Privacy policy

This document sets out the rules for collecting, using and protecting the personal data of people who visit the website, get in touch through the contact form or use the services offered.

Only data necessary for the stated purposes is processed, in accordance with data protection law.

The controller of personal data is Kinga Sędzik, running a business under the name Kinga Sędzik Fizjoterapia & Trening, Zamieście 139, 34-650 Zamieście, Poland, tax ID (NIP): 7372247841.

The Controller can be contacted about personal data matters by email at: ksedzik.fizjotrener@gmail.com.

Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation, hereinafter “GDPR”) and Polish data protection law.

Personal data is collected in order to:

• reply to messages sent through the contact form and make contact by email or phone,
• book appointments - physiotherapy, rehabilitation, medical or personal training, strength and conditioning, or online coaching,
• run sessions or therapy safely and in a way suited to the User’s needs and health,
• keep the website secure and working properly.

Depending on the situation, the following may be processed:

• first and last name,
• email address and phone number,
• the selected service and the content of the message,
• health information provided in the message or during an appointment,
• a record of consent and the date it was given.

Information about injuries, past surgery or symptoms is special category data. It is processed only on the basis of explicit consent (Article 9(2)(a) GDPR), given by ticking the checkbox below the contact form, in order to prepare the consultation, training session or therapy properly.

Providing this information is voluntary, but without it choosing the right form of help may not be possible. Consent can be withdrawn at any time.

• consent (Article 6(1)(a) and Article 9(2)(a) GDPR) - contact regarding the enquiry sent through the form and processing of health data,
• entering into and performing a service contract (Article 6(1)(b) GDPR) - booking appointments and running sessions or therapy,
• the Controller’s legitimate interest (Article 6(1)(f) GDPR) - protecting the form against spam, anonymous visitor statistics, keeping the website secure, and establishing, pursuing or defending legal claims.

• contact form messages - no longer than 12 months from the last contact or, if consent is withdrawn earlier, until it is withdrawn,
• data in the appointment booking system (name, email, phone) - for the duration of the cooperation,
• data needed for settlements or legal claims - until the relevant limitation period expires.

Only the Controller has access to personal data. However, data may be technically stored or transmitted by external service providers acting on the Controller’s behalf:

• Vercel Inc. - website hosting, anonymous visitor statistics and website speed measurement,
• Google Ireland Limited - email (Gmail) that receives contact form messages,
• Booksy International sp. z o.o. - appointment booking system.

Instagram photos shown on the website are loaded directly from the servers of Meta Platforms Ireland Limited, so Meta receives the browser’s IP address.

Google Search Console is used to monitor how the website appears in Google Search. This tool does not collect data about website visitors.

Some providers may process data outside the European Economic Area, mainly in the USA. This is based on a European Commission decision (EU-US Data Privacy Framework) or on standard contractual clauses that ensure an adequate level of protection.

Personal data is not sold or shared with other entities for marketing purposes.

Every person whose data is processed has the right to:

• access the data and receive a copy of it,
• rectification or completion of the data,
• erasure of the data,
• restriction of processing,
• data portability,
• object to processing based on the Controller’s legitimate interest,
• withdraw consent at any time - without affecting the lawfulness of processing carried out before the withdrawal.

To exercise these rights, please contact the Controller at: ksedzik.fizjotrener@gmail.com.

Anyone who believes their data is processed unlawfully has the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland) or with the supervisory authority in their country of residence.

This privacy policy may be updated, for example due to changes in the law or in the tools used. The current version is always available on this page, and its effective date is shown at the top of the document.

Matters not covered by this document are governed by the GDPR and Polish law.