The website you are viewing, medspacebg.com, is operated by „MedSpace Medical Center“ Ltd., UIC: 207729076, with registered office at: Sofia, Izgrev District, 8 Gen. Shteryu Atanasov St., Entrance B, 2nd Floor, Apartment 8, hereinafter referred to simply as MedSpace for brevity.
This Privacy Notice is intended to provide, in a simple and accessible manner, information regarding the processing of your personal data, the purposes for which the data is processed, the measures and safeguards in place to protect the data being processed, your rights, and how you can exercise them—all to ensure your peace of mind that this is done lawfully, in good faith, and transparently.
I. Controller of Your Personal Data
The controller of your personal data is „MedSpace Medical Center“ Ltd., UIC: 207729076, with registered office at: Sofia, Izgrev District, 8 Gen. Shteryu Atanasov St., Entrance B, 2nd Floor, Apartment 8.
If you have any questions regarding the confidentiality of your personal data processing, you can contact us by sending an email inquiry medspace@medspacebg.com or call us at +359 882 12 12 16.
In the course of its business operations as a commercial entity, MedSpace processes the personal data of individuals („data subjects“) in strict compliance with the requirements of Regulation (EU) 2016/679, the Personal Data Protection Act, healthcare regulations, and the company’s internal policies on personal data protection.
The healthcare facility’s team recognizes the importance of and respects the privacy of the personal data of its patients and business partners; therefore, it takes all necessary measures to protect and process such data in full compliance with national and European legislation.
When it comes to children's data, we take special care and pay close attention.
II. Key Concepts You Should Know
1. „Personal data“ means any information relating to an identified natural person or a natural person who can be identified (such as a name, identification number, location data, or online identifier) („data subject“);
2. „Processing“ means any operation or set of operations performed on personal data or a set of personal data, whether by automated means or otherwise, such as collection, recording, organization, structuring, storing, adapting or altering, retrieving, consultation, use, disclosure by transmission, dissemination, or any other means by which the data becomes accessible, alignment or combination, restriction, erasure, or destruction;
3. „Controller“ means a natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union law or the law of a Member State, the controller or the specific criteria for its determination may be laid down in Union law or the law of a Member State;
4. „Health data“ means personal data related to the physical or mental health of a natural person, including the provision of health services that provide information about the person’s health, as well as any other information contained in medical prescriptions, orders, records, certificates, and other medical documentation.
5. „Recipient“ means a natural or legal person, public authority, agency, or other entity to whom personal data is disclosed in the cases expressly provided for, regardless of whether or not it is a third party.
III. Your personal data is processed by MedSpace for one or more of the following purposes, in accordance with applicable laws and regulations
1. Providing services and/or providing you with the information you have requested about our products and/or services;
2. Compliance with our legal obligations as an outpatient healthcare facility, specifically under the Health Act, the Healthcare Facilities Act, and the subordinate legislation governing their implementation;
3. Compliance with our legal obligations regarding financial reporting under the Accounting Act, the Corporate Income Tax Act, the Tax and Social Security Procedure Code, and other relevant legislation;
4. The conclusion and performance of a contract, as well as for the purposes of pre-contractual relations and correspondence;
5. Other lawful purposes, such as accounting services, maintenance, improvement, and security of the company’s website and software systems; protection of the company’s legitimate interests, including through legal proceedings; and others.
6. Protection of our legitimate interests, such as: selling products and services through our website, providing marketing and/or advertising information, retargeting, creating user profiles for our customers on the website, providing high-quality administrative services, protecting our legitimate interests, and/or other purposes, to the extent that these take precedence over the interests and/or fundamental rights and freedoms of the data subjects.
IV. Personal data is processed on one of the following grounds
1. Your explicit, freely given, specific, informed, and unambiguous consent;
2. Based on the performance of a contract entered into between us or pursuant to statutory provisions, or in connection with our intention to enter into such a contract;
3. Processing is necessary to comply with our legal obligation, to protect your interests or the interests of another person, and to protect our legitimate interests.
