Online Booking Privacy Policy

Who is responsible

VIVERE Physio & Pilates Center, Nikolaou Plastira 6, Marousi 151 24, Greece. For any question about your data: info@viverephysio.gr or +30 210 802 4584.

The booking page runs on the Vitavo software. Its provider processes your data only on our behalf and on our instructions (a processor, Article 28 GDPR).

What data we collect

• Details you give us: first name (required), last name (optional), phone number (required, so we can reach you about your appointment) and email (optional).
• Notes: optional free text. Please write health information there only if it is needed to prepare for your appointment (e.g. difficulty moving).
• Appointment details: the service, date and time, the physiotherapist or room, and its history (confirmation, rescheduling, cancellation, attendance).
• Your choices: acceptance of this policy (with date and version), whether you want offers, whether you want appointment reminders, and your communication language.
• Verification: to confirm the phone number or email is yours, we send you a six-digit code valid for 10 minutes. The code is stored encrypted. If you choose to sign in with Google, Microsoft or Facebook, we receive from that provider only your email, an identifier of your account (so we recognise you next time) and, from Google, your account's language. We do not receive your password, photo or contacts.
• Technical data: we use your IP address in an unreadable (hashed) form to prevent abuse, such as mass fake bookings. The server also keeps technical logs for security and to keep the service running.

Health data

Booking physiotherapy or Clinical Pilates may reveal information about your health. We process it only to serve you, under professional secrecy (Article 9(2)(h) GDPR).

Your treatment record is not collected through the booking page. It is kept separately, within the clinical relationship.

Why we use it

We do not make decisions about you by solely automated means, and we do not profile you.

• Booking and serving your appointment, confirmations, changes and cancellations: to perform our contract with you (Art. 6(1)(b)).
• Verifying your phone or email and preventing abuse: to perform the contract and in our legitimate interest in protecting the service (Art. 6(1)(b) and (f)).
• Appointment reminders, unless you switch them off: to perform the contract (Art. 6(1)(b)).
• Offers and updates, only if you opt in: with your consent, which you may withdraw at any time (Art. 6(1)(a)).
• Tax and accounting obligations, where they apply: a legal obligation (Art. 6(1)(c)).

The messages we send you

We only message an email address or phone number you have verified: the verification code, the appointment confirmation, notices when it is moved or cancelled, and reminders before it. Phone messages go out by Viber or SMS.

You can switch reminders off by unticking the option when you book, or by asking us. We send offers only if you opted in.

The confirmation email contains a map of our location that loads from our own servers, without telling Google. Google or Microsoft receive data only if you click "Open in maps", "Google Calendar" or "Outlook".

Your account

On the "My account" page you can see your details and appointments, move or cancel an upcoming appointment, and change your communication language and your choice about offers.

You sign in with a link you receive by email (valid for 72 hours, usable once) or with a verification code. A sign-in lasts up to 14 days and is stored in your browser until you sign out.

Who sees your data

We do not sell or rent your data. If a provider processes it outside the European Economic Area, this happens under the GDPR's safeguards, such as an adequacy decision or standard contractual clauses.

• Our staff, only as far as needed to serve you.
• The provider of the Vitavo software and its hosting provider, as processors.
• Google, to deliver our emails, and Apifon (Greece), for SMS and Viber messages, which are delivered through Rakuten Viber.
• Google, Microsoft or Meta (Facebook), only if you choose to sign in through them.
• Public authorities, only when the law requires it.

How long we keep it

• Contact details and appointment history: while you remain our customer and for 5 years after your last appointment, or longer where the law requires it.
• Verification codes: valid for 10 minutes and deleted automatically about 30 days after they expire.
• Account links and sign-ins: 72 hours and 14 days respectively. Deleted automatically once they expire.
• Messages sent to you: about 7 days in the sending system.
• Content of technical logs: up to 30 days.
• Consent to offers: until you withdraw it.

What is stored on your device

The booking page uses no tracking cookies and no analytics or advertising tools. It stores locally in your browser only what it needs to work: the display theme and language you chose, the page's texts and look so it loads faster, and your account sign-in.

No Google, Microsoft or Facebook script loads before you click that provider's sign-in button. If you click it, the provider opens its own window and may use its own cookies under its own privacy policy.

Your rights

You have the right to access your data, to rectification, erasure, restriction of processing, portability and objection, and to withdraw your consent to offers at any time. You can also withdraw it from your account.

To exercise your rights, write to info@viverephysio.gr. We will reply within one month and may ask you to confirm your identity.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority (1-3 Kifisias Ave., 115 23 Athens, dpa.gr).

Security

Data travels encrypted (HTTPS), codes and access links are stored encrypted, our booking data is kept in our own separate database, and only authorised staff have access.

Minors

For an appointment for a minor under 15, the booking is made by a parent or guardian.

Changes

If we change this policy materially, the version and date at the top will change, and at your next booking you will be asked to accept the new version.