Privacy Policy
How Neuro handles personal data
Version 1.0 · effective 13 October 2026
UIC 203427625
reply within one month
Western Europe region
www.cpdp.bg
1. Who we are
The controller is NEURO Ltd, UIC 203427625, 146B Vitosha Blvd, 1463 Sofia, Bulgaria, e-mail info@neuro.bg. We process personal data under the GDPR and the Bulgarian Personal Data Protection Act.
2. What we process and why
| Who / what | Data | Purpose | Legal basis |
|---|---|---|---|
| Contacts at medical institutions, physicians | Name, position, institution, business contact details, order and contract history | Offers, public procurement procedures, deliveries, invoicing, customer service | Contract (6(1)(b)); legitimate interest (6(1)(f)) |
| Patients (indirectly) | Minimum identifiers on usage reports, implant and incident records (e.g. history number, date of surgery, device UDI) | Traceability, invoicing of consignment use, vigilance and recalls | Legal obligation under the MDR and the Bulgarian Medical Devices Act (6(1)(c)); Art. 9(2)(i) GDPR |
| Healthcare professionals in compliance records | Identity, institution, educational support provided | MedTech Europe Code compliance | Legitimate interest (6(1)(f)) |
| Job applicants | CV, qualifications | Recruitment | Steps before a contract; consent for keeping a CV for future roles |
| Website visitors | IP address, browser data, necessary cookies | Operating and securing the website | Legitimate interest (6(1)(f)) |
3. Patient data
We do not need patients' names; we ask institutions to provide only the minimum information required for traceability and vigilance. Staff attending procedures are bound by confidentiality.
4. Recipients
Manufacturers, the Bulgarian Drug Agency (BDA) and other competent authorities where required, group companies for internal administration, carriers, IT providers acting as processors (Microsoft (Microsoft Azure, which hosts our business platform and website, with data located in the Western Europe region; and Microsoft 365 for e-mail and documents)), accountants, auditors, banks and the National Revenue Agency (NRA). Transfers outside the EEA only with appropriate safeguards.
5. Retention
Traceability records of implantable devices: 15 years; other devices: 10 years (MDR). Accounting records: 10 years under the Accountancy Act. Customer contact data: for the business relationship and 5 years after. Unsuccessful applications: 6 months unless the applicant consents to longer.
6. Your rights
You may exercise the rights under Articles 15–22 GDPR by writing to info@neuro.bg; we reply within one month. You may lodge a complaint with the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia, www.cpdp.bg.
7. Cookies
We use only cookies strictly necessary for the website. We do not use analytics, advertising or tracking cookies. The website does not take online payments.