Eden Laser Clinic · Tirana
Privacy Policy
Eden Laser Clinic respects the privacy of visitors, patients and people who contact us. This policy explains what personal data we may collect, why we use it, with whom we share it, how long we retain it and your rights.
Updated: 13 October 2026
This policy applies to the website https://edenlaser.al/, communications with the clinic and data processing related to our consultations and services.
2. What data may we collect?
Depending on how you interact with us, we may process:
We may process identification and contact details, such as name, surname, phone, email and address, as well as booking, consultation and service information. Assessment, safety and treatment may require health history, allergies, medicines, contraindications and post-treatment reactions, together with clinical records, consultation notes, consent forms and clinical photographs where necessary.
When payment is made, we may process financial and transaction data, excluding details held solely by the payment provider. We also process your communications, technical data such as IP address, device, browser, visited pages, usage time and cookies, communication and marketing preferences where consented, and information needed for complaints, requests or incidents.
Please do not send more health information than necessary by email or messages. Full clinical information should be provided through the channels and forms the clinic specifies for consultation.
3. How do we obtain data?
We may obtain data:
We obtain data directly from you when you call, write, book or visit the clinic, and during consultation, treatment and follow-up. Where lawful and necessary, it may come from a parent, guardian or authorised representative. The website may collect information through cookies and similar technologies according to your choices; we may also obtain data from booking, communication, hosting, security or payment providers we use.
4. Why and on what basis do we use data?
We process data only where there is a lawful basis and for defined purposes.
Bookings and communications
We use contact details to answer requests, arrange consultations, confirm or change appointments and provide practical information. This takes steps at your request before providing services or fulfils our service relationship with you.
Assessment and treatment
Health data is processed only when necessary for assessment, suitability, safety, service provision and follow-up, in accordance with applicable law, professional confidentiality and your explicit consent where required.
Legal and administrative obligations
We may process data for clinical records, billing, accounting, reporting, security and compliance with legal obligations.
Security and protection of rights
We may use data to protect patients, staff, systems and the clinic’s legal rights, prevent misuse and manage complaints or claims. When relying on legitimate interests, we assess them to ensure they do not override your rights and freedoms.
Website analytics
On the public website, Google Analytics 4 is activated only after you accept statistics in the cookie notice. The Google tag is not loaded before acceptance. After acceptance, visited pages and clicks on treatments, languages, directions and contact links may be measured. Our click events do not include form or message values, phone numbers or email addresses from contact links. A phone click measures the choice to call, not a completed call.
Marketing and photographs for publication
Promotional communications and publication of identifiable photos, videos, testimonials or other materials require a valid lawful basis and, where required, separate, informed, revocable consent. Refusing marketing or publication does not affect access to services.
5. Health data and confidentiality
Health data is special-category data with additional protection. Access is restricted to those with a lawful need who are subject to confidentiality obligations.
The website is not a diagnostic or emergency channel. For urgent health concerns, contact the relevant emergency services.
6. Clinical photographs
Photographs needed to document, assess or follow treatment form part of the clinical record. Use on websites, social media, advertising, public education or other purposes beyond care requires separate assessment and consent where applicable.
For more information, read the Clinical Photography Policy.
7. With whom may we share data?
Data may be shared only to the necessary extent with:
We may share data with authorised consultation, treatment or administrative staff and professionals, and with hosting, website maintenance, email, booking, security, storage, accounting or payment providers. Sharing with laboratories or other care providers occurs only where necessary, lawful and appropriate for the service. For rights protection, we may share it with professional advisers, insurers or legal representatives; with public authorities, courts or supervisory bodies when legally required.
Providers acting as processors must use data only under documented instructions and implement appropriate security measures. We do not sell personal data.
8. International transfers
Some technology providers may process data outside Albania. Such transfers must use a legally permitted mechanism and appropriate safeguards. Contact us for more information on provider categories and safeguards.
9. How long do we keep data?
We retain data only as long as needed for its purpose and to meet legal, clinical, financial and legal-claims obligations.
The retention period depends on:
Retention depends on data type and sensitivity, the duration of the patient relationship, health and financial record requirements, limitation periods and the need to protect rights. Your consent is also considered where processing relies on it.
When no longer needed, data is securely deleted, anonymised or destroyed, unless longer retention is legally required.
10. How do we protect data?
We use organisational and technical measures appropriate to the nature and risk of processing, including access control, confidentiality, backups, device and system protection and incident-management procedures.
No system guarantees absolute security. If an incident requires legal notification, we follow applicable procedures.
11. Your rights
Under the conditions provided by law, you may request:
You may request confirmation and access to your data, correction or completion, erasure, restriction or objection to processing. Where portability applies, you may request receipt or transfer in a structured format. You may withdraw consent at any time without affecting the lawfulness of earlier processing, and request information on automated decision-making if used.
Some rights may be limited where law requires retention or processing, or it is necessary for care or legal claims. We will explain why if we cannot fully accept a request.
To protect data, we may request reasonable information to verify identity. Requests are handled within legal deadlines.
12. Privacy complaints
We encourage you to contact us first so we can review your concern. You also have the right to complain to the Commissioner for the Right to Information and Protection of Personal Data:
13. Minors
Minors’ data receives additional protection. When online-service consent concerns a child below the statutory age, parental or guardian authorisation is required. Consultations and treatment of minors also follow professional and legal requirements for representation and informed consent.
We do not target minors with direct marketing or profiling.
14. Cookies and third-party services
You can reject statistics or change your choice through “Cookie preferences” at the bottom of the page. The choice is stored in the browser’s localStorage under the key eden_analytics_consent_v1, remembering only your acceptance or rejection. Rejection stops new events from being sent by our Google Analytics 4 integration. It does not automatically delete previously stored cookies; you can delete them through your browser. Read the Cookie Policy for details.
15. Links to other websites
The website may contain third-party links or content. Their policies and practices are controlled by those parties. Read their privacy policies before providing data.
16. Changes to this policy
We may update this policy when services, technology or legal requirements change. The new version will appear here with its update date. Significant changes will be communicated appropriately.
17. Contact us
For any privacy question or request:
Email: [email protected]
Phone: +355 68 605 5007
Address: Rruga Sami Frashëri 64–70, Tirana 1046, Albania