Last updated: 4 Sep 2026
Xalyra is operated by Claudiu Coca (Romania). Businesses using Xalyra (clinics, salons, similar) are the data controllers; Xalyra is the processor.
Data processed: contact details, appointment + operational data, the records a business keeps (notes, documents, clinical/health data and images where applicable), staff account data.
Legal basis: providing the Service (contract) + keeping it secure and lawful (legitimate interest). Health data is processed on the business's instruction for the provision of health care. No sale of data, no advertising.
GDPR rights: access, rectification, erasure, restriction, portability, objection. Patient/client: contact your business — it is the controller. Platform: contact@xalyra.app. Complaints: ANSPDCP (dataprotection.ro).
Retention: Law 16/1996 (National Archives) + HG 2139/2004 (archive nomenclator) for clinical records (5–100 years per record type); Law 82/1991 for accounting/billing (10 years); Law 46/2003 + CMSR Code of Ethics (~5 years from last contact, dental) and sectoral Ministry of Health orders. Photographs of patients per Order MS 1410/2016 Art. 7 — diagnosis/treatment/defense permitted without consent; any other purpose requires the Annex 1 written consent. Records are deleted or anonymised after retention expires; the business decides when it has met its retention obligations.
Storage: EU/EEA where applicable. A business may connect its own external storage, in which case that storage is under the business's control.
Service provided as is. Lawful use only; access only data you are authorised to.
Accounts: for authorised staff of a business. You are responsible for keeping credentials secure.
Features may change; we will avoid losing your data without notice.
Full ToS and DPA accepted by each business are linked under Full documents below.
Sub-processors engaged to run the Service: Romania-Webhosting (ClausWeb), RO — application hosting, DNS + primary data storage (EU). Resend, EU region — transactional and notification email. Stripe Payments Europe Ltd., Ireland — payment processing for businesses opted into platform billing. Google LLC (Google Drive) — encrypted off-host backup storage; provider sees opaque encrypted blobs. Authoritative list in the Sub-processors document below.
The authoritative documents accepted by each business:
Terms of Service · Data Processing Agreement (GDPR Art. 28) · Sub-processors