---
title: "Privacy policy"
url: https://transgen.ro/en/confidentialitate
lang: en
site: transgen.ro
---

# Privacy policy

*Last updated: 15 September 2026.*

This page says what data the site processes, why, for how long, who else sees
it, and what you can ask for. It is written to be read. If anything is unclear,
write to us.

## Who is responsible for your data

The data controller is **Elisa Ganea**, a private individual, who makes and
runs transgen.ro on a non-commercial basis. For anything about your data, write
to **contact@transgen.ro**. We have no appointed data protection officer; we are not
required to have one, and the address above reaches the person who can act.

## In short

- **Reading the site** leaves no trace with us: no analytics, no tracking
  cookies, no advertising.
- **Chatting with Celeste** is not saved on the server. The text of your message
  reaches the language model provider so that an answer can be generated.
- **The draft generator** is the only place where we ask for personal data,
  including sensitive data, and keep it so you can come back to it. It starts
  only after you accept explicitly.
- Everything we save is **encrypted**. We sell nothing, run no advertising and
  do not use your data to train any model.
- You can ask at any time for a copy, a correction or the deletion of your data,
  at the address above.

## What we process, why, and on what basis

### 1. When you read the site

The server receives, like any server, your IP address and the request your
browser makes. The site is hosted by **Render** (Render Services, Inc.) in its
**Frankfurt** data centre, and the hosting provider may keep technical traffic
logs under its own policy. Our own logs keep the path requested, the response
code, the duration and a technical request identifier; they do not keep the IP
address (with one exception: login attempts to the admin area) and never
contain your messages.

We use no analytics service, no tracking pixel and no external resource (fonts,
scripts) apart from the bot check described below.

*Basis:* our legitimate interest in keeping the site running and secure
(art. 6(1)(f) GDPR).

### 2. Bot protection

The guides and the other pages are read without any check. When bot protection
is on, the check appears only at your first message to Celeste and on entering
the draft generator, and is performed by **Cloudflare Turnstile** (Cloudflare,
Inc.), which receives your IP address and technical signals from your browser to
tell a person from a program. After the check, a cookie (`tg_verified`)
remembers the result for 12 hours so you are not checked again. Cloudflare does
not track what you do on the site.

*Basis:* legitimate interest (art. 6(1)(f) GDPR).

### 3. Chatting with Celeste

Celeste is an automated assistant built on a language model. What you write in
the public chat is sent, together with the current conversation in your window,
to **Anthropic** (Anthropic, PBC), the model provider, so that an answer can be
generated. The conversation lives in your browser and is gone when you close
the page; we do not save it.

So that the chat is not flooded with repeated or meaningless messages, we keep
for at most an hour a fingerprint of each message (not its text), tied to your
IP address by a keyed hash, not in the clear. The fingerprint recognises a
repeat; it cannot reconstruct what you wrote. A message declined this way is
sent nowhere. The hourly message limit is kept the same way, by a hash of the
address, not the address itself.

If a connection keeps sending meaningless messages it gets a pause of a few
minutes; repeated pauses within a day become a suspension, which we lift by
hand. Of every pause and suspension we keep a record: the IP address
(encrypted), when it started, why, and when it was lifted. It is the only thing
we retain from the public chat, and only once a pause has been reached. An
ended pause or a lifted suspension is deleted after 90 days; an active
suspension stays until it is lifted.

**A word of advice:** the public chat is for general questions. It does not
need your name, your CNP or your diagnosis to answer, so do not give them to
it. For your own situation there is the generator, with its protections.

*Basis:* our legitimate interest in providing the service you ask for and in
defending it against abuse (art. 6(1)(f) GDPR).

### 4. The draft generator

Here we ask, in conversation, for everything a claim needs:

- what you write in the conversation and your personal account, in your own
  words;
- the details of the claim: name, chosen name, CNP, the series of your identity
  card and birth certificate, address, county, date and place of birth, the
  court;
- details from medical reports: numbers, dates, the doctor, the clinic;
- documents you upload, if you choose to;
- the details of any witnesses you propose (it is your responsibility to inform
  them);
- your email address, if you choose to save your progress or to be contacted
  about your feedback;
- the IP address you work from, the country code and the kind of device (phone,
  tablet, computer), from the moment you accept, not before.