Personal data regarding patients' health status is processed by MedSpace for the following primary purposes, in addition to those listed above:
- Processing is necessary to protect the vital interests of the data subject or of another natural person when the data subject is physically or legally incapable of giving consent
- The processing is necessary for the purposes of preventive medicine, medical diagnosis, the provision of health or social care or treatment, or pursuant to a contract with a healthcare professional
- The processing is necessary to protect the public interest in the area of public health (for example, protection against serious cross-border health threats or ensuring high standards of quality and safety in health care, medicinal products, or medical devices).
We guarantee that the specified special category of personal data is collected and processed under the supervision of healthcare professionals who are bound by a duty of professional confidentiality under applicable law.
MedSpace collects the personal data of customers/patients (online or offline) based on voluntarily given consent, a concluded contract, or applicable legal provisions.
Consent that has already been given may be withdrawn by the individual at any time in the same manner in which it was provided, in cases where consent is the sole basis for data processing and there is no other legal basis for processing. The withdrawal of consent does not affect the lawfulness of processing based on consent given prior to its withdrawal.
V. Categories of Individuals Whose Data Is Processed
In connection with the services it provides, MedSpace processes information regarding the following Data Subjects:
1. Individuals who use the Site;
2. Individuals who have submitted inquiries (including by phone), requests, reports, complaints, or other correspondence to MedSpace;
3. Individuals whose information is contained in inquiries (including those made by phone), requests, reports, complaints, or other correspondence sent to MedSpace.
VI. MedSpace processes the following categories of personal data
You decide for yourself whether and how to use the services provided through the website.
The forms used to enter personal data clearly indicate whether providing such data is mandatory or voluntary. Mandatory data is that without which it is impossible to provide the relevant service and/or part of it.
1. In order to provide the information you have requested via the contact form and/or to fulfill your request for a health service, consultation, or home visit, we collect the following basic information about the data subject: name, address, phone number, email address;
2. To create personalized ads for you, to provide remarketing and measure results, and to improve the usability of our website, we collect and process your IP address;
3. When providing the health services you have requested, we also collect the following personal data: personal identification number (EGN), date of birth and/or age, information from an identification document, health-related information—regarding medical conditions and their treatment—and results of various tests—blood tests, X-rays, and others.
4. To ensure the proper course of the treatment process and facilitate more accurate diagnosis, as well as to provide more effective and timely treatment tailored to individual needs, it is sometimes necessary to collect special categories of personal data—information revealing racial or ethnic origin, genetic data, data regarding gender, data regarding sexual orientation, and data regarding social and family identity.
5. Video surveillance is in operation in the public areas of the MedSpace medical facility in Sofia. The video surveillance system was installed to maintain public order, protect the medical center’s property, and ensure patient safety. Signs have been posted in the relevant locations.
The MedSpace website uses the following types of cookies:
We use our own cookies and third-party cookies to manage the content on the site, deliver personalized ads, measure results, and analyze traffic. Learn more about our Cookie Policy.
VII. MedSpace has the right to disclose your personal data to the following potential recipients
1. Competent public authorities in compliance with regulatory requirements, including the Ministry of Health, regional health inspectorates, the National Revenue Agency (NRA), the National Social Security Institute (NSSI), the National Statistical Institute (NSI), or any other government agency that has a legal basis for receiving the relevant data for financial, social security, auditing, and other lawful purposes;
2. Healthcare professionals working at other medical facilities;
3. Subcontractors providing IT support and security for the company's software systems;
4. Courier service providers; payment/banking service providers; marketing/telemarketing service providers; market research service providers; insurance companies;
5. Other individuals, if required by applicable laws and regulations.
Transfer of personal data to a country outside the EU or to an international organization
MedSpace has no intention of disclosing your personal data to third parties without first informing you and obtaining your consent. Data transfers outside the EU are permitted only to companies that have signed standard data protection clauses adopted by the European Commission or a data protection supervisory authority, or contractual clauses authorized by such a supervisory authority.
