Privacy policy

Updated: 2 October 2026.

1. Data controller

The data controller is VšĮ „Sveikatos Misterija“, legal entity code 307510770. The organisation is headed by Marytė Prūdnikova. Contact: sveikatosmisterija@gmail.com, +370 617 38230. Registered address: Jono Dailidės g. 9A, LT-68176 Marijampolė, Lithuania. Services are provided in rooms 201–202.

This policy applies to sveikatosmisterija.online and its booking and review submission features.

2. Personal data we process

Depending on the feature used, we may process:

• For bookings: name, a required email address for booking confirmation, phone number (if provided), selected service, date and time.
• For reviews: name, rating, review text and submission date. Reviews may be published if the information meets publication requirements.
• Technical data: information sent to the server during normal website use, such as IP address, browser and device details, request time and security logs, where necessary for operation and security.

The booking form has no free-text Notes field. Please do not send diagnoses, medical histories, medication, pregnancy information or other health data through the booking form, email or other booking channels, unless lawfully required for a specific service and appropriately protected. Health data is special-category personal data subject to additional GDPR requirements.

Health information you provide voluntarily may be special-category data and will be processed only as necessary and permitted by applicable law.

3. Purposes and legal bases

• Booking and service delivery – receiving orders, reserving times, contacting you about bookings and administering visits (GDPR Article 6(1)(b), where applicable).
• Booking communications – sending confirmations, changes, cancellations and other necessary information relating to your order (GDPR Article 6(1)(b)).
• Review administration and publication – receiving reviews, preventing abuse and publishing your name, rating and review with explicit consent (GDPR Article 6(1)(a)). Consent may be withdrawn.
• Legal obligations – processing required by law (GDPR Article 6(1)(c)).
• Legitimate interests – securing the website and booking system, detecting abuse, handling disputes and exercising rights where these interests are not overridden by your rights and freedoms (GDPR Article 6(1)(f)).

4. Providing data and consequences

Required booking details are marked on the form. Without the necessary details, we cannot properly receive or administer your booking. Your email address is required for confirmation. Providing a phone number is optional.

5. Recipients of data

We may disclose data or provide access to service providers necessary for website features, including infrastructure, database, security, email and other IT providers. They act under agreements and process only what is needed for their services.

Transfers outside the European Economic Area use appropriate safeguards under GDPR Chapter V where required, including European Commission adequacy decisions or other lawful transfer mechanisms.

Data may also be disclosed to public authorities or others where required by law or necessary to establish, exercise or defend legal claims.

6. Retention periods

Retention depends on the processing purpose, type of data and legal obligations. Data no longer needed is deleted or anonymised.

• Booking data (name, phone, email, service, date and time) – up to 3 months after the last visit. If the visit does not take place, data is kept for up to 3 months from the planned appointment date.
• Enquiries and correspondence by email or other contact channels – up to 3 months after the last contact, unless longer retention is necessary for a dispute, legal claim or statutory obligation.
• Technical and security logs (such as IP address, request time, browser or security event details) – up to 90 days, except data concerning a specific security incident or legal claim, which may be retained longer as necessary.
• Review data (name, rating and text) – up to 24 months after publication, unless removed sooner following a lawful request, withdrawal of consent, detected abuse or another lawful reason.
• Accounting and payment documents, where created and containing personal data – 10 years or another legally required period.

These periods may be extended only as necessary to establish, exercise or defend legal claims or meet another legal obligation.

7. Data security

Health information in reviews. The review form does not ask for diagnoses, illnesses, injuries, medication or other health information. Please do not include such information. Voluntarily supplied health information may be withheld from publication or removed.

We apply organisational and technical measures to protect personal data against unauthorised access, loss, destruction, alteration and disclosure. Administrative access is restricted and appropriate safeguards protect data transmitted through the website.

No information system is completely secure. Please avoid sending unnecessary sensitive information through website forms.

8. Your rights

Where applicable under GDPR, you have rights to information, access, rectification, erasure, restriction, objection and data portability. Where processing relies on consent, you may withdraw it at any time. These rights are subject to the relevant legal basis and GDPR conditions.

Submit requests about your rights by email to sveikatosmisterija@gmail.com. We may request additional information to verify your identity. Requests are answered within GDPR time limits.

9. Complaints to the supervisory authority

If you believe your personal data is processed unlawfully, you may complain to the State Data Protection Inspectorate (VDAI). Information: vdai.lrv.lt.

10. Cookies and similar technologies

The current website code does not include advertising or analytics tracking requiring visitor consent. Google Analytics or similar statistics or marketing tracking code is not installed.

Technical website and server functions may use information necessary for secure, proper operation. For details of current and possible future technologies, see our Cookie policy.

If non-essential cookies or tracking are introduced, they will not be stored before obtaining legally required prior consent. Visitors will receive information and a choice.

11. Changes to this privacy policy

This policy may be updated following changes to the website, services, processing or legal requirements. The latest version is always published here with its update date.