Some of this is **data concerning health** within the meaning of art. 9 GDPR,
and the CNP is a **national identification number**, given special protection
in Romanian law. We process it only with your **explicit consent**, which we ask
for before we start and which you can withdraw at any time (see "Your rights").
You can choose the **anonymous** route: then we do not ask for your name, CNP
or address, and the draft carries blank ruled lines for you to fill in by hand.

We use it to build the draft, to show you an indicative review of the case, and
so you can come back to it. The review is informative: we take no decision with
legal effects about you, automated or otherwise.

**Your date of birth** is asked at the start to check that you are at least 18.
Under 18 the generator stops: the drafting tools are withdrawn for the rest of
the session, and the content of the session (date of birth included) is deleted
automatically 30 days after the last activity, not 365.

**What reaches Anthropic:** the text of the conversation, the form answers and
the uploaded documents, so they can be read and the draft can be written. An
uploaded document is sent once, at upload; after that we keep and reuse only
the text extracted from it, never the file. We do not send your IP address,
your email address, your country or your device. Anthropic processes the data
as a processor under a data processing agreement, does not use it to train
models, and keeps it only for a limited period under its own policy.

*Basis:* your explicit consent (art. 6(1)(a) and art. 9(2)(a) GDPR) for the
content of the session; our legitimate interest (art. 6(1)(f)) for the IP
address, country and device, which we use to see where and how much the site is
used and to recognise abuse. We build no profiles and combine this data with
nothing else.

### 5. Saving your progress by email

If you choose to save your progress, we send an 8-character key to the address
you give us. The email goes out through **Resend** (Resend, Inc.), which
receives your address and the content of the message in order to deliver it.
With us, the address is encrypted and the key is not stored at all: we keep only
a fingerprint of it, so we can replace it but never read it back to you. The
address is used only to resume the session and, if you ticked the box, to
contact you about the feedback you left.

*Basis:* your consent, given by choosing to save (art. 6(1)(a) GDPR).

### 6. Feedback

After you receive the draft you can leave a rating from 1 to 5 stars and a
comment. The comment is encrypted. If you tick that we may contact you, we use
the session's email address; if there is none, we ask for it then.

*Basis:* your consent (art. 6(1)(a) GDPR).

### 7. Errors and operations

When something breaks, the error report goes to **Sentry** (Functional
Software, Inc.). We send it scrubbed: no request body, no cookies, no headers,
no local variables and no user data; what remains is the type of error, the
place in the code and a technical identifier. We do not reproduce problems on
your real data.

*Basis:* legitimate interest (art. 6(1)(f) GDPR).

### 8. The doctor directory

The directory is a public list of doctors, built by the community, with reviews
written by visitors.

**If you submit something** — a review, or a new doctor — we ask for an email
address and send a code to it. Nothing is published and nothing is kept until
you confirm the code: an unconfirmed submission deletes itself after a day.

Once you confirm, we keep: what you wrote (public), your email address
(encrypted, never shown on the site), an irreversible fingerprint of that
address and of your IP address — the first so that ten reviews of one doctor
cannot come from one person, the second against spam — and the moments you
ticked the two boxes.

**We keep your email address for as long as the review stands.** There is one
reason for it: if the doctor disputes the review, we have someone to ask. We do
not use it for anything else, we give it to nobody, and it appears nowhere on
the site — **but if a court orders us to hand it over, we have to.** Write
knowing that. When a review is deleted, the address goes with it.

**Your review passes through an automatic filter** before it appears: the text
goes to Anthropic, which returns only "clean" or "hold" plus a reason from a
fixed list. Anything clean is published straight away, without anyone here
reading it; anything held is read by a person first.

*Basis:* your explicit consent (art. 6(1)(a) and art. 9(2)(a) GDPR) for
publishing the text — an account of your own healthcare says something about
you, which is why we ask for that separately from your statement that you were
there. For the anti-spam fingerprints: legitimate interest (art. 6(1)(f)).

