Privacy policy
Last updated: 15 September 2026.
This page says what data the site processes, why, for how long, who else sees it, and what you can ask for. It is written to be read. If anything is unclear, write to us.
Who is responsible for your data
The data controller is Elisa Ganea, a private individual, who makes and runs transgen.ro on a non-commercial basis. For anything about your data, write to [email protected]. We have no appointed data protection officer; we are not required to have one, and the address above reaches the person who can act.
In short
- Reading the site leaves no trace with us: no analytics, no tracking cookies, no advertising.
- Chatting with Celeste is not saved on the server. The text of your message reaches the language model provider so that an answer can be generated.
- The draft generator is the only place where we ask for personal data, including sensitive data, and keep it so you can come back to it. It starts only after you accept explicitly.
- Everything we save is encrypted. We sell nothing, run no advertising and do not use your data to train any model.
- You can ask at any time for a copy, a correction or the deletion of your data, at the address above.
What we process, why, and on what basis
1. When you read the site
The server receives, like any server, your IP address and the request your browser makes. The site is hosted by Render (Render Services, Inc.) in its Frankfurt data centre, and the hosting provider may keep technical traffic logs under its own policy. Our own logs keep the path requested, the response code, the duration and a technical request identifier; they do not keep the IP address (with one exception: login attempts to the admin area) and never contain your messages.
We use no analytics service, no tracking pixel and no external resource (fonts, scripts) apart from the bot check described below.
Basis: our legitimate interest in keeping the site running and secure (art. 6(1)(f) GDPR).
2. Bot protection
The guides and the other pages are read without any check. When bot protection
is on, the check appears only at your first message to Celeste and on entering
the draft generator, and is performed by Cloudflare Turnstile (Cloudflare,
Inc.), which receives your IP address and technical signals from your browser to
tell a person from a program. After the check, a cookie (tg_verified)
remembers the result for 12 hours so you are not checked again. Cloudflare does
not track what you do on the site.
Basis: legitimate interest (art. 6(1)(f) GDPR).
3. Chatting with Celeste
Celeste is an automated assistant built on a language model. What you write in the public chat is sent, together with the current conversation in your window, to Anthropic (Anthropic, PBC), the model provider, so that an answer can be generated. The conversation lives in your browser and is gone when you close the page; we do not save it.
So that the chat is not flooded with repeated or meaningless messages, we keep for at most an hour a fingerprint of each message (not its text), tied to your IP address by a keyed hash, not in the clear. The fingerprint recognises a repeat; it cannot reconstruct what you wrote. A message declined this way is sent nowhere. The hourly message limit is kept the same way, by a hash of the address, not the address itself.
If a connection keeps sending meaningless messages it gets a pause of a few minutes; repeated pauses within a day become a suspension, which we lift by hand. Of every pause and suspension we keep a record: the IP address (encrypted), when it started, why, and when it was lifted. It is the only thing we retain from the public chat, and only once a pause has been reached. An ended pause or a lifted suspension is deleted after 90 days; an active suspension stays until it is lifted.
A word of advice: the public chat is for general questions. It does not need your name, your CNP or your diagnosis to answer, so do not give them to it. For your own situation there is the generator, with its protections.
Basis: our legitimate interest in providing the service you ask for and in defending it against abuse (art. 6(1)(f) GDPR).
4. The draft generator
Here we ask, in conversation, for everything a claim needs:
- what you write in the conversation and your personal account, in your own words;
- the details of the claim: name, chosen name, CNP, the series of your identity card and birth certificate, address, county, date and place of birth, the court;
- details from medical reports: numbers, dates, the doctor, the clinic;
- documents you upload, if you choose to;
- the details of any witnesses you propose (it is your responsibility to inform them);
- your email address, if you choose to save your progress or to be contacted about your feedback;
- the IP address you work from, the country code and the kind of device (phone, tablet, computer), from the moment you accept, not before.
Some of this is data concerning health within the meaning of art. 9 GDPR, and the CNP is a national identification number, given special protection in Romanian law. We process it only with your explicit consent, which we ask for before we start and which you can withdraw at any time (see “Your rights”). You can choose the anonymous route: then we do not ask for your name, CNP or address, and the draft carries blank ruled lines for you to fill in by hand.
We use it to build the draft, to show you an indicative review of the case, and so you can come back to it. The review is informative: we take no decision with legal effects about you, automated or otherwise.
Your date of birth is asked at the start to check that you are at least 18. Under 18 the generator stops: the drafting tools are withdrawn for the rest of the session, and the content of the session (date of birth included) is deleted automatically 30 days after the last activity, not 365.
What reaches Anthropic: the text of the conversation, the form answers and the uploaded documents, so they can be read and the draft can be written. An uploaded document is sent once, at upload; after that we keep and reuse only the text extracted from it, never the file. We do not send your IP address, your email address, your country or your device. Anthropic processes the data as a processor under a data processing agreement, does not use it to train models, and keeps it only for a limited period under its own policy.
