Privacy Notice

1. Who is responsible for your data?

DnB Physio is the shared website and service presentation of Dori and Bogi. They provide their services through separate businesses. The physiotherapist who provides your session is responsible for their own professional care, associated treatment records and invoicing.

You may send any privacy enquiry to info@dnbphysio.com. If it concerns Bogi's independent professional records, we will direct it to the appropriate person or explain who you should contact. Each provider remains responsible for responding to requests concerning the processing they control.

2. What information we use and why

Visiting the website

When you visit the website, technical information such as your IP address, browser and device information, requested pages, access times and error information may be processed by the hosting infrastructure. This supports delivery of the website, security, fault diagnosis and protection against misuse. The legal basis is our legitimate interest in operating a reliable and secure website (Article 6(1)(f) GDPR).

Contact forms, email and telephone enquiries

We process the name, email address, optional telephone number, enquiry category, message and relevant correspondence you provide. Website submissions may also include the date, time and page from which the enquiry was sent. We use this information to answer your questions and arrange appropriate next steps.

Where your enquiry concerns a session you wish to arrange or an existing service, processing is necessary to take steps at your request or perform the service contract (Article 6(1)(b) GDPR). Other general correspondence is handled on the basis of our legitimate interest in answering enquiries and administering the business (Article 6(1)(f) GDPR). Please do not send unnecessary medical reports or sensitive details through a general contact form.

Booking appointments and managing packages

We process your name, contact details, selected therapist, service, date and time, participant information where relevant, booking status, cancellations and rescheduling, package entitlement and remaining sessions, and communications about your appointment. The selected physiotherapist receives the information needed to provide the session. Appointment confirmations, reminders and essential service messages are part of booking administration, not newsletter subscriptions.

The legal basis is taking steps at your request and performing the service contract (Article 6(1)(b) GDPR). Records needed to meet legal requirements are processed under Article 6(1)(c) GDPR. The booking system currently does not collect online card payments. Any invoice is issued by the provider delivering your session.

Physiotherapy and continuity of care

During physiotherapy, your provider may process health information you supply and information needed for assessment, treatment, exercise guidance and continuity of care. This may include relevant symptoms and history, assessment findings, the support provided and appropriate follow-up information. Only information relevant to the professional service should be recorded.

Ordinary personal data is processed as necessary to provide the service and meet professional obligations (Articles 6(1)(b) and 6(1)(c) GDPR). Health information requires an additional condition under Article 9 GDPR. For professional health care provided under applicable law or a contract with a health professional subject to confidentiality, this is Article 9(2)(h), together with Article 9(3). Where a particular additional use instead requires your explicit consent, that consent must be requested separately; acknowledging this notice is not blanket consent to all uses of health data.

Group sessions and bookings for other people

Group sessions involve other participants. Your name, image, voice and information you choose to share may be visible or audible to others during a live session. Avoid disclosing sensitive information to the group unnecessarily. If you provide another participant's personal details when booking, you must have authority to do so, provide accurate information and make this notice available to them. We use those details only as needed to administer and deliver the booked service and fulfil applicable obligations.

Invoices, complaints and legal claims

The provider supplying your session processes the identification, service and billing information needed to issue invoices, keep required accounting records and meet tax or professional obligations (Article 6(1)(c) GDPR). Information needed to address complaints or establish, exercise or defend legal claims may be retained on the basis of legitimate interests (Article 6(1)(f)); where health information is necessary for legal claims, Article 9(2)(f) may also apply.

Newsletters

If you subscribe, we process your name where supplied, email address, selected language, subscription preferences and information documenting your subscription or withdrawal. We use MailerLite to manage the mailing list and send newsletters. Subscription is voluntary and based on consent (Article 6(1)(a) GDPR). Booking or contacting us does not automatically subscribe you.