### 9. Donations

The support button leads to **Buy Me a Coffee**, an external service with its
own privacy policy. We do not receive or see your payment details.

## If you are a doctor listed in the directory

This section is for you even if you have never been on this site. Someone else
added the details about you; you gave us nothing and we did not ask you. Here is
everything you need to know (art. 14 GDPR).

**What we publish:** name, specialty, clinic or hospital, city and county,
whether the visit is reimbursed by the national insurance house, a description
written by the person who added the entry, and how to book — the clinic's
booking page or its contact number.

We do not publish your personal number, your home address, your personal email
or your schedule. The booking field is for the practice's public contact; if
somebody puts a personal number there we take it out, and the automated
screening usually holds the entry before it appears at all.

Reimbursement is a fact about the practice, not a judgement about you, and it is
what the person who added the entry reported — if it is wrong we correct it on
request, like any other field.

**Where we got it:** from sources that were already public — the site of the
clinic where you work, or the College of Physicians' register of doctors. We ask
for a link on every entry and show it on the entry's own page. It is not
mandatory, though: where there is none, the page says plainly that the
information came from the person who added the entry, so nobody reads it as
something we checked.

**On what basis:** legitimate interest (art. 6(1)(f) GDPR) — people looking for
care need to know who exists and where. Your consent is not required for that,
but that does not leave you without recourse.

**What you can ask for:**

- **To object (art. 21 GDPR).** At any time, on grounds relating to your
  situation. Write to **contact@transgen.ro**. In practice: in almost every case we will
  take the entry down without argument. You do not have to convince us and we
  will not ask for reasons. If we do refuse, we will write to you and say why —
  and we write it down at our end too, because an unreasoned refusal is not a
  valid one.
- **To correct it.** If the specialty, clinic, city or reimbursement is wrong,
  we change it.
- **To have a review taken down.** If a review is false, if it states as fact
  something that did not happen, or if you simply tell us that person was never
  your patient — we look into it, and if we cannot verify it, we delete it.
- **To see what we hold about you** (art. 15) and to complain to ANSPDCP.

A withdrawn entry stays withdrawn: the next visitor cannot put it back.

## Who else sees the data

Nobody outside the list above. We do not sell, rent or give your data to anyone
else, and we do not use it for marketing.

| Provider | What it receives | Where | Role |
|---|---|---|---|
| Render | everything stored (encrypted) and the traffic | Frankfurt, EU | hosting |
| Anthropic | the text of conversations, form answers, uploaded documents, submitted review text (for filtering) | USA | the language model |
| Cloudflare | IP address, browser signals | EU/USA | bot check |
| Resend | email address, the email with the key or the confirmation code | USA | sending email |
| Sentry | scrubbed error reports | EU/USA | technical errors |

**Transfers outside the European Union.** Anthropic, Cloudflare, Resend and
Sentry are United States companies. The transfer relies on the EU-U.S. Data
Privacy Framework, where the provider is certified, or on the standard
contractual clauses approved by the European Commission, included in the data
processing agreement with each. You can ask at **contact@transgen.ro** for details of the
safeguards that apply.

Data may be disclosed to an authority only where the law obliges us to. It has
not happened, and we would tell you if we were allowed to.

## How long we keep it

| What | How long |
|---|---|
| The public chat conversation | not saved |
| Anti-spam fingerprints and the message limit | at most one hour |
| The bot-check cookie | 12 hours |
| A generator session: conversation, details, files, drafts, email, key | **365 days from your last activity**; coming back restarts the clock |
| A session belonging to someone under 18 | 30 days from the last activity |
| The session cookie | 1 day, renewed on every visit |
| Ended pauses and suspensions | 90 days after they ended |
| Active suspensions | until we lift them |
| An unconfirmed directory submission | one day, then it deletes itself |
| The email address behind a published review | as long as the review stands; deleted with it |
| Directory fingerprints (email, IP address) | as long as the entry stands |
| Directory entries and reviews | no fixed term, until withdrawn or deleted |
| The residual record (see below) | no fixed term, until we delete it |

**On expiry** the conversation, the details of the claim, your account, the
files, the drafts, the email address and the resume key are deleted
automatically.

