Privacy and Cookies Policy

1. Data Controller

The controller of your personal data within the website https://musclelab.club/ and in connection with the services provided in the field of physical conditioning and massage is:

Usługi Fizjoterapeutyczne Miron Chmielewski
ul. Szkolna 104, 05-126 Wólka Radzymińska
NIP: 5361782989

For matters related to personal data protection, you can contact us at the e-mail address: [email protected].

2. Purposes and Legal Bases of Data Processing

We process your personal data exclusively for specified, lawful purposes:

• Service provision (massage, physical conditioning improvement): in order to conclude and perform a contract for the provision of services (legal basis: Art. 6(1)(b) GDPR).
• Contact and inquiry handling: in order to respond to messages sent via email or telephone, which constitutes our legitimate interest (legal basis: Art. 6(1)(f) GDPR).
• Accounting and tax obligations: in order to issue bills/invoices and maintain accounting records (legal basis: Art. 6(1)(c) GDPR).
• Booking system management: to efficiently schedule and manage appointments through an external platform (legal basis: Art. 6(1)(b) and (f) GDPR).

3. Processing of Health Status Data (Sensitive Data)

Due to the nature of our services (bodywork, musculoskeletal system work, massage), we may ask you to provide basic information regarding your health status, past injuries, or contraindications before starting a session.

We process these data (constituting the so-called special categories of data) solely based on your explicit, voluntary consent (Art. 9(2)(a) GDPR), in order to ensure your maximum safety and the effectiveness of the performed services. You can withdraw this consent at any time; however, this may result in the inability to perform the treatment for safety reasons.

4. Data Retention Period

We store your data only as long as necessary to achieve the purposes for which they were collected:

• Accounting and tax data: for a period of 5 years from the end of the calendar year in which the tax payment deadline expired (statutory requirement).
• Data related to service provision (Fresha) and health data: for the duration of the service provision, and subsequently for the limitation period of potential claims (standardly up to 3 years) or until you withdraw your consent to process special categories of data.
• Contact data (emails): until the communication is completed and potential claims are time-barred.

5. Data Recipients and External Tools

To provide our services at the highest level, we utilize the assistance of trusted third parties to whom we may entrust your data:

• Fresha: Your first name, last name, phone number, and appointment history are processed in the Fresha system, which we use to manage the booking calendar. The system provider ensures appropriate data security standards.
• IT support and hosting: entities ensuring the operation of our website and email.
• Accounting office: in case it is necessary to issue an invoice or bill.

6. Data Transfer Outside the EEA

In connection with the use of analytical tools (Google, Microsoft), some of your data (e.g., anonymized IP address) may be transferred to servers located in the United States. The providers of these tools (Google LLC and Microsoft Corporation) have adhered to the EU-US Data Privacy Framework, meaning they provide a level of personal data protection corresponding to European standards (GDPR).

7. Your Data Protection Rights

In accordance with GDPR provisions, you have a number of rights related to your data. You have the right to:

• Access your data and receive a copy of them.
• Rectification (correction) of your data.
• Erasure of data (the so-called "right to be forgotten").
• Restriction of data processing.
• Object to processing.
• Data portability.
• Withdraw consent at any time (this applies, for example, to health status data).

To exercise your rights, please contact us by email. Furthermore, you have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO).

8. Requirement to Provide Data and Profiling

Providing personal data is voluntary, yet necessary to conclude a contract for the provision of services (e.g., booking an appointment slot). Failure to provide basic data will prevent us from performing the service. As part of our business, we do not make automated decisions and do not profile your data in a way that would produce legal effects concerning you.

9. Cookies and Analytics (Google, Microsoft)

Our website uses cookies to ensure its proper functioning, improve performance, and for analytical purposes.

• Google Analytics: A tool used to collect anonymous statistics regarding website traffic.
• Google Maps and Google Fonts: We use Google Maps to facilitate finding the studio's location (at Bracka Street in Warsaw) and fonts for the correct display of the website. Your browser establishes a connection with Google servers, which may involve transmitting your IP address.
• Microsoft Clarity: We use a tool that allows us to understand user interactions with the website (heatmaps). This tool is not used for ad personalization.

You can manage your cookie preferences using the panel available on our website or through your browser settings.

10. Changes to the Privacy Policy

We reserve the right to update this Privacy Policy in the event of changes in legal regulations or changes in the tools used. The latest version will always be available on this subpage.