You can unsubscribe using the link in a newsletter or by contacting us. Withdrawal does not affect the lawfulness of earlier processing. Limited consent and suppression records may remain where necessary to demonstrate compliance or ensure that further marketing is not sent. Mail delivery and interaction information may be processed by the mailing service; any optional individual tracking must be subject to the applicable consent requirements.

3. Required and optional information

Fields marked or technically enforced as required are needed to handle the relevant request or booking. Without necessary identification, contact or appointment information, we may be unable to respond or arrange the session. Optional information can be omitted. Health information relevant to safe and appropriate care may be needed by your physiotherapist; they can explain why it is requested.

The privacy acknowledgement on a form confirms that this notice has been made available and read. It does not waive your rights, constitute a newsletter subscription or replace a separate consent where one is legally required.

4. Who may access your information?

Information is made available according to the task and purpose concerned. Recipients may include:

• Your selected physiotherapist and people authorised to assist with appointment or business administration.
• Website hosting, email, backup and technical maintenance providers supporting operation and security of the site.
• MailerLite for newsletter administration and delivery.
• Professional advisers, accountants, insurers or competent authorities where disclosure is necessary and lawfully justified.

The website uses WordPress and Elementor for its pages and forms, and Amelia for booking and customer-panel functions. Form submissions and booking information are stored within the website's systems. Use of a software product does not by itself mean that its developer receives all information entered into it. Technical administrators may need access for maintenance, security or troubleshooting; access must be limited to what is necessary and handled confidentially.

Service providers acting on our behalf must process data under appropriate instructions and contractual safeguards. Providers acting independently, including services you choose to contact directly, are responsible for their own processing as explained in their privacy notices. We do not sell client information.

5. External services and international transfers

The contact page contains Google Maps content. Loading embedded maps can disclose technical information, including your IP address and browser information, to Google. Using a directions link takes you to Google's service. WhatsApp links open a separate communication channel; WhatsApp and its associated providers process information under their own terms and privacy notices. You can contact us by email or use the contact form instead of WhatsApp.

Third-party services and their support or infrastructure providers may process information outside the European Economic Area. Where a transfer is made by us or our processors, an appropriate GDPR Chapter V transfer mechanism is required, such as an applicable adequacy decision or the European Commission's Standard Contractual Clauses with necessary supplementary safeguards. These mechanisms do not mean that every destination has identical laws. You can ask the relevant controller for information about the safeguards applicable to your data and how to obtain a copy, subject to legitimate confidentiality restrictions.

Further provider information is available in Google's Privacy Policy, WhatsApp's Privacy Policy and MailerLite's Data Processing Addendum.

6. Cookies and similar technologies

The website and its components may use cookies or similar storage to maintain secure sessions, support booking and sign-in functions, and remember language preferences. The duration depends on the function: session storage ends with the session, while preference or login settings may persist for their configured lifetime or until removed.

Non-essential analytics, advertising or third-party tracking requires consent where applicable law requires it; it is not authorised merely by reading this notice or ticking the privacy acknowledgement. Embedded third-party services may have their own cookies and data collection. You can manage or remove stored cookies in your browser. Blocking necessary cookies may affect sign-in, booking or other requested functions.

Technical browser storage: WordPress uses wpEmojiSettingsSupports to remember browser support for emoji during the browsing session. This technical storage is not used for advertising.

Your cookie choices: CookieYes provides Accept All, Reject All and Customise options. Optional categories are disabled until you choose them. Your choice is stored in the first-party cookieyes-consent cookie for 180 days. You can reopen Cookie settings using the floating button or footer button and withdraw optional permission at any time. Withdrawal affects future loading; it does not undo earlier processing by a provider.

Google Maps: embedded maps on the Contact page load only when Functional consent is enabled. Google then receives information such as your IP address and may use cookies according to its own settings and your Google account status. Google determines the relevant cookie lifetimes; see Google’s cookie information. Addresses and external directions links remain available when embedded maps are blocked. Following an external link opens the provider’s service under its own privacy arrangements.

