Privacy policy

2. What we collect

• Account data: email address, name, phone number and language preference.
• Clinic data: appointments and the health information you choose to share in our health questionnaire, used only to provide safe treatment.
• Orders: delivery and billing details and order history.
• Academy and events: enrolments, course progress, certificates and tickets.
• Forms: messages, consulting requests and job applications (CVs are stored privately).
• Technical data: security logs. Our website analytics are cookieless.

3. Why we use it (legal bases)

• To provide the services you request (contract): bookings, orders, courses, tickets and your account.
• With your explicit consent: health information for treatment, marketing emails and newsletter.
• To meet legal obligations: accounting and tax records.
• For our legitimate interests: security, fraud prevention and improving our services.

4. Who we share it with

Trusted providers acting on our instructions: Cloudflare (hosting, database, file storage and security, in the EU), Stripe (payments), Resend (transactional email) and Google (optional sign-in). We never sell your data.

5. International transfers

Where a provider processes data outside the EEA, transfers rely on adequacy decisions or Standard Contractual Clauses.

6. How long we keep it

Account data while your account is active; clinical records and financial records for the periods required by Maltese law; job applications for up to 12 months unless you ask us to delete them sooner.

7. Your rights

You can request access, rectification, erasure, restriction, portability, and object to processing or withdraw consent at any time by emailing us. You may also complain to the Information and Data Protection Commissioner (IDPC) in Malta.

8. Changes

We will publish any changes to this policy on this page.