Information on the Protection of Personal Data

The controller of personal data under this information is:

a.clinic, s. r. o.
registered office at Jakabova 3621/45, Bratislava-Ružinov 821 04
Company ID (IČO): 57 789 843
Tax ID (DIČ): 2123120736
registered in the Commercial Register of the Bratislava III Municipal Court, Section Sro, Insert No. 202261/B
E-mail: martin@a.clinic

(“a.clinic” or “we”), which operates the a.clinic online platform (the “Platform”).

This information is intended for persons who visit the a.clinic website, create a user account, complete the intake health questionnaire or order health services through the Platform (the “Client” or “you”). Capitalised terms have the meaning given to them in the a.clinic General Terms and Conditions (the “Terms”).

We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the “GDPR”), Slovak Act No. 18/2018 Coll. on the Protection of Personal Data and on Amendments to Certain Acts, and other applicable legislation.

a.clinic has not appointed a data protection officer. For any question about the protection of personal data, you can contact us by e-mail at martin@a.clinic or by letter to the registered office address given in clause 1.1.

The Platform is intended exclusively for persons who have reached the age of 18 (clause 1.8 of the Terms). We do not knowingly process the personal data of persons under 18.

a.clinic is not a healthcare provider. It does not carry out medical examinations, determine a diagnosis, assess the suitability of treatment, determine a medicine or its dosage, or issue medical prescriptions (Article I of the Terms).

a.clinic is an independent controller when it processes personal data in particular for the following purposes:

1. a)creating and managing the user account,
2. b)concluding and performing the Contract and the technical handling of orders and payments,
3. c)allocating a healthcare provider according to objective organisational criteria,
4. d)processing the answers to the intake health questionnaire before a healthcare provider is allocated (Article V),
5. e)communication with the Client and customer support,
6. f)the security and technical operation of the Platform,
7. g)fulfilling its own legal obligations and protecting legal claims,
8. h)measuring visits to and use of the Platform in order to improve it, on the basis of consent to analytics technologies, and obtaining feedback (point 4.11),
9. i)marketing cookies on the basis of consent.

Healthcare is provided by an independent healthcare provider (the “HCP”) who has been allocated to you and whose identity you see before you submit your order (clause 5.4 of the Terms). The HCP is an independent controller of the personal data it processes for the professional assessment of your health, diagnosis, treatment, the prescribing of medicines and the keeping of medical records, and it is responsible for that processing.

Once an HCP has been allocated, a.clinic processes health data and other data relating to healthcare (clause 3.4) for the HCP as its processor under Article 28 GDPR: it stores the data, makes it available to the HCP's doctor and provides the technical means for consultations and communication. It does so solely on the HCP's instructions and not for its own purposes (clauses 4.7 and 11.4 of the Terms).

The prices of the health services are the HCP's prices, and payments are made through the Stripe payment gateway to the HCP's payment account (clauses 7.3 and 8.6 of the Terms). a.clinic processes payment-related data only to the extent necessary to conclude and perform the Contract, keep records of payments and fulfil its legal obligations.

About Clients we process in particular the following categories of personal data:

1. a)identification and contact data: first name and surname, e-mail address and chosen language,
2. b)account and Contract data: date of registration, consents given and the versions of the documents you agreed to, orders, withdrawals from the contract and cancellation of ongoing care,
3. c)payment data: amount, currency, date and status of the payment, and the customer, payment and subscription identifiers in the Stripe system, including unsuccessful payment attempts and the decline reason code reported by Stripe,
4. d)data needed to allocate an HCP: country of residence and consultation language,
5. e)consultation data: booking times, whether you joined the video consultation and your rating of the consultation,
6. f)technical and security data: IP address, browser and device type, sign-in records, application error records and service e-mail delivery records (the kind of e-mail, whether it was delivered, delayed or returned, and the domain of the recipient's address),
7. g)data about use of the Platform, if you have consented to its measurement (point 4.10): pages visited and questionnaire and order screens shown, the time spent on them and the order of steps, the website you came from (its domain only), the advertising campaign label, language, time zone, device type, operating system and browser, window size, page loading speed, and questionnaire answers that are not health data: sex, country of residence, consultation language, when you would like to speak to a doctor and an age group (not the date of birth); answers to optional questions about the Platform and any text you add to them (point 4.11),
8. h)the content of your communication with us, for example messages from the contact form or e-mails,
9. i)data obtained through cookies and similar technologies to the extent set out in the Cookie Policy.

You enter your payment card details directly into Stripe's payment form. a.clinic neither sees nor stores full payment card details.

The intake health questionnaire contains in particular data on sex, date of birth, height, weight and goal weight, illnesses and medical history, medicines taken and previous treatment, pregnancy, breastfeeding and contraception, eating disorders, physical activity, and your goals and preferences. Health data is a special category of personal data under Article 9 GDPR. Sex, date of birth, country of residence, consultation language and when you would like to speak to a doctor are not in themselves health data; we treat the other questionnaire answers as health data.

