GDPR
Privacy policy
How we handle personal data of clients and visitors of activeosteopathy.cz, in line with EU regulation 2016/679 (GDPR) and Czech law 110/2019 Sb.
Updated: October 2026
Data controller
Active Osteopathy — Roberto Folleri, D.O. Company ID (IČO): 04410718 Lidická 766/1, 150 00 Prague 5, Czech Republic E-mail: info@activeosteopathy.cz Contact for data-protection questions: Roberto Folleri.
Data we process
Identification and contact data (first name, last name, e-mail, phone), service and payment records, health data necessary for osteopathic care (case history, complaints), session notes, and technical data when visiting the site (IP address, browser type, traffic statistics).
Purpose
Providing healthcare and consulting services, keeping medical records, booking and managing appointments, invoicing and accounting, communication (booking confirmations, reminders, recommendations), site analytics and marketing within the scope of consent given.
Legal basis
Performance of contract (Art. 6(1)(b) GDPR) — booking and service delivery. Legal obligation (Art. 6(1)(c)) — keeping medical records, accounting duties. Legitimate interest (Art. 6(1)(f)) — securing operations, fraud prevention. Consent (Art. 6(1)(a)) — marketing, newsletter, non-essential cookies. Special categories of health data (Art. 9(2)(h)) — provision of health care.
Retention
Medical records — 10 years from the last session (Czech decree 98/2012 Sb.). Accounting documents — 10 years. Marketing contacts — until consent is withdrawn, max 5 years. Web form submissions that do not lead to a contract — 6 months.
Recipients
We pass data only to processors with whom we have a data-processing agreement: hosting provider (Vercel Inc.), payment gateway, accounting office, e-mail communication provider. Health data is not shared outside the team members directly involved in your care, except where required by law.
Your rights
You have the right to access, rectify, erase (except for data we must retain by law), restrict processing, data portability, object, and withdraw consent at any time. You may also lodge a complaint with the Czech Office for Personal Data Protection (uoou.cz).
Cookies and analytics
The site uses strictly necessary cookies and storage (e.g. client portal login, the contents of your basket). Traffic is measured anonymously and without cookies. We only store aggregate data: the page visited, day, country, device type, where you came from including the ad campaign tag, how far you went down the page and how long it was open, which important links you clicked (booking, shop, phone) and which steps of a booking or an order you went through. Plus an anonymous identifier that changes every day and cannot be traced back to your IP address or identity. Statistics are automatically deleted after 14 months. If you allow it in the bar on the site, the following also start: • Microsoft Clarity (Microsoft Ireland Operations Ltd.): records how you move through the pages (scrolling, clicks, mouse movement) and builds heatmaps and session recordings from it, which we use to improve the site. Text you type into forms is not recorded. Clarity does not run at all on pages with health data (intake questionnaire, client portal, feedback). It stores the cookies _clck and _clsk. • Ad measurement for Facebook and Instagram (Meta Pixel, Meta Platforms Ireland Ltd.): stores Meta cookies and shares with Meta the visit, sign-ups and shop purchases (product viewed, basket, order and its value) so we know which ads work. You can withdraw consent at any time with the “Cookies” button in the footer.
Contact
To exercise your rights or ask data-protection questions, write to info@activeosteopathy.cz. We respond within 30 days.