Privacy Policy

Version 2.3, in force from 26 October 2026. Operator: Edunat Health SRL.

This is a translation. The Romanian version is the legally binding one: Politica de confidențialitate.

In short: we do not ask for your personal identification number (CNP), your full name or your address. Your data is kept on our own servers in the European Union. We do not sell it, we do not give it to anyone for advertising or any other purpose, and we do not use analytics or advertising software from other companies. To improve the Platform, we ourselves look, on our own server, at which sections are used and where errors occur. You can download or delete your data at any time, from your account.

1. Who is responsible for your data

The data controller is Edunat Health SRL, tax identification number (CUI) 41308912, Trade Register number J2019002661359, with its registered office at Str. Mărului, Chișoda, Timiș County, which provides MentorSano - Health Compass under the MentorSano brand. For any question or request about your data: portal@mentorsano.ro, telephone 0371 231 331.

2. What data we hold

• For your account: your first name, the initial of your surname and your email address. Your full name only if you give it to us, for example so that we can link a subscription you have bought to your account.
• About your health, only what you choose to write or upload: your answers to questionnaires, your test results and medical documents, your messages, the daily journal (sleep, energy, symptoms), photos and descriptions of your meals, and your food preferences and allergies.
• What your specialist prepares for you: the plan, the meal plans, the steps for each week, the recommended tests and the assessment of your meals.
• Technical data, for the security of your account: a technical fingerprint of your browser (so that we can recognise your device without a password), your PIN (stored only as a cryptographic fingerprint, which we cannot read), your IP address, your browser type, the times you signed in, and a log of who has viewed your data.
• How you use the Platform: which sections you open and how long you spend in them, what you do there (for example, that you ticked off a habit or submitted a questionnaire) and the technical errors that occurred on your page. This data does not include what you wrote or your answers.
• From the Oura ring or the Whoop band, only if you connect them yourself in “Connected devices”: the sleep score, HRV, resting heart rate, hours slept, the readiness score (Readiness on Oura, recovery on Whoop), the deviation of your body temperature (Oura only), the sleep stages (deep, REM, light, awake), how long you took to fall asleep, sleep efficiency, the times you went to bed and woke up and, from Oura, the steps of each day and the day's stress (the minutes of high stress and of recovery), for the last 30 nights when you connect it, then for the new nights, once a day in the morning and when you open the journal. You see them in the journal and can change them before you submit it. We compare them, by fixed rules, with your own average over the last 30 nights: you see in Progress, under “Your sleep”, each night against your usual, next to how rested you said you felt in the journal, and what goes with your better nights (including the days you walked more than usual), and the measured stress next to the stress you note in the journal; yesterday's steps come filled in in your journal. Your specialist sees the same nights in your file, and also sees when your pulse and HRV move away from your average for several nights in a row. We do the same with the values you type into the journal from another watch or band.
• Commercial data, only if you have a subscription: the plan you chose, your payments and your invoices. Your card details never reach us.

3. Why we use it and on what legal basis

• Your account and the service you asked for (the plan, the meal plans, the messages): the contract between us, Article 6(1)(b) GDPR.
• Health data: your explicit consent, Article 9(2)(a) GDPR, given separately when you sign up. See Processing of health data.
• The security of your account (the device fingerprint, the access log, the limits on attempts): our legitimate interest, and yours, in keeping the data away from others, Article 6(1)(f) GDPR.
• Improving and developing the Platform (which sections are used, how far people get, where errors occur): our legitimate interest in fixing what does not work and making the Platform easier to use, Article 6(1)(f) GDPR. We read this data in aggregate, as figures (for example, “how many people opened the meal plan this week”), not to follow any particular person. We do not use this data for advertising and we do not give it to anyone else. You may object at any time; see My rights.
• Invoices and accounting records: a legal obligation, Article 6(1)(c) GDPR.

We do not send you advertising and we do not use your data for any purpose other than those listed above. The emails we send you are part of the service: the access link, reminders about your journal and your plan, and, when your specialist sends you a reply, a meal plan or the step for the week, its text, so that you also have it in your inbox. The subject line of our emails never contains information about your health.

4. Automated decisions

We do not take automated decisions that produce legal effects concerning you or that similarly significantly affect you. The results of the short questionnaires are calculated according to fixed rules and only show you where to pay attention. The plan, the meal plans and the recommendations are prepared and approved by a person. See How we use artificial intelligence.

5. Who sees your data

Only the specialist who follows your plan and, strictly for maintenance and security, the people who administer the Platform technically. Every time your file is opened, this is recorded in an access log.

We do not sell your data, we do not give it to commercial partners, laboratories, pharmacies, insurers or employers, and we do not use it for advertising. We work with technical providers (server hosting, email delivery, software used by your specialist), who receive only what is necessary for their service and are bound by confidentiality. Details are in Sharing data with partners.

When you press a purchase button in the Platform, the minuneanaturii.ro shop receives only the list of products (the code of each product and the quantity) and an anonymous key for the list. The shop does not receive your name, your email address or your health data.

If you connect your Oura ring or your Whoop band, we ask Oura or Whoop for the sleep data of the nights we do not have yet, at most 30 nights back, using the key you give us when you approve the connection on their page. From Whoop we also take the night’s recovery (the recovery score, HRV and resting heart rate). We send them only that key and the dates of the nights, nothing from your file. What is in your Oura or Whoop account remains under their rules (Ōura Health Oy, Finland; WHOOP, Inc., United States). You can disconnect at any time in “Connected devices”: we then delete the key and ask them to revoke it.

We disclose data to the authorities only where the law requires us to.

6. Where your data is kept

The servers and the backup copies are in the European Union. If a technical provider processes data outside the European Economic Area, the transfer takes place only under the conditions of Chapter V of the GDPR.

7. How long we keep it

• Account and file data: for as long as you have an account. When you delete it, the data is erased immediately.
• An account in which nothing has happened for 90 days (neither you nor your specialist has opened it) is deleted automatically, together with everything in it.
• The IP address and browser data in the access log: 90 days, after which they are removed from the log.
• Which sections you used and the technical errors: for as long as you have an account; they are erased together with it.
• Photos of your meals: 120 days, after which they are deleted automatically; only their assessment remains.
• Sleep data taken from Oura or Whoop: for as long as you have an account, like the rest of the journal. The connection key is deleted when you disconnect the device.
• Unconfirmed sign-up requests: deleted within 48 hours.
• Daily backup copies: these are overwritten in their normal cycle, so deleted data also disappears from them after a period of time.
• Invoices: for as long as accounting law requires.

8. How we protect it

• the data is kept on servers we administer ourselves, in the European Union;
• the connection to the Platform is encrypted (HTTPS);
• you sign in with a link sent by email, a PIN and your recognised device, not with a simple password; entering the wrong PIN several times blocks access temporarily;
• access to the data is restricted and every access is logged;
• we make daily backup copies and check that they can be restored.

If an incident nevertheless occurs that puts your data at risk, we will notify you and the supervisory authority, as the law requires.

9. Your rights

You may at any time request a copy of your data, rectification, erasure, restriction of processing or data portability; you may object to processing and you may withdraw your consent. You can do most of this yourself, from your account. Everything is explained in My rights and managing my data.

If you believe we have not respected your rights, you may lodge a complaint with the Romanian Data Protection Authority (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, dataprotection.ro).

10. Changes

We update this policy when what we do with your data changes. If the change is significant, we will let you know in advance.