Privacy Policy for Patients

The protection of your personal data is of particular importance to us. We therefore process your data exclusively on the basis of the applicable data protection provisions, in particular Law No. 06/L-082 on Protection of Personal Data of the Republic of Kosovo (hereinafter the "Data Protection Law"). Where the EU General Data Protection Regulation (GDPR) also applies, e.g. for users in the European Union or for processing carried out in the EU, you additionally have the rights granted under the GDPR. In this Privacy Policy we inform you about the most important aspects of data processing in connection with our platform shendetesia.com / shendeti.online.

Important notice: The platform is not intended for emergencies. In a medical emergency, call the emergency number 112 immediately.

Last updated: 10.10.2026

1. Controller

ExploreYourDoc e.U.

Hirschstettner Straße 19/P/P0413

1220 Vienna, Republic of Austria

Commercial register number (Firmenbuch): FN 644542g

Director: Lorian Atashi

Phone: +383 45 630 928

E-mail: [email protected]

2. Collection and processing of personal data

2.1 Data collected during registration

When you register on our platform, we collect the following data:

• First and last name

• E-mail address

• Phone number (optional, for appointment reminders)

• Password (stored in encrypted form)

2.2 Data collected when booking an appointment

When you book an appointment, we process:

• Name and contact details

• Selected doctor/facility

• Type and time of the appointment

• Any notes on the appointment

2.3 Appointment requests to practices not yet connected

If a medical facility has not yet claimed its profile on ExploreYourDoc, you can submit an appointment request via the respective profile (without a binding online booking). In this case we process:

• First and last name

• E-mail address and phone number

• Preferred appointment (free text, optional)

• Brief reason for the request (optional; please do not enter diagnoses or health data)

• Selected profile (doctor/facility)

• Time of the request and technical metadata (e.g. IP address at the time of consent)

• If you are logged in: link to your user account

We forward your details to the requested practice — by e-mail if a business contact address is available, or by other suitable means (e.g. after the practice has connected its profile). This is a request, not a confirmed appointment. The practice will contact you directly.

Registration is not required; with a free account you can save and track your requests.

2.4 Technical data

Each time you access our platform or our mobile apps (iOS/Android), the following data is collected automatically:

• IP address (anonymised)

• Date and time of access

• Browser type and version, or app version and operating system

• Operating system

• Referrer URL (website) or device identifiers (app, where technically necessary)

• Pages visited or app features used

2.5 Location data (if enabled)

If you enable location sharing in your browser or device, we may process location data (e.g. approximate or precise position) to provide location-based features (e.g. finding doctors near you, distance calculation, map display).

Location sharing is voluntary. You can revoke it at any time in the settings of your browser/device.

2.6 Payment data (if offered)

Where the practice offers online payment, payments are processed via RaiAccept, the payment gateway of Raiffeisen Bank Kosovo (see section 4.5). The payment is made directly to the practice's own RaiAccept merchant account; the practice is the controller for this payment, and ExploreYourDoc only transmits the order data. In this context we process — depending on the specific payment transaction — in particular:

• Name and contact details (e.g. e-mail address)

• Payment amount, currency, date/time

• Information about the service provider/recipient

• Payment status and transaction/payment references

You enter your card details directly in the RaiAccept payment form; they are never stored by ExploreYourDoc e.U. We do not receive full card or account details.

2.7 Directory data of doctors, pharmacies and hospitals

ExploreYourDoc operates a directory of medical facilities in the Republic of Kosovo. Profiles of doctors, practices, pharmacies and hospitals are displayed even if they have not registered with ExploreYourDoc themselves. This information is addressed to the doctors and facilities concerned.

Data processed: exclusively professional information, in particular

• Name and academic titles

• Specialty and additional qualifications

• Practice address and geo-coordinates

• Professional phone number, e-mail address and website

• Classification as a public or private facility, where publicly known

• Opening hours, languages spoken and services offered

Source of the data: The data originates from publicly accessible sources:

• publicly accessible websites of the respective practices and facilities

• publicly accessible online doctor and business directories as well as search engine results (exclusively to determine professional contact details)

An overview of data sources and licences is also available at Data sources & licences.

Purpose: Patients should be able to inform themselves about medical services and find suitable doctors or facilities (doctor search, comparison, contact).

Recipients: The profiles are publicly accessible on ExploreYourDoc. Technical service providers (see section 4) process the data on our behalf.

Retention period: The data is stored for as long as the profile is published. If we learn that a doctor or facility is no longer active under the stated details (e.g. through a report via our form), we correct or remove the profile. Following a justified objection or an erasure, the profile is removed without undue delay.

Information of data subjects: Since individually notifying all listed persons would require disproportionate effort, we make this information publicly available.