Basis: your explicit consent (art. 6(1)(a) and art. 9(2)(a) GDPR) for the content of the session; our legitimate interest (art. 6(1)(f)) for the IP address, country and device, which we use to see where and how much the site is used and to recognise abuse. We build no profiles and combine this data with nothing else.
5. Saving your progress by email
If you choose to save your progress, we send an 8-character key to the address you give us. The email goes out through Resend (Resend, Inc.), which receives your address and the content of the message in order to deliver it. With us, the address is encrypted and the key is not stored at all: we keep only a fingerprint of it, so we can replace it but never read it back to you. The address is used only to resume the session and, if you ticked the box, to contact you about the feedback you left.
Basis: your consent, given by choosing to save (art. 6(1)(a) GDPR).
6. Feedback
After you receive the draft you can leave a rating from 1 to 5 stars and a comment. The comment is encrypted. If you tick that we may contact you, we use the session’s email address; if there is none, we ask for it then.
Basis: your consent (art. 6(1)(a) GDPR).
7. Errors and operations
When something breaks, the error report goes to Sentry (Functional Software, Inc.). We send it scrubbed: no request body, no cookies, no headers, no local variables and no user data; what remains is the type of error, the place in the code and a technical identifier. We do not reproduce problems on your real data.
Basis: legitimate interest (art. 6(1)(f) GDPR).
8. The doctor directory
The directory is a public list of doctors, built by the community, with reviews written by visitors.
If you submit something — a review, or a new doctor — we ask for an email address and send a code to it. Nothing is published and nothing is kept until you confirm the code: an unconfirmed submission deletes itself after a day.
Once you confirm, we keep: what you wrote (public), your email address (encrypted, never shown on the site), an irreversible fingerprint of that address and of your IP address — the first so that ten reviews of one doctor cannot come from one person, the second against spam — and the moments you ticked the two boxes.
We keep your email address for as long as the review stands. There is one reason for it: if the doctor disputes the review, we have someone to ask. We do not use it for anything else, we give it to nobody, and it appears nowhere on the site — but if a court orders us to hand it over, we have to. Write knowing that. When a review is deleted, the address goes with it.
Your review passes through an automatic filter before it appears: the text goes to Anthropic, which returns only “clean” or “hold” plus a reason from a fixed list. Anything clean is published straight away, without anyone here reading it; anything held is read by a person first.
Basis: your explicit consent (art. 6(1)(a) and art. 9(2)(a) GDPR) for publishing the text — an account of your own healthcare says something about you, which is why we ask for that separately from your statement that you were there. For the anti-spam fingerprints: legitimate interest (art. 6(1)(f)).
9. Donations
The support button leads to Buy Me a Coffee, an external service with its own privacy policy. We do not receive or see your payment details.
If you are a doctor listed in the directory
This section is for you even if you have never been on this site. Someone else added the details about you; you gave us nothing and we did not ask you. Here is everything you need to know (art. 14 GDPR).
What we publish: name, specialty, clinic or hospital, city and county, whether the visit is reimbursed by the national insurance house, a description written by the person who added the entry, and how to book — the clinic’s booking page or its contact number.
We do not publish your personal number, your home address, your personal email or your schedule. The booking field is for the practice’s public contact; if somebody puts a personal number there we take it out, and the automated screening usually holds the entry before it appears at all.
Reimbursement is a fact about the practice, not a judgement about you, and it is what the person who added the entry reported — if it is wrong we correct it on request, like any other field.
Where we got it: from sources that were already public — the site of the clinic where you work, or the College of Physicians’ register of doctors. We ask for a link on every entry and show it on the entry’s own page. It is not mandatory, though: where there is none, the page says plainly that the information came from the person who added the entry, so nobody reads it as something we checked.
On what basis: legitimate interest (art. 6(1)(f) GDPR) — people looking for care need to know who exists and where. Your consent is not required for that, but that does not leave you without recourse.
What you can ask for:
- To object (art. 21 GDPR). At any time, on grounds relating to your situation. Write to [email protected]. In practice: in almost every case we will take the entry down without argument. You do not have to convince us and we will not ask for reasons. If we do refuse, we will write to you and say why — and we write it down at our end too, because an unreasoned refusal is not a valid one.
- To correct it. If the specialty, clinic, city or reimbursement is wrong, we change it.
- To have a review taken down. If a review is false, if it states as fact something that did not happen, or if you simply tell us that person was never your patient — we look into it, and if we cannot verify it, we delete it.
- To see what we hold about you (art. 15) and to complain to ANSPDCP.
A withdrawn entry stays withdrawn: the next visitor cannot put it back.