**What remains after that is a residual record**, with no content in it: the
session's dates and times, how many messages, files and drafts there were,
whether it was anonymous, the feedback rating and comment (if you left any), the
country code, the device label and the IP addresses the session was used from
(encrypted). No name remains, no detail of the claim, no draft, no message. We
keep it to see how the site is used over time and to be able to recognise and
refuse abuse.

## How we protect it

- Everything saved on the server (the database, the uploaded files) is
  **encrypted on disk**. Without the encryption key the generator refuses to
  start rather than write in the clear.
- The connection between your browser and the server is encrypted (HTTPS).
- The admin area is protected by a password and a two-step authentication
  code, one person has access, and every opening of a session is recorded.
- A draft can be opened only from the session that produced it, not by anyone
  who has its address.
- Uploaded documents are read once; the file is not sent anywhere again.

To be precise about what encryption buys: it protects a backup, a stolen disk
or a leaked database file. It does not protect against someone compromising the
running server, where the key is available.

If a security breach occurred that was likely to put you at high risk, we would
inform you directly, where we can, and notify the supervisory authority, as the
law requires.

## Your rights

Under the GDPR you have the right:

- **of access** to your data and to a copy of it;
- **to rectification**, if something is wrong;
- **to erasure**;
- **to restriction** of processing;
- **to portability**: to receive the data you gave us in a common format (the
  draft can be downloaded at any time as text, Word or PDF);
- **to object**, for processing based on legitimate interest;
- **to withdraw your consent** at any time, without affecting what was
  processed before.

All of them are exercised by email to **contact@transgen.ro**. We answer within a month
at most. So as not to hand data to someone else, we may ask you to write from
the address you saved the session with, or to tell us the resume key.

### Deletion, concretely

The **"Start from scratch"** button on the generator page closes the
conversation, invalidates the resume key and deletes the IP addresses tied to
the session, but it does **not** delete the conversation from the server: it is
the withdrawal of consent, not erasure.

To have the data deleted, write to us. We delete the conversation, the details
of the claim, your account, the files, the drafts, the email address and the
key, and confirm it to you.

What we do **not** delete on request is the residual record described above:
the session's times and counts, the feedback, the country, the device and the
encrypted IP addresses, plus the pause or suspension records. We keep them on
the basis of our legitimate interest in recognising and refusing abuse and in
knowing how the site is used; an erasure request cannot be the way a suspension
disappears. They contain nothing you wrote and identify you by nothing but the
address. You can object to this retention too; we answer with reasons, and if
our ground does not outweigh yours, we delete the record as well.

### Complaints

If you think we are not respecting your rights, you can write to us first. You
always have the right to lodge a complaint with the Romanian supervisory
authority, the **National Supervisory Authority for Personal Data Processing
(ANSPDCP)**, B-dul G-ral. Gheorghe Magheru 28–30, Sector 1, Bucharest,
[dataprotection.ro](https://www.dataprotection.ro), anspdcp@dataprotection.ro.

## Cookies and browser storage

We use only what is strictly necessary for the site to work, which is why we do
not ask for your consent for them:

| Name | Purpose | Lifetime |
|---|---|---|
| `tg_verified` | remembers that you passed the bot check | 12 hours |
| `tg_session` | ties your browser to your generator session | 1 day, renewed |
| `tg_admin` | admin only | 8 hours |

In the browser we also keep the theme you chose (light/dark) and a flag that
Celeste has already said hello in the current tab. Neither identifies you and
neither leaves your device.

## Minors

The guides and the chat can be read by anyone. The draft generator is only for
people aged 18 or over; below that age it stops, and the content of the session
is deleted sooner, as described above. We do not ask for and do not want data
about children by any other route; if some reached us by mistake, write to us
and we delete it.

## Changes

When we change something in how we process data, we update this page and the
date at the top. A change that matters to people using the generator is also
announced on the generator page. Earlier versions can be requested at
**contact@transgen.ro**.