Your data
Privacy Policy
This Privacy Policy explains how Physio Flora collects, uses, stores, and protects your personal data when you visit our website or book an appointment with us. It has been written in accordance with the EU General Data Protection Regulation (GDPR), the Spanish Organic Law 3/2018 on Data Protection and Digital Rights (LOPD-GDD), and guidance from the Spanish Data Protection Agency (AEPD).
Please read this policy carefully. If you have any questions, contact us at info@physioflora.es.
1. Data Controller
The data controller responsible for your personal data is:
- Business name: Physio Flora
- Legal entity: Esther Flora Muijzer, autónoma (sole trader), trading as Physio Flora
- Tax identification number (NIE): Z3204993V
- Registered address: Calle Tesorillo de Torrenueva 2, piso 1, puerta 7, 29649, Mijas Costa, Málaga, Spain
- Email: info@physioflora.es
- Phone: +34 711 059 592
- Data Protection Officer (DPO): No DPO has been appointed. Direct all data enquiries to the email address above.
2. Personal Data We Collect
We collect the following categories of personal data:
Identity and contact data
Full name, email address, and telephone number (provided when booking or contacting us); whether you are a new or returning patient.
Health data (Special Category under GDPR Article 9)
The type of appointment booked (e.g. physiotherapy, sports massage, sports performance) — this implies health-related information. Clinical notes and assessment records are held within our practice management system, Jane App.
Payment data
Deposit payment details are processed directly by our payment provider, Stripe. Physio Flora does not store payment card numbers or full payment data. We retain only a transaction reference and the deposit amount paid.
Technical and usage data
IP address, browser type, and device information collected automatically when you visit the site. Pages visited, session duration, and click behaviour are collected only with your consent via analytics cookies (see our Cookie Policy).
3. Legal Basis for Processing
| Data category | Legal basis |
|---|---|
| Booking and contact data | Article 6(1)(b) GDPR — necessary to perform the service contract you have entered into |
| Health data (appointment type and clinical records) | Article 9(2)(h) GDPR — necessary for the provision of healthcare by a health professional, subject to professional secrecy obligations |
| Payment transaction references | Article 6(1)(c) GDPR — compliance with legal obligations (Spanish tax law) |
| Analytics and marketing cookies | Article 6(1)(a) GDPR — consent, given via the cookie banner. You may withdraw consent at any time. |
4. Data Processors and Third Parties
We use the following third-party service providers ("data processors") who process personal data on our behalf. Each is bound by a Data Processing Agreement (where applicable) and may only process data for the purposes we specify.
Jane App Inc. (Canada)
Practice management and appointment scheduling. Patient identity, contact details, appointment history, and clinical records are stored in Jane App. Jane App operates under Canadian data protection law and provides standard contractual clauses for international transfers. www.janeapp.com
Stripe Inc. (USA / Stripe Payments Europe Ltd, Ireland for EU payments)
Payment processing. Stripe handles all card payment data. Physio Flora receives only a transaction reference and confirmation of payment. Transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission. stripe.com
Google LLC (USA)
Google Analytics 4 (via Google Tag Manager) is used to understand how visitors use our website, and the Google Places API powers the reviews widget on our home page. Google Analytics only activates when you grant analytics consent via the cookie banner. Transfers are governed by Standard Contractual Clauses. policies.google.com/privacy
Lovable AB (Sweden)
Website design, development, hosting, and publishing platform. Lovable provides the infrastructure on which this site runs and processes technical data (such as IP addresses and request logs) as part of its hosting service. lovable.dev
Supabase, Inc. (USA)
Backend database and cloud infrastructure (used via Lovable Cloud). Stores data such as newsletter subscriptions, event RSVPs, blog enquiries, and contact form submissions. Transfers are governed by Standard Contractual Clauses. supabase.com
GoDaddy.com LLC (USA)
Domain name registration for physioflora.es. GoDaddy processes the registration details required to maintain the domain; it does not host the website itself. godaddy.com
We do not sell your personal data to any third party, nor do we share it for marketing purposes without your explicit consent.
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects about you (GDPR Article 22). All clinical and booking decisions involve a human practitioner or member of staff.
5. How Long We Keep Your Data
| Data type | Retention period | Reason |
|---|---|---|
| Booking and appointment records | 5 years from appointment date | Spanish healthcare records requirements |
| Payment transaction references | 5 years from transaction date | Spanish tax law (Ley 37/1992) |
| Analytics data (Google Analytics) | Up to 14 months | GA4 data retention setting |
| Cookie consent records | 12 months (renewed annually) | GDPR consent requirements |
| Newsletter subscriptions and contact form submissions | Until you unsubscribe or request deletion | Purpose limitation |
6. Your Rights
Under the GDPR and LOPD-GDD, you have the following rights regarding your personal data:
- Right of access (Article 15): request a copy of the personal data we hold about you.
- Right of rectification (Article 16): request that we correct inaccurate or incomplete data.
- Right of erasure (Article 17): request deletion of your personal data where there is no legitimate reason for us to continue processing it.
- Right to restriction of processing (Article 18): request that we pause processing of your data in certain circumstances.
- Right to data portability (Article 20): request that we transfer your data to you or a third party in a structured, machine-readable format.
- Right to object (Article 21): object to processing where we rely on legitimate interests as a legal basis.
- Right to withdraw consent: where processing is based on consent, you may withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.
To exercise any of these rights, please email us at info@physioflora.es with the subject line "Data Rights Request". We will respond within one month.
We may need to verify your identity before processing your request. We will not charge a fee for reasonable requests.
7. Right to Complain to the AEPD
If you believe that your data protection rights have been breached, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD):
- Website: www.aepd.es
- Address: C/ Jorge Juan, 6, 28001 Madrid, Spain
- Phone: +34 901 100 099
We would, however, welcome the opportunity to address your concerns directly before you approach the AEPD. Please contact us first at info@physioflora.es.
8. International Data Transfers
Some of our data processors (Jane App, Stripe, Google, Supabase, Lovable, GoDaddy) are based outside the European Economic Area. Transfers of personal data to these providers are made under Standard Contractual Clauses (SCCs) adopted by the European Commission, which provide equivalent data protection safeguards to those within the EU.
You may request a copy of the relevant transfer mechanism by emailing info@physioflora.es.
9. Cookies
We use cookies and similar tracking technologies on our website. For full details of the cookies we use, their purposes and how to manage your preferences, please see our Cookie Policy.
10. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in law, our practices, or the services we offer. The date at the bottom of this page will always indicate the most recent revision. Where changes are material, we will take reasonable steps to notify you.
We encourage you to review this policy periodically.
Contact details
For any questions about this Privacy Policy, your data rights, or how to reach Physio Flora, please use the contact details below.
Physio Flora
Calle Tesorillo de Torrenueva 2, piso 1, puerta 7
29649 Mijas Costa, Málaga, Spain
Last updated: 16 July 2026