Your options as a listed doctor or facility:

• Claim your profile: You can claim your profile free of charge and maintain your details yourself.

• Rectification: You can report incorrect or outdated information without an account via our form. Patients can also report errors this way; we review every report before making any change.

• Objection and erasure: Via the same form. To protect against misuse, we require proof of identity for this.

• Access: Upon request to [email protected], we will tell you which data we have stored about your profile and where it comes from.

You also have the right to lodge a complaint with the Information and Privacy Agency (see section 10).

3. Special categories of personal data

Important notice on health data

Health data is sensitive personal data within the meaning of the Data Protection Law and is subject to enhanced protection.

3.1 ExploreYourDoc as an intermediary platform

When simply searching for doctors, booking appointments or sending appointment requests to practices not yet connected via the patient platform, you may voluntarily provide information about your concern (e.g. reason for visit or notes). Please do not enter diagnoses or other health data in free-text fields. If you nevertheless provide such information, it will be transmitted — to the extent necessary — to the selected provider in order to prepare your request or appointment.

3.2 ExploreYourDoc practice software

If your doctor uses the ExploreYourDoc practice software, more extensive health data is processed in the course of treatment. In this case ExploreYourDoc acts as a processor on behalf of the respective medical facility, which is itself the controller of this data. This may include, among others, the following categories of data:

• Master data: name, date of birth, address, contact details

• Medical data: diagnoses, medical history, findings, course of treatment

• Documentation: medical letters, laboratory results, image files

• Forms: forms provided by the doctor (e.g. medical history questionnaires) that you complete digitally before or during your visit

• Prescriptions: medicines, dosages

Responsibility for the lawfulness of this data processing lies with the respective medical provider, who is also bound by medical confidentiality.

3.3 Protective measures

All health data is transmitted and stored in encrypted form. Access is strictly limited to the treating doctor and their authorised practice staff. ExploreYourDoc has no independent access to your health data.

4. Use of third-party providers

4.1 Twilio (communication, telephony, video)

Provider: Twilio Inc., 375 Beale Street, Suite 300, San Francisco, CA 94105, USA

Purpose: SMS appointment reminders and confirmations, transactional e-mails (SendGrid), technical provision of video consultations between patient and practice (if offered by the provider)

Data processed: phone number, e-mail address, name, appointment and contact metadata; for video: audio/video transmission (encrypted, DTLS/SRTP); recordings only with explicit consent

Transfer outside Kosovo: USA – standard contractual clauses; according to its own statements, the provider also relies on the EU-US Data Privacy Framework (see section 9)

Privacy information: twilio.com/legal/privacy

4.2 Newsletter (SendGrid)

Purpose: sending newsletters with health tips and platform news

Data processed: e-mail address, name (optional), opening and click behaviour

You can unsubscribe from the newsletter at any time. Every newsletter e-mail contains an unsubscribe link.

4.3 Google Maps

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Purpose: display of map content and location search for medical facilities

Data processed: IP address, location data (if enabled), usage data

Transfer outside Kosovo: USA – appropriate safeguards (EU-US Data Privacy Framework; see section 9)

Privacy information: policies.google.com/privacy

Google Maps is only loaded after you have given your consent. You can manage your consent in the cookie settings.

4.4 Google AdSense (advertising on the website)

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Purpose: display of advertisements on the ExploreYourDoc website

Data processed: online identifiers (e.g. cookie IDs), IP address (truncated where applicable), device/browser information, interactions with ads

Consent: For visitors in the EEA, the United Kingdom and Switzerland, Google obtains the required consent via the Google EU message (Google-certified CMP with IAB TCF). It appears independently of the ExploreYourDoc cookie banner. You can reopen your choice at any time via the "Ad settings (Google)" link in the page footer.

Technology: Google Consent Mode v2 — advertising signals (ad_storage, ad_user_data, ad_personalization) are set by Google's consent message, not by our cookie banner.

Transfer outside Kosovo: USA – appropriate safeguards (EU-US Data Privacy Framework; Google LLC is certified)

Privacy information: policies.google.com/privacy

4.5 RaiAccept – Raiffeisen Bank Kosovo (payment processing, where offered)

Provider: Raiffeisen Bank Kosovo J.S.C. (Raiffeisen Bank Kosovo Sh.A.), Prishtinë, Republic of Kosovo, as acquiring bank; payment gateway "RaiAccept" (operated within the Raiffeisen Bank International group)

Purpose: processing of online payments for appointments and services where the practice offers online payment. The payment is made directly to the practice's own RaiAccept merchant account; the practice is the controller for this payment. ExploreYourDoc only transmits the order data to RaiAccept.