Once an HCP has been allocated, further data arises in the course of healthcare: the doctor's consultation notes, treatment decisions and data on the prescribed treatment, records of weight, waist circumference and doses taken, regular check-ins, and documents uploaded by you or the doctor (for example laboratory test results). a.clinic processes this data for the HCP as a processor (clause 2.4).

We obtain data mainly directly from you. Healthcare data also comes from the HCP's doctor, payment status data from Stripe, and technical data from your device.

Providing identification and contact data and questionnaire answers is voluntary, but without them it is not possible to conclude the Contract, allocate an HCP or provide a health service. Consent to marketing cookies is voluntary, and not giving it does not affect your use of the Platform.

The user account and the services of the Platform: performance of the Contract, Article 6(1)(b) GDPR.

Allocating an HCP according to the consultation language, country of residence and doctors' availability: performance of the Contract, Article 6(1)(b) GDPR. Answers to health questions are not used to allocate an HCP (clause 4.2 of the Terms).

The technical handling of orders and payments, withdrawals from the contract, cancellation of ongoing care and complaints: performance of the Contract, Article 6(1)(b) GDPR, and compliance with legal obligations protecting consumers, Article 6(1)(c) GDPR. For a personal payment link, we record when it was opened and how many times, so that we know it reached you and can help you with your order: legitimate interest, Article 6(1)(f) GDPR. We use no cookies and no third party for this.

Bookkeeping: compliance with a legal obligation under Slovak Act No. 431/2002 Coll. on Accounting, Article 6(1)(c) GDPR.

Service e-mails, for example sign-in codes, booking confirmations, consultation reminders and notices about the course of care and about payments: performance of the Contract, Article 6(1)(b) GDPR.

Replies to questions and requests sent through the contact form or by e-mail: performance of the Contract or steps prior to entering into it, Article 6(1)(b) GDPR; if you are not a Client, our legitimate interest in replying to your message, Article 6(1)(f) GDPR.

Security of the Platform, prevention of misuse and fixing errors, including application error records, payment gateway event records including unsuccessful payments, and service e-mail delivery records: legitimate interest in a secure and functioning Platform, Article 6(1)(f) GDPR.

Demonstrating the consents given and establishing, exercising or defending legal claims: legitimate interest, Article 6(1)(f) GDPR, and, where health data is concerned, Article 9(2)(f) GDPR. The obligation to demonstrate consent also follows from Article 7(1) GDPR.

Marketing cookies (Meta Pixel) for measuring the effectiveness of advertising: your consent, Article 6(1)(a) GDPR and Slovak Act No. 452/2021 Coll. on Electronic Communications.

Measuring visits to and use of the Platform, to find out where visitors leave the questionnaire and the order, what causes them difficulty and which parts of the Platform are slow or broken: your consent to analytics technologies, Article 6(1)(a) GDPR and Section 109(8) of Slovak Act No. 452/2021 Coll. on electronic communications, and for visitors from the Czech Republic Section 89(3) of Czech Act No. 127/2005 Coll. on electronic communications. a.clinic measures this with its own script and stores the data in its own database (point 7.2, Supabase); we do not give it to advertising partners or other third parties. No cookies or other persistent identifier are used: each page load is a separate visit. We do not store the IP address in the analytics data. It does not run in the user account. We do not use the data to make decisions about you or for profiling, and we do not link it to your user account. You can withdraw your consent at any time in “Cookie settings” (point 10.4).

Optional questions about the Platform (“Not ready yet?” at the payment step, “How did you hear about us?” and “What almost stopped you?” after payment, and the question how you would feel if you could no longer use a.clinic, which we show in your account no sooner than 14 days after your first consultation and no more than once every 90 days): a.clinic's legitimate interest in learning what helps and what holds back its Clients and in improving the Platform, Article 6(1)(f) GDPR. You do not have to answer, and not answering has no effect on your order or your care. We store the answers without a link to your user account; only authorised a.clinic staff read them; we do not pass them to the HCP or the doctor, publish them or use them for advertising. Please do not include information about your health in the text; if you do, we remove it from the text without undue delay.

You may object at any time to processing based on legitimate interest (Article X). We do not sell your personal data, and we do not use health data for marketing or for profiling for advertising purposes.

The answers you enter in the questionnaire are stored only in your browser (local storage as described in the Cookie Policy). a.clinic receives them only when, as part of your order, you create a user account or sign in to it. If you have consented to measurement of Platform use (point 4.10), a.clinic receives, while you fill in the questionnaire, which questionnaire screens you saw and for how long, and your answers to the questions that are not health data (point 3.3). It does not receive answers to health questions, your height, weight or date of birth before you create an account.

Before your answers are sent, we ask for a separate, explicit consent to the processing of health data, which is not pre-ticked. This consent is separate from accepting the Terms and from the order. We record when you gave it, in which language and to which version of this information it relates. If the consent cannot be recorded, the answers are not sent.