Social Media
Your access to social media platforms such as Facebook, Instagram, and TikTok, as well as Google, YouTube, Twitter, and others, requires separate registration and acceptance of the terms and conditions of those sites. MedSpace is not responsible for the protection of your personal data upon acceptance of those terms and conditions. Please review the terms and conditions of these sites in detail.
VIII. MedSpace retains your personal data for the following periods
As a data controller, MedSpace processes data for the minimum period necessary to achieve the purposes of the processing and as provided for by applicable law, in accordance with the principle of data minimization.
1. Users’ personal data is stored for the duration of the service and for 5 years following the completion of the service; this also applies to your voluntary consent to communicate with us, for marketing purposes and/or promotional information).
You may always ask us to delete certain information or close your account, and we will respond to that request by retaining certain information, even after the account is closed, when required by applicable law or legitimate interests.
2. Information received from inquiries and messages submitted via the contact forms on our website, via WhatsApp, Viber, email, or SMS—up to 2 months.
3. Personal data contained in accounting documents is retained for the periods specified by law, in accordance with Article 12 of the Accounting Act and other applicable regulations.
4. All documents and information related to the treatment of patients at the medical center and to the monitoring of their medical history are retained in accordance with the time limits specified by law.
5. If there are security video surveillance recordings for the facility in question, they are retained for up to 30 days.
MedSpace stores personal data on physical and/or electronic media, and access to this data is restricted to employees of the healthcare facility who are directly or indirectly involved in its processing or in the relevant medical case.
We have implemented appropriate security measures to prevent the accidental loss, alteration, disclosure, use, and/or unauthorized access to personal data. Our information infrastructure includes safeguards against unauthorized access, and we use state-of-the-art security measures for our databases and software applications. We have also implemented procedures to address any suspected personal data breach and will notify you and the competent authorities of a breach when we are legally required to do so.
IX. Your rights as data subjects are as follows
1. To request access to and a copy of your personal data;
2. To request that your personal data be transferred to another controller;
3. Inaccurate personal data, as well as data that is no longer current, should be corrected;
4. You may request that your personal data be deleted when:
- the personal data is no longer necessary for the purposes for which it was collected
- when you have withdrawn your consent
- when you have objected to the processing
- when the processing is unlawful
- when personal data must be erased to comply with a legal obligation under EU law or the law of a Member State that applies to us as a data controller
- when personal data has been collected in connection with the provision of information society services
5. You have the right to request that the processing of your personal data be restricted; in this case, the data will only be stored but not processed. Our refusal to restrict processing will be explicitly stated in writing, and we are required to provide a lawful reason for such refusal;
6. You have the right to withdraw your consent to the processing of your personal data at any time by submitting a request to MedSpace;
7. You have the right to object to certain types of processing, such as direct marketing (unsolicited promotional messages);
8. You have the right not to be subject to a decision based solely on automated processing, including profiling;
9. You have the right to file a complaint directly with the supervisory authority; for MedSpace, this is the Commission for Personal Data Protection, located at: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd., and website: www.cpdp.bg
If you wish to submit a request, exercise any of your rights listed above, or file a complaint regarding the processing of your personal data by MedSpace, you may do so by contacting us directly via email at: medspace@medspacebg.com, phone: +359 882 12 12 16.
X. Policy on the Voluntary Resolution of Disputes
It is our policy to voluntarily resolve any disputes that may arise regarding the processing of your personal data, and we would therefore welcome it if you first contact our Data Protection Officer before filing a complaint directly with the supervisory authority.
This Privacy Notice was last updated on September 9, 2025, and complies with the General Data Protection Regulation (Regulation (EU) 2016/679) and the Personal Data Protection Act.
To ensure the proper implementation of Regulation (EU) 2016/679, to ensure compliance and the fulfillment of the obligations of the data controller, MedSpace implements all internal procedures and rules required by law.