Who else sees the data
Nobody outside the list above. We do not sell, rent or give your data to anyone else, and we do not use it for marketing.
| Provider | What it receives | Where | Role |
|---|---|---|---|
| Render | everything stored (encrypted) and the traffic | Frankfurt, EU | hosting |
| Anthropic | the text of conversations, form answers, uploaded documents, submitted review text (for filtering) | USA | the language model |
| Cloudflare | IP address, browser signals | EU/USA | bot check |
| Resend | email address, the email with the key or the confirmation code | USA | sending email |
| Sentry | scrubbed error reports | EU/USA | technical errors |
Transfers outside the European Union. Anthropic, Cloudflare, Resend and Sentry are United States companies. The transfer relies on the EU-U.S. Data Privacy Framework, where the provider is certified, or on the standard contractual clauses approved by the European Commission, included in the data processing agreement with each. You can ask at [email protected] for details of the safeguards that apply.
Data may be disclosed to an authority only where the law obliges us to. It has not happened, and we would tell you if we were allowed to.
How long we keep it
| What | How long |
|---|---|
| The public chat conversation | not saved |
| Anti-spam fingerprints and the message limit | at most one hour |
| The bot-check cookie | 12 hours |
| A generator session: conversation, details, files, drafts, email, key | 365 days from your last activity; coming back restarts the clock |
| A session belonging to someone under 18 | 30 days from the last activity |
| The session cookie | 1 day, renewed on every visit |
| Ended pauses and suspensions | 90 days after they ended |
| Active suspensions | until we lift them |
| An unconfirmed directory submission | one day, then it deletes itself |
| The email address behind a published review | as long as the review stands; deleted with it |
| Directory fingerprints (email, IP address) | as long as the entry stands |
| Directory entries and reviews | no fixed term, until withdrawn or deleted |
| The residual record (see below) | no fixed term, until we delete it |
On expiry the conversation, the details of the claim, your account, the files, the drafts, the email address and the resume key are deleted automatically.
What remains after that is a residual record, with no content in it: the session’s dates and times, how many messages, files and drafts there were, whether it was anonymous, the feedback rating and comment (if you left any), the country code, the device label and the IP addresses the session was used from (encrypted). No name remains, no detail of the claim, no draft, no message. We keep it to see how the site is used over time and to be able to recognise and refuse abuse.
How we protect it
- Everything saved on the server (the database, the uploaded files) is encrypted on disk. Without the encryption key the generator refuses to start rather than write in the clear.
- The connection between your browser and the server is encrypted (HTTPS).
- The admin area is protected by a password and a two-step authentication code, one person has access, and every opening of a session is recorded.
- A draft can be opened only from the session that produced it, not by anyone who has its address.
- Uploaded documents are read once; the file is not sent anywhere again.
To be precise about what encryption buys: it protects a backup, a stolen disk or a leaked database file. It does not protect against someone compromising the running server, where the key is available.
If a security breach occurred that was likely to put you at high risk, we would inform you directly, where we can, and notify the supervisory authority, as the law requires.
Your rights
Under the GDPR you have the right:
- of access to your data and to a copy of it;
- to rectification, if something is wrong;
- to erasure;
- to restriction of processing;
- to portability: to receive the data you gave us in a common format (the draft can be downloaded at any time as text, Word or PDF);
- to object, for processing based on legitimate interest;
- to withdraw your consent at any time, without affecting what was processed before.
All of them are exercised by email to [email protected]. We answer within a month at most. So as not to hand data to someone else, we may ask you to write from the address you saved the session with, or to tell us the resume key.
Deletion, concretely
The “Start from scratch” button on the generator page closes the conversation, invalidates the resume key and deletes the IP addresses tied to the session, but it does not delete the conversation from the server: it is the withdrawal of consent, not erasure.
To have the data deleted, write to us. We delete the conversation, the details of the claim, your account, the files, the drafts, the email address and the key, and confirm it to you.
What we do not delete on request is the residual record described above: the session’s times and counts, the feedback, the country, the device and the encrypted IP addresses, plus the pause or suspension records. We keep them on the basis of our legitimate interest in recognising and refusing abuse and in knowing how the site is used; an erasure request cannot be the way a suspension disappears. They contain nothing you wrote and identify you by nothing but the address. You can object to this retention too; we answer with reasons, and if our ground does not outweigh yours, we delete the record as well.
Complaints
If you think we are not respecting your rights, you can write to us first. You always have the right to lodge a complaint with the Romanian supervisory authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28–30, Sector 1, Bucharest, dataprotection.ro, [email protected].
Cookies and browser storage
We use only what is strictly necessary for the site to work, which is why we do not ask for your consent for them:
| Name | Purpose | Lifetime |
|---|---|---|
tg_verified |
remembers that you passed the bot check | 12 hours |
tg_session |
ties your browser to your generator session | 1 day, renewed |
tg_admin |
admin only | 8 hours |
In the browser we also keep the theme you chose (light/dark) and a flag that Celeste has already said hello in the current tab. Neither identifies you and neither leaves your device.
Minors
The guides and the chat can be read by anyone. The draft generator is only for people aged 18 or over; below that age it stops, and the content of the session is deleted sooner, as described above. We do not ask for and do not want data about children by any other route; if some reached us by mistake, write to us and we delete it.
Changes
When we change something in how we process data, we update this page and the date at the top. A change that matters to people using the generator is also announced on the generator page. Earlier versions can be requested at [email protected].
