1 September 2026
Privacy Policy
This policy explains what personal data we process, on what basis, and what rights you have. It is written under Article 13 of the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) and the Bulgarian Personal Data Protection Act (ЗЗЛД).
1. Controller
- Controller: legal name, company number
- Address: address
- Email for data protection questions: hello@kinetiktherapy.com
- Data protection officer: yes/no — not mandatory at this scale
2. What we process
| Category | Data | When |
|---|---|---|
| Identity and contact | name, email, telephone | when booking |
| Visit details | visit address, chosen time and duration | when booking |
| Health data | the area of complaint you select, then the intake form and the notes kept during therapy | at booking and during therapy |
| Technical data | IP address and server log data | when visiting the site |
Health data is a special category under Article 9(1) GDPR. The area-of-complaint field at booking is deliberately coarse for that reason. Do not send detailed medical information by email or through social media.
3. Legal bases
- Article 6(1)(b) GDPR — performance of a contract: booking, confirming and delivering the therapy.
- Article 9(2)(h) GDPR — preventive medicine, medical diagnosis and the provision of health care by a professional bound by an obligation of professional secrecy: for health data.
- Article 6(1)(c) GDPR — legal obligation: accounting and tax records.
- Article 6(1)(f) GDPR — legitimate interest: site security and abuse prevention.
The therapist is bound to protect health information under Articles 27 and 28 of the Bulgarian Health Act.
4. Recipients and processors
| Recipient | Role | Location |
|---|---|---|
| Vercel | site hosting | EU / USA |
| GoDaddy (Professional Email) | email and calendar | EU / USA |
| scheduling provider | processing booking requests | country |
Each processor is engaged under an Article 28 GDPR agreement. We do not sell data or share it with third parties for marketing.
5. Transfers outside the EU
Where a provider processes data outside the European Economic Area, the transfer relies on Standard Contractual Clauses adopted by the European Commission, or an adequacy decision.
6. Retention
- Requests that did not lead to a visit: 12 months.
- Records of therapy delivered: period — to be aligned with medical record-keeping requirements.
- Accounting records: 5 years under Bulgarian accounting and tax law.
- Server logs: up to 12 months.
7. Your rights
- Access to your data and a copy of it (Article 15).
- Rectification of inaccurate data (Article 16).
- Erasure, so far as no legal retention duty applies (Article 17).
- Restriction of processing (Article 18).
- Data portability (Article 20).
- Objection to processing based on legitimate interest (Article 21).
- Withdrawal of consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
Exercise these rights at hello@kinetiktherapy.com. We respond within one month.
8. Complaint to a supervisory authority
You may complain to the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, kzld.bg, and to the courts.
9. Automated decision-making
We do not carry out automated decision-making or profiling within the meaning of Article 22 GDPR.