Health data: how we use it

Health data belongs to the GDPR’s “special categories” and is given extra protection. This page explains in plain words which health data of yours we use, why, who sees it, where it is stored and for how long. It is information: you don’t need to agree to anything. For your other details, see the Privacy policy.

Which health data

• What you tell us about your health (e.g. in the booking note, on the phone or at your first assessment).
• The therapist’s notes on your assessment and progress.
• The exercise programmes we give you and the log of exercises you complete.
• Your appointment history and, as far as needed, your session packages and payments: even the fact that you have physiotherapy is information about your health.

For what purpose

Only for your treatment: to plan your treatment, follow your progress, organise your appointments and give you your exercise programmes on your phone. We never use health data for advertising or promotional messages, and we never sell it or give it to third parties for their own purposes.

On what legal basis

Processing for your treatment is not based on consent. It is based on:

• the contract for your treatment (GDPR Art. 6(1)(b));
• the provision of health care by a health professional bound by professional secrecy (GDPR Art. 9(2)(h) and 9(3)), with the safeguards of article 22 of Greek Law 4624/2019.

That is why there is no “I consent to my health data” box at sign-up or when you book. If you gave such a consent in the app in the past, you don’t need to do anything: your treatment carries on as normal on the basis above.

Professional secrecy and who sees it

The therapist is bound by professional secrecy. Only she and, if there are any, clinic staff who need it for their work have access to the clinic’s management system; they too are bound by professional secrecy or by a written duty of confidentiality. In the app you see your own programmes and the notes the therapist has chosen to share with you.

Emails and notifications to you mention the date, the time and the type of treatment (for exercise reminders, the programme title). The therapist’s notes are never sent by email or notification. To organise her schedule, the clinic receives an email for every booking, change or cancellation you make and sees appointments in its calendar (name, phone, treatment, time). Technical providers (hosting, database, email delivery) process the data only on our behalf; they are described in the Privacy policy. Public authorities receive data only where the law requires it.

Where it is stored

In the app’s database (Supabase), on servers in Ireland (EU), with encrypted connections, encryption on the servers and access control at database level: each client can only see their own data. Backups are described in the Privacy policy (section 5).

For how long

We keep your treatment record and appointment history for as long as our obligations as health professionals require patient records to be kept and then delete or anonymise them. If you delete your account, the record is not erased before that period ends, but it is used for nothing else.

Your rights

You can see and download your data (in the app, with the “Download my data” button; for a full copy of your record, ask the clinic), ask for correction, restriction or erasure, and object to processing where applicable. For treatment data, erasure, restriction and objection are limited for as long as the duty to keep the record applies. Email us at info@resetlab.gr: we reply within one month at the latest. If you believe we have not respected your rights, you can lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr). All your rights: Privacy policy (section 7).

Optional consents, outside treatment

We will ask for your explicit consent (GDPR Art. 9(2)(a)) only for uses that are not part of your treatment, if they ever come up, for example:

• to publish a review of yours that mentions your health;
• to describe your case anonymously in an article.

We will ask you separately, at that moment, for that specific purpose. If you say no, your treatment is not affected in any way. If you say yes, you can withdraw at any time by emailing info@resetlab.gr, and from then on we stop that use (e.g. we remove the review). Withdrawal does not affect anything lawfully done before it.

Notifications about new articles and about announcements and offers are optional too, and off by default: see the Privacy policy (section 3).

Parents and guardians

For children and teenagers under 18, the account is created and managed by a parent or guardian. They also exercise the rights described here and, if one of the optional consents is ever needed, decide on it.