Privacy Policy
Last updated: 17 October 2026
At Reset Lab we respect your privacy. This page explains in plain words which personal data we process when you visit the website, book an appointment or use our app, why, for how long and what your rights are, under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Greek Law 4624/2019.
1. Who is responsible for your data
The data controller is Reset Lab by Marianna Malevri (Marianna Malevri, Physiotherapist), [Street & number],166 71 Vouliagmeni, Greece, VAT no. [VAT]. For anything about your data: info@resetlab.gr, phone +30 210 000 0000.
2. What data we process
- Contact details: full name, mobile phone, email, preferred language, and anything you send us through the contact form or the newsletter.
- App account: email and password. Your password is never stored in readable form, only as an irreversible cryptographic fingerprint (hash).
- Appointments: date, time, treatment, status (e.g. completed, cancelled) and anything you write when booking.
- Health data (special category): the therapist’s notes on your progress, exercise programmes, the log of exercises you complete and health information you give us.
- Financial data: payments (amount, date, method: cash, card, IRIS) and session packages.
- Notifications: if you turn them on, a technical identifier of your device created by your browser (push subscription) and your preferences (which notifications you want).
- Technical security data: our providers log IP addresses and request times for a few days to protect against abuse.
We use no tracking tools, advertising pixels or third-party analytics, and we never sell or share data for advertising.
3. Why we process it and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Booking and managing appointments, app account, appointment confirmations and reminders | Performance of a contract (Art. 6(1)(b)) |
| Providing physiotherapy: treatment record, notes, exercise programmes | Explicit consent (Art. 9(2)(a)) and provision of health care by a health professional bound by professional secrecy (Art. 9(2)(h) and 9(3)) |
| Push notifications about articles and announcements | Consent (Art. 6(1)(a)), given when you turn notifications on; you can turn them off at any time |
| Keeping financial records and receipts | Legal obligation (Art. 6(1)(c)) under tax law |
| Security of the app and protection against abuse | Legitimate interest (Art. 6(1)(f)) |
Consent for health data is explained in detail on the Consent for health data page.
4. Who has access
Only the therapist sees your data. In the app you only see your own details, your appointments, your programmes and the notes the therapist chose to share with you. To run the service we use the following providers (“processors”), under contracts that require them to protect the data and use it only on our instructions:
- Supabase: database, accounts and files, on servers in Frankfurt (EU).
- Vercel: hosting of the website and the app functions, processed in Frankfurt (EU).
- Resend: sending emails (confirmations, reminders, password resets, and contact-form messages to the clinic) from servers in the EU.
- Your browser’s notification services (Apple, Google, Mozilla, Microsoft): deliver push notifications to your device. The content is encrypted and contains no health data.
- The therapist’s calendar [e.g. Google Workspace]: name, phone and treatment of each appointment, so that it appears in the therapist’s schedule.
- Newsletter service [provider name], only if you subscribe to the newsletter.
- The clinic’s accountant, only the data required by tax law.
- Public authorities, only where the law requires it.
Some providers are companies based outside the EU. Where access from outside the EU may occur, it is covered by the European Commission’s Standard Contractual Clauses or the EU-US Data Privacy Framework.
5. How long we keep it
- App account: while it is active. When you delete it, it is deleted immediately.
- Treatment record and appointment history: [period required by law for health records], after which it is deleted or anonymised.
- Financial records: as long as tax law requires.
- Contact-form messages: not stored in the app; they reach the clinic by email and are deleted once the conversation is over, unless you book an appointment.
- Security logs: a few days.
- Backups: the database provider keeps daily backups for 7 days. The clinic also keeps a daily copy of the records in private storage in the EU for 30 days, and a copy on a clinic computer protected by password and encryption. Both are refreshed continuously, and copies older than 30 days are deleted automatically.
6. How we protect it
- Encrypted connections (HTTPS) everywhere and encryption of data on the servers.
- Access control at database level: each client can only see their own data and only the therapist can see everything.
- Passwords stored only as irreversible hashes, and email confirmation for every new account.
- Emails and notifications contain no health data: only date, time and treatment.
- Daily backups.
7. Your rights
You have the right to:
- access and portability: in the app, the “Download my data” button gives you a file with the data you see there, straight away. For a full copy of your record, ask the clinic;
- rectification: change your name, phone and language in your profile, or ask us to correct anything else;
- erasure: the “Delete account” button deletes your account immediately and cancels future appointments. Data we must keep by law (e.g. treatment record, financial records) is kept only as long as required. Deleted data remains in the backups for up to 30 days, with no other use, and is then deleted from them too;
- withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal;
- restriction of processing and objection, where applicable.
For any of the above, email us at info@resetlab.gr: we reply within one month at the latest. If you believe we have not respected your rights, you can lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).
8. Children
For children in treatment, the account is created and managed by a parent or guardian, who also gives the necessary consents.
9. Cookies and storage on your device
This website uses no cookies for tracking or advertising and loads nothing from third parties: fonts and photos are served from our own server. That is why there is no cookie banner.
The app stores on your device (local storage) only what it needs to work: your sign-in, so you don’t have to enter your password every time, and temporarily a booking that completes after you confirm your email. To open quickly and offline, it also keeps a copy of its own files (not your data). All of this is removed when you sign out or from your browser settings.
10. Changes
If anything important changes in this policy, you will see it here with a new date and, if you have an account, we will let you know in the app.