, and the lack of field data. The conclusions drawn are marked as deductions, not observations.

We do not claim compliance levels we have not tested

The same audit contains no declared compliance level, because a complete audit requires testing with real screen readers, on real devices, with users — none of that had been done. What it does contain are individual findings, each with the relevant criterion, ordered so the work can be prioritised. Three blockers counted, the rest improvements.

We separate what can be published from what cannot

Technical fact from our own code: publishable, with the line. Actual project status: publishable, with the real reason, not the euphemism. Commercial result — clients, improvement percentages, volumes: not publishable without measurement and the client’s agreement. Comparison of the type “first” or “best”: not publishable without criterion and date. This grid applies before a line is written, not in proofreading.

We check consistency between what you publish and what the code does

The published policy and the implementation must not diverge, and divergence is hard to see from the inside. Examples from our own audit: the page promised IP address anonymisation, but the code sent it in full in a notification; the publicly declared retention period was not enforced by anything. The resulting rule: if a code change alters what is collected, where it goes, or how long it is kept, the published text changes at the same time.

The service, in detail

The data

What every system in the industry addresses

The classes of data that medical clinics hold, with the legal basis for keeping them where the law provides it.

Laboratory results and investigation reports: The document with a diagnosis or laboratory values is the core of the special category and, at the same time, the only item in the clinic designed to leave the clinic. The moment the delivery channel is chosen, the clinic also chooses the level of processing security — the obligation is to implement technical and organisational measures appropriate to the risk, taking into account the state of technological development and the severity of the consequences. The channel requested by the patient is not, in itself, a justification; it is a preference that must fit within a measure decided by the controller.Keep: Unverified for the sectoral retention term of medical documentation, established by acts of the Ministry of Health, which we could not open today. The applicable principle remains retention for a period that does not exceed what is necessary for the purpose, and the anticipated terms by category are entered in the record of processing activities.SourceLegea 195/2024, art. 9 alin. (1), art. 32 alin. (1), art. 5 alin. (1) lit. e), art. 30 alin. (1) lit. f); Legea 263/2005, art. 12 alin. (1)
Referral from the family doctor: The referral note states who is referring, to which speciality and, usually, why. It is health data and, in addition, it is proof of the insured route. It circulates between three different controllers — the family practice, the clinic and, for reimbursement, the health insurance fund — and between them each transmission is a disclosure that needs its own basis.Keep: How long is necessary for the medical act to which it relates and for the related settlement. The term is set explicitly, not inherited from the duration of the contract with the software provider.SourceLaw 195/2024, art. 5 para. (1) lit. b) and e), art. 9 para. (1), art. 30 para. (1) lit. d); Law 263/2005, art. 12 para. (3)
Appointment and reason for attendance: Name, phone number, specialism, doctor, date, time — and the free-text field where reception notes what the patient said. The free-text field is what changes the regime of the entire record: “check-up” is administrative, two sentences about symptoms are not. The booking itself relies on performance of the contract or on steps taken at the request of the person before the contract; the clinical content in the free-text field needs something else, which is why the cleanest thing is not to ask for it there.Keep: Related to the purpose of the appointment and the relationship that follows. A history of appointments kept indefinitely ‘for statistics’ needs its own basis and its own term.SourceLegea 195/2024, art. 6 alin. (1) lit. b), art. 5 alin. (1) lit. c), art. 9 alin. (1)
Call recordings at reception: Audio in which an identifiable person describes their condition. It is health data in another format, nothing more. For it to exist lawfully, it needs its own basis — if it is legitimate interest, the patient has the right to object on personal grounds and processing stops if the controller does not demonstrate legitimate and compelling overriding grounds. And it needs information at the time of collection: the controller's identity, the purposes and basis, recipients, the intention to transfer, the retention period, rights, the right to lodge a complaint with the Centre.Keep: It is set by the operator and communicated at collection; when an exact period cannot be given, the criteria for determining it are communicated. A recording function left on the central unit’s default setting is not a term.SourceLaw 195/2024, art. 13 para. (1) and (2), art. 6 para. (1) lit. f), art. 21 para. (1) and (4), art. 9 para. (1)
Imaging and radiology reports: The image and its interpretation are two objects, often in two systems, sometimes with two providers. Both are special category. When interpretation is carried out by an external radiologist, a third participant appears in the chain, and their role — authorised person or independent operator — is determined by who decides the purposes and means, not by what is written on the invoice.Keep: As with medical documentation: unverified sectorally, decided on the principle of necessity and written in the record of processing activities.SourceLaw 195/2024, art. 4 (the definition of “health data”), art. 28 para. (1) and (9), art. 26 para. (1), art. 30 para. (1) lit. f)
Insured status, policy and national identification number: These are the data that the registry office asks for first and on which the answer to the question about cost depends. The national identification number — including the series and number of the ID card — may be processed in the situations provided for on any basis, but if the basis is legitimate interest, the controller is obliged to put in place specific safeguards: measures to minimise the data and for security, storage terms set according to the nature of the data and the purpose, with specific deletion or review periods, and periodic training for the persons processing them.Keep: How much the settlement and the related accounting obligations require. When the basis is legitimate interest, the specific retention or review period is not optional.SourceLaw 195/2024, art. 53 para. (1) and (2), art. 4 (the definition of “national identification number”), art. 6 para. (1)

Limbajul

The words people there use

An agent that says “programming” where the industry says otherwise is immediately heard as foreign. That is why vocabulary goes into configuration, not into the glossary at the end.

