Personal data protection

This notice explains how the zobozdravnik.si website processes personal data when you visit the website, use the contact form, request an appointment and submit questions to a dentist. It has been prepared in accordance with the General Data Protection Regulation (GDPR), the Personal Data Protection Act (ZVOP-2), the Electronic Communications Act (ZEKom-2) and the rules applicable to healthcare providers. If the data becomes part of medical documentation, it is also subject to the special rules of healthcare legislation and professional confidentiality.

1. Personal data controller

The personal data controller is ZOBOZDRAVNIK, zasebna zobna zdravstvena ordinacija mag. Tomaž Rotar, dr. dent. med., d.o.o., Prešernova ulica 6A, 4240 Radovljica, Slovenia (abbreviated name: ZOBOZDRAVNIK d.o.o.; registration number: 3309428000; tax number: 24597520; entry in the Slovenian Business Register is maintained by AJPES).

For privacy-related questions and to exercise your rights, you can write to us at [email protected] or call us on +386 4 530 06 60.

2. What personal data we process

Contact form and appointment request

We process the data that you provide yourself, in particular your first and last name, email address, telephone number, selected clinic or reason for contacting us, the content of the message and the time of submission. For security and abuse prevention purposes, the user agent and a hashed technical identifier of the network address may also be recorded. If you include health data in your message, we process it only to the extent necessary to handle your request and, where necessary, to provide healthcare. Do not enter health data in online forms that is not necessary for the purpose of your message.

Questions for a dentist

When you use the question form, we process your name, email address, location or question category, the content of the question, the time of submission, proof of consent and technical data for abuse prevention. The question may contain health data, which is a special category of personal data. The form is intended for questions that may be published publicly together with the answer following editorial review. The email address is not published. Only the content of the question and the answer are published, together with any additional data that the form clearly indicates will be published. Before publication, we may remove or generalise data that is unnecessary and could make it possible to identify an individual.

A published question and answer are accessible to an indefinite number of visitors. Public content may be indexed by search engines or temporarily stored by other providers, so removing content from our website does not necessarily result in the immediate deletion of all copies from third-party caches and indexes.

If you do not want your question to be published publicly, use the contact form or contact the clinic directly.

Website visits, security and statistics

When you use the website, the visited page or URL, time of visit, page title, referring page, language, approximate country, device type, browser, operating system, UTM parameters, IP address, pseudonymous visitor identifier and user agent may be recorded. The website uses its own server-side statistics and technical logs; the data is not intended for advertising profiling.

When searching questions or articles, the search term, number of results and technical data may be recorded. Do not enter names, contact details, document numbers or other information that could identify you or another person in the search fields, nor any health details that are not necessary for the search.

3. Purposes and legal bases

Contact, appointment request and communication: we process personal data in order to respond to your request, arrange a visit and take steps at your request before or in the course of providing a healthcare service (Article 6(1)(b) GDPR), and where necessary to comply with legal obligations (Article 6(1)(c) GDPR).
Health data in the course of healthcare: where required for prevention, diagnosis, treatment or the provision of healthcare, it is processed under the conditions of Article 9(2)(h) GDPR and applicable healthcare legislation, subject to professional confidentiality. If you voluntarily provide health data in preliminary electronic communication that does not yet constitute healthcare, and no other exception under Article 9(2) GDPR applies, it is processed on the basis of your explicit consent (Article 9(2)(a) GDPR).
Question intended for public publication: we process personal data on the basis of your consent (Article 6(1)(a) GDPR), and any health data on the basis of your explicit consent (Article 9(2)(a) GDPR). You may withdraw your consent at any time; withdrawal does not affect the lawfulness of processing before withdrawal. Upon receiving your withdrawal, we will cease further processing and publication of data based on consent, unless another legal basis exists for the specific processing.
Security, abuse prevention, error diagnostics and basic server-side statistics: processing is based on our legitimate interest in providing a secure, stable and functional website (Article 6(1)(f) GDPR). We do not use the data for advertising profiling or automated decision-making concerning your treatment.

4. Recipients and processors

Personal data is accessed only by authorised persons who need it to perform their work. To the extent necessary, it may be processed by contracted providers of hosting, email, maintenance, security and other information technology services. Relationships with processors are governed in accordance with the GDPR. We may also disclose data to competent public authorities where required by law or a binding decision. We do not sell personal data.

For a question that you have consented to have published publicly, the recipients of the published data are website visitors and any providers of web search engines or public web content archiving services.

5. Transfers to third countries and external services

If a contracted provider processes personal data outside the European Economic Area, such a transfer is carried out only if the conditions of Chapter V GDPR are met, for example on the basis of an adequacy decision or appropriate safeguards. You may request information about the transfer mechanism used and a copy of the appropriate safeguards at [email protected].

6. Retention period

We retain data from the contact form and appointment requests for as long as necessary to handle the request, communicate and arrange the visit, and thereafter only for as long as necessary to comply with legal obligations and establish, exercise or defend potential legal claims. Where data becomes part of medical documentation, it is retained for the periods prescribed by the regulations governing medical documentation.