Cookie choices are separate from the privacy acknowledgement used in booking or contact forms. Refusing optional cookies does not prevent you from booking or sending an enquiry. Browser settings can also remove previously stored cookies. For assistance, contact us using the details below.

7. How long information is kept

We do not apply one retention period to every type of information. The relevant controller determines the period using the purpose, the ongoing service relationship, applicable documentation and accounting requirements, and any necessary legal-claim retention.

• General enquiries that do not result in treatment or a contract: normally up to 12 months after the enquiry is resolved, unless an unresolved issue or legal requirement justifies longer retention.
• Booking and package records: for the time needed to administer appointments, remaining entitlements, cancellations and the service relationship; afterwards, only the information needed for applicable legal obligations or the establishment, exercise or defence of claims is retained.
• Professional treatment documentation: for the mandatory period applicable to the provider and the care delivered. The period is determined from the applicable professional and health-record rules, the type of record and the event from which the statutory period runs. Your provider can explain the period applicable to your particular records. Records subject to a legal duty cannot be deleted simply because an account is closed.
• Invoices and accounting records: for the statutory retention period applicable to the business issuing the invoice.
• Newsletter information: for active mailing until you unsubscribe or the subscription is otherwise ended; limited proof-of-consent and suppression information may remain for compliance and to respect your withdrawal.
• Technical logs and backups: for the period needed for security, diagnosis and recovery, taking account of provider settings and backup rotation. Information required for an identified security incident may be kept until it is resolved. Backup copies are not used as an active marketing list.

Where a legal dispute or obligation requires retention, access and use should be limited to that purpose. You may request further information about the retention criteria and records relating to you from the relevant controller.

8. Security and confidentiality

We use access controls and appropriate technical and organisational measures to protect personal data against unauthorised access, loss and misuse. Professional information is handled confidentially. No internet service can guarantee absolute security. Please protect your booking-access links and sign-in details, avoid sharing them, and contact us if you suspect unauthorised access.

A request to view or change personal information may require proportionate identity verification. Please do not send identity documents or detailed medical records unless specifically requested through an appropriate channel.

9. Your rights

Subject to the conditions and exceptions in the GDPR, you may:

• Request access to your personal data and a copy of it.
• Ask for inaccurate information to be corrected and incomplete information to be completed.
• Request erasure where there is no overriding reason or legal duty to keep the information.
• Request restriction of processing in the circumstances set out in the GDPR.
• Receive data you provided in a structured, commonly used, machine-readable format, or request transfer to another controller, where processing is automated and based on consent or a contract.
• Object, on grounds relating to your situation, to processing based on legitimate interests. Processing must stop unless compelling legitimate grounds override your interests and rights, or the information is needed for legal claims.
• Object to direct marketing at any time; your data will no longer be used for that purpose.
• Withdraw consent at any time where processing is based on consent, without affecting earlier lawful processing.
• Lodge a complaint with a competent data protection supervisory authority and seek a judicial remedy.

We normally respond to a rights request within one month. If the request is complex or numerous, the GDPR permits an extension of up to two further months; we will tell you within the initial month and explain why. Requests are generally free of charge, subject to the GDPR's provisions concerning manifestly unfounded or excessive requests.

10. Complaints and supervisory authorities

You may complain to the supervisory authority in the country of your habitual residence, place of work or the alleged infringement. You do not have to contact us first.

Hungary: National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9–11., Hungary. Official contact and complaint procedures: naih.hu.

Austria: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, Austria. Email: dsb@dsb.gv.at. Official information: dsb.gv.at.

11. Automated decisions and updates

We do not use the website to make solely automated decisions producing legal or similarly significant effects about you. Displaying available appointment times or sending scheduled service messages is booking administration, not an automated clinical decision.

This notice may be updated when our services, systems or legal requirements change. The current version and its update date will be available on this page. Where required, we will provide additional information about a new purpose or obtain separate consent before the relevant processing begins.