Privacy Policy

At Reset Lab we respect your privacy. This page explains in plain words which personal data we process when you visit the website, book an appointment or use our app, why, for how long and what your rights are, under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Greek Law 4624/2019.

1. Who is responsible for your data

The data controller is Reset Lab by Marianna Malevri (Marianna Malevri, Physiotherapist), Rea 2,166 71 Vouliagmeni, Greece. For anything about your data: info@resetlab.gr, phone +30 697 005 3622.

2. What data we process

• Contact details: full name, mobile phone, email, preferred language, and anything you send us through the contact form. Please don’t write health details in the form; we’ll talk about them at your appointment.
• App account: email and password. Your password is never stored in readable form, only as an irreversible cryptographic fingerprint (hash).
• Appointments: date, time, treatment, status (e.g. completed, cancelled) and anything you write when booking. Even the fact that you book physiotherapy is information about your health, so we protect your appointment history in the same way as health data.
• Health data (special category): the therapist’s notes on your progress, exercise programmes, the log of exercises you complete and health information you give us.
• Financial data: payments (amount, date, method: cash, card, IRIS) and session packages.
• Acceptance of terms and your choices: when you accepted the Booking terms and which version, in which language and where (sign-up, booking or an invitation from the clinic), and when you turned notifications about new articles and about announcements and offers on or off.
• Notifications: if you turn them on, a technical identifier of your device created by your browser (push subscription), your browser and device type, and your preferences (which notifications you want).
• Technical operation and security data (logs): Cloudflare, Supabase and Resend log for a short time IP addresses, the time and type of requests to the servers, and email delivery details (e.g. recipient, subject, whether it was delivered), so that the service works, errors can be found and abuse can be prevented.

We use no advertising tools or pixels, and we never sell or share data for advertising. We measure aggregate visitor statistics (Cloudflare Web Analytics) only if you accept in the cookie notice (see section 9).

3. Why we process it and on what legal basis

Backups have the same legal basis as the data they contain. We do not ask for your consent for your treatment: what this means for your health data is explained on the Health data: how we use it page.

This policy is information for you; it is not something you “accept”. When you create an account or book online, the only thing you accept is the Booking terms.

Notifications about new articles and announcements. These are promotional, so they are off by default. The app asks you once whether you want them, with a separate switch for “New articles” and for “Announcements and offers”. You can turn them off at any time in Account → Notifications, as easily as you turned them on, and we record when you turned them on or off. These switches do not affect service messages.

4. Who has access

Only the therapist and, if there are any, clinic staff who need it for their work (e.g. for appointments) have access to the clinic’s management system. All of them are bound by professional secrecy or by a written duty of confidentiality. When you book or cancel an appointment, staff also receive a notification on their devices. In the app you only see your own details, your appointments, your programmes and the notes the therapist chose to share with you. To run the service we use the following providers (“processors”), under contracts that require them to protect the data and use it only on our instructions:

• Supabase: database, accounts, files and backups, on servers in Ireland (EU).
• Cloudflare: hosting of the website, the app and its functions, forwarding of the clinic’s email and, only with your consent, visitor statistics (see section 9). It runs on a global network, so processing may also take place outside the EU.
• Resend: sending emails (confirmations, reminders, password resets, and contact-form messages to the clinic) from servers in the EU.
• Your browser’s notification services (Apple, Google, Mozilla, Microsoft): deliver push notifications to your device. The content travels encrypted, so these services cannot read it.
• Google (the clinic’s Gmail and Google Calendar): when you book, change or cancel an appointment, the clinic receives an email with your name, phone, email, treatment and time, so that it appears in its schedule.
• The clinic’s calendar feed: the clinic’s appointments are shown in the therapist’s calendar app (e.g. Google Calendar) through a private link, so that she can see her schedule. The feed contains appointments from 30 days back to 180 days ahead, with name, phone and treatment. The link is changed straight away if needed.
• The clinic’s accountant, only the data required by tax law.
• Public authorities, only where the law requires it.

Cloudflare, Supabase and Resend also keep logs of their own operation for a short time, for security and to find errors (legitimate interest, see sections 3 and 5).

Some providers (Supabase, Cloudflare, Resend, Google) are companies based in the USA. Where access or a transfer outside the EU may occur, it relies on the EU-US Data Privacy Framework for providers certified under it and, where that does not apply, on the European Commission’s Standard Contractual Clauses.