Registry: The point where requests come in — at the counter and by phone. It is not “reception” and it is not a call centre; it is the link that distributes the patient between the specialists’ schedules. When someone in the clinic says “at reception”, they are talking about a role, not a room.
Referral note: The document with which the family doctor refers the patient to a specialist or for an investigation. It is the key to the insured route; without it, the same investigation becomes a paid service. A site that lists services without saying whether a referral is required misses exactly the question the visitor arrives with.
High-performance medical services: The category of investigations for which appointment booking is made separately, through its own system, not through the clinic’s schedule. The term is used as such in the public communication of the insurance fund and is the word the patient is looking for.
Nomenclator: The coded catalogue of medical services. Each item has a code, name, unit of measure and tariff. The nomenclature name is the clinic’s accounting language, not the patient’s language — translating between the two is a real part of content work.
Unit of measure: What is counted for a service item: the session, the visit, the consultation, the investigation, the procedure, the treated case. Two clinics with the same displayed tariff may issue different invoices because they count something else. A price without a unit is not complete information.
Outpatient / inpatient: Care in which the patient goes home on the same day, as opposed to inpatient care. The documentation differs — the outpatient file as opposed to the observation sheet — and with it, the data collected and who sees it also differ.
Co-payment: The amount paid by the patient for a service that is otherwise covered. It is the most common source of misunderstanding at the cashier, because the patient read “covered” and paid something.
IMSP: Public medical and sanitary institution. It matters because the regime of a public institution differs: for authorities and public institutions, legitimate interest is not available as a basis in the performance of tasks, and appointing a data protection officer is mandatory by virtue of their status alone.
Health service provider: The legal term in the patient law for medical and pharmaceutical institutions, regardless of ownership form. It is the word the law uses to address the clinic.

Where it breaks down

What goes wrong when medical clinics digitalise in a hurry

The result leaves via the shortest channel, and the channel does not appear anywhere in the documents

The report is sent through whatever the patient wrote, because that is the fastest way. From that moment there is a processing operation with a recipient and, often, a transfer outside the European Economic Area, which does not appear in the record of processing activities, does not appear in the information given to the patient at collection and has no processing contract with the channel provider. The clinic did not decide anything wrong — it did not decide anything, and that is exactly the problem that becomes visible at the first access request or the first complaint.

Everyone sees everything, because it is simpler

A single access level for medical staff, a shared account at reception. The law requires that the involvement of other specialists without the patient’s consent be done only within the scope necessary for taking an appropriate decision, and the medical exception itself is linked to the professional bound by secrecy. Without roles and without a log, the clinic cannot demonstrate either compliance or the opposite — and the burden of demonstrating compliance lies with the controller, under the principle of accountability.

The chatbot on the site slips into triage

It starts as a reply to questions about schedule and price. Then someone adds the question “what is wrong with you”, because it sounds useful. At that moment it collects special category data on a channel designed for administrative data, and if it also decides where to send the patient, it touches the prohibition on automated decisions based on such data. The slide is not visible in a demo — it is visible in transcripts, two months later.

List of services published without code and without unit

The name and amount are placed on the website. The patient cannot find out from the page whether a referral is needed, whether the amount is per appointment or per case, and whether their status changes the answer. The result is that the page generates exactly the calls it was meant to reduce, and the clinic draws the conclusion that “people call anyway”, instead of seeing that the page does not contain the information they call about.

Call recording enabled from the telephone exchange, not from a decision

The function is activated because it exists. No one writes the purpose, legal basis, retention period, who has access to the files, and what happens to them when the telephone provider changes. A store of health data in audio format accumulates with a third party, without notice at collection and without a term. When an access or objection request comes in, the clinic discovers that it cannot even search it.

Questions

What someone from a medical clinic asks before buying software

Can I send test results by email or messaging if the patient asks for that?

The patient’s request is not, by itself, a security measure. The controller’s obligation is to implement technical and organisational measures appropriate to the risk, taking account of the state of technological development, costs and the severity of the consequences for the person. A report with a diagnosis has serious consequences if it reaches the wrong person. In practice, the right question is not “can I”, but “what does the channel compensate for”: verifying the recipient’s identity, a link that expires, a password sent by another means, a portal. And if the document passes through a channel provider, that provider is a processor and falls under the contractual and transfer regime.

Can I put in a system that asks the patient what symptoms they have and sends them to the right specialist?

It can collect and route to a human. It cannot make the decision on its own. A person has the right not to be subject to a decision based solely on automated processing that significantly affects them, and decisions falling under exceptions cannot be based on special categories of data except by explicit consent or substantial public interest, with appropriate measures. Even then, human intervention, the expression of one’s point of view and contesting the decision must be ensured. An assistant that suggests and a human who confirms is an architecture that fits within the law; an automatic symptom router does not.