Data processed: name, e-mail address, phone number, IP address, billing address, order amount and currency (EUR), order reference, transaction status. You enter your card details directly in the RaiAccept payment form (PCI-DSS, 3-D Secure / PSD2); they are not stored by ExploreYourDoc e.U.

Saved cards ("One-Click"): only with your consent, a card token may be stored for future payments; you can remove the saved card at any time in the payment form.

Transfer outside Kosovo: payments are processed by Raiffeisen Bank Kosovo in Kosovo; this may involve processing within the Raiffeisen Bank International group in the EU.

Website: raiffeisen-kosovo.com

4.6 Vercel Analytics

Provider: Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA

Purpose: audience measurement and analysis of website usage to improve the platform

Data processed: usage data (e.g. page views, referrer, device/browser information), (truncated) IP address where applicable

Cookies: Vercel Analytics does not set cookies; the script is only loaded after your consent via our cookie banner

Transfer outside Kosovo: USA – appropriate safeguards (e.g. EU-US Data Privacy Framework and/or standard contractual clauses)

Privacy information: vercel.com/legal/privacy-policy

4.7 Google Ads (conversion tracking)

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA)

Purpose: measuring the effectiveness of advertising campaigns (conversion tracking) and remarketing to display relevant ads

Data processed: online identifiers (e.g. cookie IDs, device IDs), IP address (truncated where applicable), usage data (e.g. pages visited, ad clicks, conversion events)

Retention period: Google Ads cookies have a lifetime of up to 90 days; you can delete them at any time in your browser settings

Transfer outside Kosovo: USA – appropriate safeguards (EU-US Data Privacy Framework; Google LLC is certified)

Objection/opt-out: You can withdraw your consent at any time via "Ad settings (Google)" in the footer or deactivate personalised advertising at adssettings.google.com

Privacy information: policies.google.com/privacy

4.8 Amazon Web Services (hosting & infrastructure)

Provider: Amazon Web Services EMEA SARL (EU contracting party), parent company: Amazon.com Inc., USA

Purpose: operation of the platform API, data storage, encryption

Data processed: user data, appointment bookings, uploaded documents, API requests

Location: EU (Frankfurt, eu-central-1)

Certifications: ISO 27001, SOC 2 Type II

Transfer outside Kosovo: storage in the EU; technical support by the US parent company possible – standard contractual clauses

Privacy information: aws.amazon.com/compliance/data-privacy/

4.9 MongoDB Atlas (cloud database)

Provider: MongoDB Inc., 1633 Broadway, 38th Floor, New York, NY 10019, USA

Purpose: cloud database for storing user, appointment and practice data

Data processed: all personal data stored in the database

Location: EU (Frankfurt, Germany)

Certifications: ISO 27001, SOC 2 Type II, HIPAA-ready, GDPR-compliant

Encryption: AES-256 at rest, TLS 1.3 in transit

Privacy information: mongodb.com/legal/privacy-policy

4.10 Google Firebase (push notifications in the app)

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Purpose: push notifications in the ExploreYourDoc mobile apps (iOS/Android) about appointments, forms and platform updates

Data processed: device token (Firebase Cloud Messaging), notification metadata; medical content in push texts is not analysed by ExploreYourDoc

Privacy information: policies.google.com/privacy

4.11 Google AdMob (advertising in the mobile app)

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, USA)

Purpose: display of advertisements (native ads) in the ExploreYourDoc patient app to finance the free service

Data processed: advertising ID (if consented), device and app information, IP address (truncated where applicable), interactions with ads, consent status (Google User Messaging Platform / UMP)

Managing consent: In the app under Settings → Privacy & Legal → Advertising & Consent (where required for your region) and in the UMP dialog when the app is first launched. Without consent, no personalised ads are shown; the app remains usable.

Transfer outside Kosovo: USA – appropriate safeguards (EU-US Data Privacy Framework; Google LLC is certified)

Privacy information: policies.google.com/privacy

4.12 Firebase Analytics (usage analysis in the app)

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Purpose: anonymous usage statistics to improve the mobile app (e.g. screen views, app starts)

Data processed: device information, app usage events; we use Firebase Analytics without an advertising ID (Analytics without Ad ID Support)

Withdrawal: at any time in the app under Settings → Privacy & Legal → Usage analysis

Privacy information: policies.google.com/privacy

5. Cookies

5.1 Strictly necessary cookies

We use strictly necessary cookies that are required for the operation of the platform:

• Session cookies for authentication

• Security cookies (CSRF protection)

• Preference cookies (language, settings)

• Payment/security cookies of the RaiAccept payment form if you use the payment function (e.g. for fraud prevention, 3-D Secure and secure payment processing)

5.2 Cookie settings (local storage)

We store your choice in the ExploreYourDoc cookie banner locally in your browser (localStorage, key eyd-cookie-consent) so that we can take your consent into account on future visits.