We retain data related to a public question for as long as necessary to handle the question, demonstrate consent and manage the published content. A published question and answer may remain accessible for as long as the content is published; we retain identification and contact data only for as long as necessary for the stated purposes or due to legal requirements.

Technical logs, server-side analytics, search terms and error diagnostics are generally retained for no more than 400 days, unless an individual record is required for longer to investigate a security incident, abuse or legal claim. When the data is no longer required, it is deleted or anonymised.

7. Your rights

Subject to the conditions of the GDPR, you have the right to access your personal data, rectify inaccurate data, erase data, restrict processing, obtain data portability where the statutory conditions are met, and object to processing based on a legitimate interest. Where processing is based on consent, you may withdraw it at any time. You can submit a request to [email protected]. To protect your data, we may verify your identity before fulfilling the request.

If you believe that your personal data is being processed contrary to the applicable regulations, you have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, email: [email protected]. Instructions and forms are available on the Information Commissioner’s website.

8. Obligation to provide data and automated decision-making

You provide data in online forms voluntarily. Mandatory fields are required so that we can process the request technically and substantively. If you do not provide the data required to contact you or handle your request, we may be unable to respond through the form. The website does not carry out automated decision-making that would produce legal or similarly significant effects for an individual and does not use health data for advertising profiling.

9. Data security

We use appropriate technical and organisational measures to limit unauthorised access, loss, alteration or disclosure of data. Access to the administration area and data from forms is restricted to authorised users. However, no electronic transmission or information system can guarantee absolute security.

Cookies and local storage

In its basic configuration, the website does not use advertising or external analytics cookies. It uses the following strictly necessary technical storage:

PH_HPXY_CHECK: a security session cookie set by the server security system to protect the website against abuse and attacks; it generally expires at the end of the browser session.
zobozdravnik_session: a first-party session cookie required for form security, CSRF protection, temporary system messages and administration functionality; it generally expires at the end of the browser session.
zobozdravnik_info_*: Local storage of the status of an urgent notice. When the user closes a displayed urgent notice, technical information may be stored in localStorage so that the same notice is not displayed again. It remains in the browser until the notice is deleted or until the website removes or replaces it.

Consent is not required for the strictly necessary technical storage listed above because it is needed to provide a function or service expressly requested by the user. Users can delete stored data in their browser settings; deleting a session cookie may temporarily affect the operation of forms or a logged-in session.

Terms of use

10. Provider information and use of the website

The website provider is ZOBOZDRAVNIK, zasebna zobna zdravstvena ordinacija mag. Tomaž Rotar, dr. dent. med., d.o.o., Prešernova ulica 6A, 4240 Radovljica, Slovenia; registration number: 3309428000; tax number: 24597520; email: [email protected]; telephone: +386 4 530 06 60. The company is entered in the Slovenian Business Register maintained by AJPES.

Dental services are provided by appropriately qualified healthcare professionals in accordance with the regulations of the Republic of Slovenia and the rules of the regulated profession. Physicians and doctors of dental medicine practising medicine in the Republic of Slovenia are entered in the register of physicians maintained by the Medical Chamber of Slovenia, where information about professional rules and licences is also available.

Submitting a contact form or an appointment request constitutes a submitted request and does not in itself guarantee an appointment or constitute confirmation of a booking. The appointment is agreed when it is confirmed by the clinic.

11. Health information is not a substitute for an examination

The website content, articles and published questions and answers are of a general informational nature. They do not constitute an individual diagnosis or personal treatment plan and cannot replace a clinical examination, diagnostic procedures and direct consultation with a dentist. In the event of pain, swelling, bleeding, injury, breathing difficulties or another emergency, contact the appropriate healthcare or emergency service.

12. Accuracy, prices, appointments and external content

We endeavour to keep information accurate and up to date, but professional guidelines, prices, schedules, service availability and other circumstances may change. For a specific service, price or appointment, the information confirmed directly by the clinic applies. External websites and services have their own terms and privacy policies; their operators are responsible for their content and operation.

13. Copyright

Texts, photographs, graphics and other copyrighted content on the website are protected in accordance with applicable law unless otherwise indicated for individual content. Reproduction, adaptation or commercial use without the appropriate permission of the rights holder is not permitted, except where allowed by law.

14. Website availability and liability

The website may occasionally be unavailable due to maintenance, technical difficulties or circumstances beyond our reasonable control. To the extent permitted by mandatory regulations, we are not liable for damage arising solely from temporary website unavailability, content provided by external providers or use of the website contrary to these terms. This provision does not limit liability that cannot be excluded by law or the statutory rights of patients and consumers.

For questions and disputes concerning the use of the website, you can contact us at [email protected]. We will endeavour to reach an amicable resolution. Matters not governed by these terms are subject to the law of the Republic of Slovenia, and disputes shall be resolved by the court having jurisdiction under the applicable legislation.

15. Changes to the document

We may update this notice due to changes to the website’s functionality, providers, processing methods or legislation. The version currently in force is published on this page.

Last substantive update: 1 September 2026.

Personal data protection and terms of use