5. How long we keep it

• App account (sign-in, notification devices, preferences, “Updates”): while it is active. When you delete it, all of this is deleted immediately.
• Treatment record and appointment history: for as long as our obligations as health professionals require patient records to be kept, after which it is deleted or anonymised.
• Financial records: as long as tax law requires.
• Records of your acceptance of the terms and of your notification choices: together with your record, for as long as we keep it.
• Contact-form messages: they reach the clinic by email and in its management system, where only the clinic can see them and reply to you. They are deleted automatically after 12 months (or earlier, once the conversation is over).
• Our providers’ logs: for a short time, as set by each provider, and then deleted automatically.
• Backups:
  • Every night a copy of the app’s data is made in private storage in the EU (Supabase). The copies from the last 30 days are kept; older ones are deleted automatically.
  • Our database provider (Supabase) also keeps its own daily backups, for 7 days.
  • The clinic also keeps a copy on its own computer, protected by password and encryption. In the clinic’s backup folder, automatic copies older than 30 days are removed when the admin area is opened on that computer. Copies downloaded manually stay wherever they were saved until the clinic deletes them.

6. How we protect it

• Encrypted connections (HTTPS) everywhere and encryption of data on the servers.
• Access control at database level: each client can only see their own data and only the clinic’s staff accounts can see everything.
• Passwords stored only as irreversible hashes, and email confirmation for every new account.
• Emails and notifications to you mention the date, the time and the type of treatment (for exercise reminders, the programme title). If the therapist sends you a personal message, the notification may show its beginning. The therapist’s notes are never sent by email or notification; they stay in the database only. If other people can see your phone screen, you can hide notification content in your phone’s settings.
• Daily backups.

7. Your rights

You have the right to:

• access and portability: in the app, the “Download my data” button gives you a file with the data you see there, straight away. For a full copy of your record, ask the clinic;
• rectification: change your name, phone and language in your profile, or ask us to correct anything else;
• erasure: the “Delete account” button deletes your account immediately and cancels future appointments. Data we must keep (e.g. treatment record, financial records) is kept only as long as required and is used for nothing else. Deleted data remains in the backups, with no other use, until those are deleted too as described in section 5;
• restriction of processing and objection, where applicable. For treatment data, erasure, restriction and objection are limited for as long as the duty to keep the record applies;
• object to promotional messages: at any time and without giving a reason, by turning off the switches inAccount → Notifications or by email. From then on we send you none;
• withdraw consent where processing is based on it (notifications about new articles and announcements, visitor statistics, the map, and any optional use we asked you about separately), at any time and as easily as you gave it, without affecting the lawfulness of processing before the withdrawal. Treatment data is not based on consent; the other rights in this list apply to it.

For any of the above, email us at info@resetlab.gr: we reply within one month at the latest. If you believe we have not respected your rights, you can lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).

8. Children

For children and teenagers under 18 in treatment, the account is created and managed by a parent or guardian, who also accepts the Booking terms and exercises the rights in section 7. If an optional consent is ever needed for the child, the parent or guardian decides on it. We do not send promotional messages (new articles, announcements, offers) to minors.

9. Cookies and storage on your device

This website has no advertising cookies. Fonts and photos are served from our own server. Anything that is not necessary loadsonly if you allow it in the notice shown on your first visit. There “Accept” and “Reject” carry equal weight, and with “Reject” the website and bookings work normally. You can change your choice at any time via “Cookie settings” at the bottom of every page. If you reject, we ask again at the earliest after 6 months; if you accept, after 12 months or when something in this section changes.

With your consent

• Visitor statistics (Cloudflare Web Analytics). We measure in aggregate which pages are read and how fast they load. Your browser sends Cloudflare Inc. the page you open and where you came from, load times, browser and device type and a random ID for that page load. Cloudflare also receives your IP address and processes this on our behalf (as our processor), possibly with transfer to the USA under the EU-US Data Privacy Framework. It sets no cookies. It never loads on the booking pages, in the app or in the admin area. Legal basis: your consent (Greek Law 3471/2006 art. 4(5), GDPR art. 6(1)(a)).
• Google map on the Contact page (Google Ireland Ltd.). It loads only if you press “Show Google map” or turn it on in the settings. Google then receives your IP address and browser details and may store cookies for its own purposes, possibly with transfer to the USA. For collecting and transmitting this data at the moment the map loads we are joint controllers with Google; for anything Google does afterwards, Google alone is responsible (policies.google.com/privacy).

Necessary (no consent needed, because what you asked for does not work without them)

The language stays on the device after you sign out. You can also remove all of the above in your browser settings (“Clear site data”).

10. Changes

If anything important changes in this policy, you will see it here with a new date and, if you have an account, we will let you know in the app. If a change affects something based on your consent, we will ask you again.