Privacy Policy

1. What personal data we collect

• Contact data: name, phone number, email address.
• Health data: medical history, health condition, contraindications, session notes and other health-related information.
• Booking data: date and time of booking, type of service, payment information (invoice number, payment confirmation).
• Communication data: content of emails, SMS messages and other communications you share with us.
• Technical data: cookies, IP address, browser type and page visit statistics (in anonymous/pseudonymous form only).
• Photo, video and audio materials: the client's likeness (photos, videos) and voice (audio recordings), collected and published for marketing purposes on social media (TikTok, Instagram, Facebook, etc.) only on the basis of the client's separate consent.

2. Legal bases for processing personal data

• Performance of a contract (GDPR Art. 6(1)(b)): Contact and booking data are processed to manage bookings and provide services.
• Consent (GDPR Art. 6(1)(a) and Art. 9(2)(a)): Health data (special category data) are processed on the basis of your explicit consent, which you give when confirming a booking (by accepting our booking and attendance terms) and which you confirm and specify when completing and signing the health questionnaire (intake form). Processing of marketing materials (photos, videos) on social media likewise takes place on the basis of the booking terms and the client's given consent.
• Legal obligation (GDPR Art. 6(1)(c)): Certain data (e.g. invoices) are retained to comply with statutory accounting requirements.
• Legitimate interests (GDPR Art. 6(1)(f)): Anonymous visit statistics are used to improve the website and marketing.

3. How we collect data

• Directly from you (booking form, email, SMS, phone, on-site questionnaire).
• Through the SalonLife booking system (a third-party software service).
• Through Stebby, Kingituste Saar or other intermediary platforms when you use their vouchers or gift cards.
• Through website cookies and analytics (Matomo) — anonymously only.

4. Transfer of data to third parties

We do not sell or share your personal data with third parties for marketing purposes. Data may be transferred only in the following cases:

• Service providers: SalonLife OÜ (booking system) — only to the extent necessary for contract performance.
• Social media platforms: TikTok, Meta (Instagram, Facebook), Google (YouTube) — marketing materials (videos, photos) are shared only where the client has given consent.
• Companies / Employers: Where a client's employer or partner company pays for services on the basis of a consolidated invoice, the data required for invoicing (client name, session time and type) are passed to the relevant company.
• Payment processors: banks and payment companies for settlement transactions.
• Public authorities: to fulfil legal obligations (e.g. tax authority).
• Third-party platforms (Stebby, Kingituste Saar, etc.) process only the data necessary for their intermediary service — under their own privacy policies.

5. Data retention periods

• Health data and session notes: retained for up to 3 years from the last visit or until consent is withdrawn (whichever comes first).
• Invoices and payment data: retained for 7 years in accordance with accounting legislation.
• Contact and communication data: retained for up to 2 years from the last contact.
• Marketing materials (photos, videos): retained until the marketing purpose is fulfilled or until the client withdraws their consent.
• Anonymous statistics: retained indefinitely.

6. Data subject rights

Under the GDPR you have the following rights:

• Right of access: the right to know what personal data we process about you.
• Right to rectification: the right to request correction of inaccurate data.
• Right to erasure ("right to be forgotten"): the right to request deletion of data when there is no lawful basis for processing.
• Right to restriction of processing: the right to request that processing be restricted under certain conditions.
• Right to data portability: the right to receive your data in machine-readable format.
• Right to object: the right to object to processing based on legitimate interests.
• Withdrawal of consent: you may stop consent-based processing at any time by contacting info@mvtherapy.ee. This does not affect the lawfulness of processing before withdrawal. The withdrawal of consent for and removal of marketing materials (videos/photos) posted on social media are subject to the special conditions set out in MV Therapy's booking and attendance terms.

To exercise your rights, please contact: info@mvtherapy.ee. We will respond within 30 days.

7. Cookies

We use the following types of cookies on our website:

• Essential cookies: necessary for the website to function (e.g. session cookies). Their use does not require consent.
• Analytical cookies (Matomo): to measure website usage. We use a self-hosted Matomo solution that does not share data with third parties. Data are anonymised.

You can disable cookies at any time in your browser settings.

8. Data security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction:

• Data transmission takes place over encrypted HTTPS connections.
• Physical documents are stored in locked premises.
• Digital data are protected by access controls.
• Data processing agreements are in place with all third-party service providers.

9. Contact and dispute resolution

For questions, requests or complaints, please contact:

• MV Therapy OÜ, Viimsi Haigla, Ravi tee 4, 74001 Haabneeme
• Email: info@mvtherapy.ee
• Tel: +372 5818 9561

If you believe your data are being processed unlawfully, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate (AKI): www.aki.ee.

This privacy policy is updated as necessary. Last updated: June 2026.