Google Consent Mode v2 is technically integrated: by default, all storage is denied. We set analytics signals (analytics_storage) according to your choice in our banner. Advertising signals for AdSense and Google Ads (ad_storage, ad_user_data, ad_personalization) are controlled by the Google EU message — not by our banner.

5.3 Optional cookies & analytics tools

We use two separate consent layers on the website:

Via our cookie banner (ExploreYourDoc):

• Google Maps (map integration)

• Location search (browser location sharing)

• Vercel Analytics (usage analysis, cookieless – only loads after consent)

Via the Google EU message (AdSense / Google Ads):

• Google AdSense (ads on the website)

• Google Ads (conversion tracking & remarketing)

You can change your choice at any time:

• "Cookie settings" in the footer → Maps, location, Vercel Analytics

• "Ad settings (Google)" in the footer → AdSense, Google Ads

Mobile apps: In the ExploreYourDoc apps (iOS/Android), separate consent dialogs apply (e.g. Google UMP for advertising, opt-in for usage analysis, system dialog for push). You can manage these in the app settings under Privacy & Legal or in your device settings.

6. Your rights

Under the Data Protection Law, you generally have the following rights. Where the GDPR applies (e.g. for users in the EU or processing in the EU), you additionally have the corresponding rights under the GDPR.

6.1 Right of access

You can request information about the personal data we process about you.

6.2 Right to rectification

You can request the correction of inaccurate data or the completion of your data.

6.3 Right to erasure

You can request the erasure of your data, provided there are no statutory retention obligations to the contrary.

If you are the holder of a profile listed on ExploreYourDoc and wish to have this profile deleted, you can submit a deletion request directly via our deletion request page. An official document (e.g. photo ID or medical professional ID) is required to verify your identity. We process your request within 30 days. Via the same page you can also request the correction of profile details or object to publication (see section 2.7).

6.4 Restriction of processing

You can request the restriction of the processing of your data.

6.5 Data portability

You can receive your data in a structured, commonly used and machine-readable format.

6.6 Right to object

You can object to the processing of your data insofar as it is based on legitimate interests.

6.7 Withdrawal of consent

You can withdraw any consent you have given at any time with effect for the future.

To exercise your rights, please contact: [email protected]

7. Data security

We use extensive technical and organisational security measures to protect your data against unauthorised access, loss or destruction:

• SSL/TLS encryption of all data transmissions

• Encrypted data storage (AES-256)

• Regular security updates

• Access control based on the principle of least privilege

• Hosting and data storage in EU data centres (Amazon Web Services and MongoDB Atlas, Frankfurt location)

8. Retention period

We store your personal data only for as long as necessary to fulfil the purposes of processing or as required by statutory retention periods:

• User account: until deleted by the user

• Appointment bookings: 3 years after the appointment

• Appointment requests (practices not yet connected): 90 days after the request, unless deleted earlier or forwarded to the practice

• Log data: 12 months

• Newsletter data: until consent is withdrawn

9. Data transfers outside the Republic of Kosovo

To operate the platform, we use service providers that process data in the European Union (e.g. Amazon Web Services and MongoDB Atlas, Frankfurt, Germany) or in the USA (e.g. Google, Twilio/SendGrid, Vercel, Google AdMob/Firebase in the app). Payments via RaiAccept are processed by Raiffeisen Bank Kosovo; this may involve processing within the Raiffeisen Bank International group in the EU. Your personal data is therefore transferred outside the Republic of Kosovo.

Such a transfer only takes place if:

• the recipient country provides an adequate level of data protection recognised under the Data Protection Law, or

• standard contractual clauses have been concluded or other appropriate safeguards within the meaning of the Data Protection Law are in place, or

• another basis provided for in the Data Protection Law applies.

For US service providers, we rely on standard contractual clauses and, where the provider is certified, on the EU-US Data Privacy Framework. The database and platform data are stored and processed in EU data centres (Frankfurt, Germany).

10. Right to lodge a complaint

You have the right to lodge a complaint with the competent data protection supervisory authority of the Republic of Kosovo:

Information and Privacy Agency (Agjencia për Informim dhe Privatësi – AIP)

Prishtinë, Republic of Kosovo

Website: aip.rks-gov.net

If you live in an EU Member State and the GDPR applies, you may also contact the data protection supervisory authority of your country of residence.

11. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy as necessary to adapt it to changes in the law or to changes in our services. The current version is always available on this page. Registered users will be informed of material changes by e-mail.

12. Contact

For questions about data protection or to exercise your rights, please contact:

ExploreYourDoc e.U.

Data protection requests

Hirschstettner Straße 19/P/P0413

1220 Vienna, Republic of Austria

Phone: +383 45 630 928

E-mail: [email protected]