Privacy Policy

Effective from September 30, 2026

Your privacy and the confidentiality of your health information is very important to me. In this privacy policy, I explain what personal data I process when you use the website zemlinskaphysio.com, apply for an appointment or receive physiotherapy services, for what purposes and what your rights are. Personal data is processed in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), the Personal Data Processing Act, the Patient Rights Act and other regulatory acts of the Republic of Latvia.

1. Manager and contact information

The controller of personal data processing is Yulia Zemlinska, physiotherapist practice (ZEMLINSKA PHYSIO).

• Address: Piestastnes iela 11a, Dzintari, Jurmala, Latvia
• Email: info@zemlinskaphysio.com
• Phone: +371 28821008

For all questions about the processing of personal data, as well as to exercise your rights, please contact us using the contact information provided above.

2. What personal data do I process

• Contact information – first name, last name, e-mail address, phone number.
• Record data – the selected service, the date and time of the visit, the appointment history, the notes you specified.
• Health data – information about your health condition, complaints, anamnesis, examination results, physiotherapy plan and progress you provide in the application, consultation or classes (see section 4 for details).
• Payment and settlement data – billing information, order number, payment amount and status. I do not receive or store bank card data - they are processed by the payment service provider Stripe.
• Customer account data – if you create an account for record management: email address and encrypted password.
• Contact details – the content of your messages that you send via contact form, email, WhatsApp or Instagram.
• Receiving news – e-mail address if you have signed up for news and offers.
• Technical data – information stored in cookies, which is necessary for the operation of the website (see section 8 for more details).

3. Purposes and legal basis of data processing

• Signing up for a visit and managing it (confirmations, reminders, changes, cancellation) – conclusion and performance of the contract (GDPR Article 6, paragraph 1, subparagraph b).
• Provision of physiotherapy services – assessment of health status, planning and carrying out therapy, drawing up individual exercise programs – performance of the contract and provision of health care (Article 6, paragraph 1, subparagraph b) and Article 9, paragraph 2, subparagraph h) GDPR).
• Organizing medical documentation – fulfillment of a legal obligation (GDPR Article 6, Clause 1, subparagraph c, Article 9, Clause 2, subparagraph h) of the GDPR, in compliance with the requirements of the Patient Rights Act and record-keeping of medical documents.
• Billing, invoicing and accounting – performance of the contract and fulfillment of a legal obligation (GDPR Article 6, paragraph 1, subparagraph b) and c)
• Answers to your questions and applications – pre-contractual measures at your request (Article 6(1)(b) GDPR); if you provide health information in a message - your explicit consent (GDPR Article 9(2)(a)).
• Sending news and offers – your consent (Article 6(1)(a) GDPR). You can withdraw your consent at any time by using the opt-out link in the email or by writing to info@zemlinskaphysio.com.
• Ensuring the operation and security of the website, protecting the legal interests of the practice (e.g. in case of disputes) – legitimate interests (GDPR Article 6(1)(f)).

4. Health data

Health data is a special category of personal data, so it is subject to increased protection. I process them only to the extent necessary to provide a quality physiotherapy service and they are only available to me as a medical practitioner who is bound by a professional duty of confidentiality. I disclose information about your state of health to third parties only with your consent or in cases specifically specified in regulatory acts.

Please enter only the information required for the application in the contact form on the website and in the messaging apps. You can discuss detailed information about the state of health during the consultation.

5. Data recipients

Your personal data is not sold. They are transferred only to those service providers (processors) necessary for the operation of the practice, and only to the extent necessary for the provision of a specific service:

• website hosting (hosting) and technical support service providers;
• payment processing service provider Stripe Payments Europe, Ltd. (Ireland) – for online payments;
• e-mail service providers – for sending confirmations, invoices and other notifications;
• newsletter platform - if you have signed up for newsletters;
• accounting service provider - only billing data, no health information;
• state institutions (for example, the State Revenue Service, the Health Inspectorate) - only in the cases and to the extent specified in the regulatory acts.

If you contact me via WhatsApp or Instagram, the operator of these platforms, Meta Platforms Ireland Ltd. processes data in accordance with its privacy policy.

6. Transfer of data outside the EU/EEA

Personal data is mainly processed in the European Union and the European Economic Area. If a service provider (such as Stripe or Meta group companies) transfers data to a country outside the EU/EEA, this happens by applying the protection measures set by the GDPR - the decision of the European Commission on the adequacy of the level of protection (including EU and US data privacy regulation) or standard contract clauses.

7. Duration of data storage

• Medical documentation and health data – within the term specified in the regulatory enactments on record-keeping of medical documents.
• Invoices and accounting supporting documents – Within the period specified in the Accounting Law.
• Registration and customer account data – while you use the services, and no longer than 3 years after the last visit, unless longer storage is necessary to fulfill the requirements of regulatory acts or to protect legal interests.
• Contact details (applications and questions that did not lead to a visit) - up to 1 year after the last communication.
• News receipt data – until you withdraw your consent.

After the storage period, the data is securely deleted or anonymized.

8. Cookies

Cookies are small text files that are stored on your device when you visit a website. This website only uses cookies that are necessary for its operation:

• necessary cookies – ensures the operation of online registration, customer account and language selection, as well as the security of the website;
• payment cookies – Stripe uses cookies for secure payment processing and fraud prevention.

The use of necessary cookies does not require consent. Analytics or advertising cookies are not currently used; if this changes, your consent will be sought before they can be used. You can delete or block cookies in your browser settings, but then some website functions (such as logging) may not work to their full potential.

9. Your rights

You have the right to:

• access and receive a copy of your personal data;
• request correction of inaccurate or incomplete data;
• request deletion of data if their storage is no longer necessary and is not provided for by regulatory acts;
• request restriction of data processing;
• opposes data processing based on legitimate interests;
• receive your data in a structured, machine-readable format (data portability);
• withdraw consent at any time, without affecting the legality of the processing carried out up to the withdrawal.

To exercise your rights, write to info@zemlinskaphysio.com. I will give an answer without undue delay, no later than within one month. To protect your data, I may ask you to confirm your identity before releasing the information.

10. Data security

Adequate technical and organizational measures are used to protect personal data: encrypted connection (SSL), access restriction, secure passwords and regular software updates. Only the physiotherapist has access to health data.

11. Complaints

If you believe that your personal data is being processed illegally, please contact me first to resolve the matter. You also have the right to submit a complaint to the supervisory authority - the Data State Inspectorate (Elijas iela 17, Rīga, LV-1050; www.dvi.gov.lv; pasts@dvi.gov.lv).

12. Changes to Privacy Policy

The Privacy Policy may be updated due to changes in legislation or practices. The current version is always available on this page and its effective date is indicated at the top of the page.