I record calls at reception. What do I have to say and to whom?

At the time of collection, to the patient: who the controller is and how to contact them, the contact details of the data protection officer if there is one, the purposes and legal basis, the legitimate interests pursued if that is the basis, the recipients or categories of recipients, the intention to transfer to another state, the storage period or the criteria for determining it, the rights of access, rectification, erasure, restriction, objection and portability, the right to withdraw consent if that is the basis relied on, and the right to lodge a complaint with the Centre. And if the basis is legitimate interest, the right to object must be brought to attention explicitly, clearly and separately from any other information, at the latest at the first communication.

I work with an external call centre. Is a service contract enough?

No, if that contract does not contain the required clauses. The processor contract must set out the subject matter, duration, nature, purpose of the processing, type of data and categories of data subjects, and expressly provide for processing only on documented instructions, the staff’s confidentiality commitment, security measures, the prohibition on engaging another subcontractor without written authorisation, assistance with patients’ requests and breach notifications, deletion or return of the data at the end, and making available the information needed for audits. And if the call centre operator ends up determining the purposes and means itself, it is considered a controller for that processing, with the corresponding liability.

The doctors work on their own account in my clinic. Who is the controller?

It is decided by who determines the purposes and means, not by the form of the contract. When two or more entities determine them jointly, they are joint controllers and must transparently establish, by means of an agreement, each one’s responsibilities — in particular the exercise of patients’ rights and information obligations. The essence of the agreement is brought to the patient’s attention, and the patient may exercise their rights against each of the controllers, regardless of what is written in the agreement between them. Ambiguity here is not neutral: it is resolved against the party that cannot show an agreement.

Do I need a data protection impact assessment before connecting a new system?

It is required in particular for large-scale processing of special categories, for systematic and comprehensive evaluation based on automated processing with significant effects, and for systematic large-scale monitoring of an area accessible to the public. The Centre approves the list of types of operations that require it and may also approve a list of those for which it is not necessary; the lists are published in the Official Gazette and on the Centre’s page. If the assessment shows a high risk that is not mitigated, prior consultation follows, with a response within no more than eight weeks, extendable by six. A useful reverse benchmark: the data of a single doctor’s patients are not considered large-scale processing.

How long do I have to respond to a request for access to the file?

At most one month from receipt, without undue delay. The period may be extended by two months when necessary, but the extension and the reasons for it are communicated within the first month. The response is free of charge. In parallel, the patient law requires unrestricted access to one’s own medical data and the right to obtain a copy of any part of one’s own records. The practical question for any system bought by a clinic is a single one and is asked before signing: can it produce, on request, a complete export of a person’s data.

The patient requests erasure. Do I have to delete the medical record?

The right to erasure does not apply to the extent that processing is necessary for compliance with a legal obligation that requires processing, for reasons of public interest in the area of public health, for archiving purposes in the public interest, or for the establishment, exercise or defence of a right in legal proceedings. Medical documentation typically falls into the first. What can almost always be deleted is the layer added on top of it: marketing consent, call recordings kept without a time limit, messaging threads, portal accounts. A correct response separates the two layers instead of refusing outright.

What real risk do I have if I put everything off for a year?

The law enters into force on 23 August 2026, 24 months after publication. Fines go up to 1,000,000 lei or 1% of the total turnover of the previous year for the obligations of the controller and the processor, and up to 2,000,000 lei or 2% for the principles of processing, the rights of data subjects and transfers — the higher amount applies. Sanctions also apply to public authorities and institutions. There is a phased approach: from the first year, 10% of the established amount applies, from the second 40%, from the third 100%. So postponement is not neutral — it moves the same mistake into a year when it costs four, then ten times more.

What we cannot claimWe do not place any of our own measured result on this page for a medical clinic and we do not replace it with a market figure. We are not a data protection officer service provider, we do not issue legal opinions and we do not stand in for a lawyer: what is written here are norms cited with article, not analysis of a case. We could not verify the sectoral retention periods for medical documentation, established by acts of the Ministry of Health — the consolidated official source returned 403 on the day of verification, and a term that cannot be shown remains unverified. We did not verify the list of types of operations for which the Centre requires an impact assessment; when it is published, it decides, not the present text. We do not build certified medical software as a device and we do not deal with the compliance of the medical act. We do not have a code of conduct approved by the Centre and no certification within the meaning of the law. We do not name any clinic and we do not publish anything about anyone’s patients.

The service, in detail What we actually built All scenarios

The service, appliedWe have not yet delivered exactly this combination. What you read above is the mechanism of our service, verifiable on its page, set alongside the rules that govern clinici medicale — each with the article it comes from. What we have actually built sits on the service page and in the portfolio.

Sources 8 sources · verified on 2026-09-07

What would you want to work better?

Tell us about your process. Together we decide what is worth building, what we can connect, and how we check the result.

Let's talk