The legal basis for processing health data at this stage is your explicit consent under Article 9(2)(a) GDPR; the related processing is based on the performance of the Contract under Article 6(1)(b) GDPR.

The purpose is to obtain and store your answers securely and make them available to the allocated HCP for professional assessment. a.clinic does not medically assess the answers and does not use them for its own diagnosis, choice of treatment or medicine, advertising or profiling (clauses 4.4, 4.5 and 11.5 of the Terms).

An HCP is allocated to you when you pay for your order. From that moment your answers are made available to that HCP, which processes them as an independent controller on its own legal basis, in particular Article 9(2)(h) GDPR and Slovak Act No. 576/2004 Coll. on Healthcare, Services Related to the Provision of Healthcare and on Amendments to Certain Acts. From then on, a.clinic processes them for the HCP as a processor (clause 2.4).

You may withdraw your consent at any time by e-mail to martin@a.clinic. Withdrawal does not affect the lawfulness of processing before the withdrawal. After withdrawal we stop processing health data on this basis and delete the answers we process as controller. Without this data it may not be possible to continue with the order. Withdrawal does not concern data that the HCP processes on its own legal basis and is required to keep in the medical records.

Some answers in the questionnaire (for example an age under 18, residence outside the European Union, or certain health circumstances in which treatment may not be safe) lead to a message that the service is not suitable for you. The medical criteria of the questionnaire are set or professionally approved by the HCP or an authorised healthcare professional (clause 4.3 of the Terms).

This evaluation takes place directly in your browser, the answers are not sent to a.clinic for it, and you can review and correct them. It is not a decision about your treatment. If you believe the result does not reflect your situation, write to us at martin@a.clinic or contact your doctor. If you have consented to measurement (point 4.10), we record only that the notice was shown because of age or country of residence; if it was shown for a health reason, we record nothing.

The HCP is allocated automatically according to organisational criteria: the consultation language, country of residence, the earliest available appointment and the doctors' workload. This is not an assessment of your health or of the suitability of treatment (Article III of the Terms).

Diagnosis, the suitability of treatment, the medicine, its dosage and the issuing of a medical prescription are always decided by a doctor. a.clinic does not make such decisions by automated means.

We make your personal data available, to the extent necessary, to the HCP allocated to you and its doctors.

a.clinic uses the following processors, which process personal data only on our instructions:

1. a)Supabase: the Platform's database, sign-in, file storage and server functions; the database and file storage are located in a data centre in Zurich, Switzerland,
2. b)Vercel Inc.: hosting of the website and application; it processes technical access data such as the IP address, while questionnaire answers and other health data do not pass through it,
3. c)Whereby: video consultations; the connection runs directly between the participants, consultations are not recorded and the room is deleted after the consultation ends; Whereby processes technical connection data and the name displayed in the call,
4. d)Resend: sending service e-mails from a data centre in the European Union and reporting whether an e-mail was delivered; we do not track e-mail opens or link clicks through this service (for a personal payment link, see clause 4.3),
5. e)Google (Google Workspace): a.clinic's e-mail inbox, which receives your e-mails and messages from the contact form.

Stripe Payments Europe, Limited (Ireland) processes payment data as a payment service provider. The payment is made on the HCP's payment account; Stripe acts for the HCP and partly as an independent controller, for example in preventing fraud and complying with its legal obligations.

Meta Platforms Ireland Limited (Ireland) receives data from the Meta Pixel only if you have consented to marketing cookies, and only from the informational pages of the website (the home pages, the blog and the legal documents). This is in particular the page visited, the IP address, browser data and cookie identifiers. For the collection and transmission of this data, a.clinic may be a joint controller with Meta; any further processing is carried out by Meta as an independent controller.

We do not provide health data to advertising partners. No events are sent to the Meta Pixel from the questionnaire, the order, the user account or any other part of the Platform containing health data (clause 4.3 of the Cookie Policy).

If you are a doctor and connect your Google or Outlook calendar to the Platform, Google or Microsoft provides us with the times when you are busy. The details are set out in the section “Your calendar (for doctors)” on this page.

If you order a laboratory test from Unilabs through a link on the Platform, you do so directly with Unilabs and under its terms. a.clinic does not pass your personal data to Unilabs.

To the extent necessary, we may also make personal data available to accounting, tax and legal advisers and to public authorities where required by law.

The Platform's database and file storage are in Switzerland, for which the European Commission has adopted a decision on the adequate level of protection of personal data.

Some of the providers listed in Article VII, or their subcontractors, are established in the United States of America or elsewhere outside the European Economic Area (in particular Vercel, Resend, Google, Microsoft, the Meta group and subcontractors of Supabase and Stripe). Personal data is transferred to them only under the conditions of Chapter V GDPR, on the basis of an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified companies) or of standard contractual clauses approved by the European Commission.

On request at martin@a.clinic, we will provide you with information on the safeguards for a specific transfer.

We keep personal data only for as long as necessary for the purpose for which it is processed, or as required by law:

1. a)user account data for the life of the account; after the account is closed, we delete or anonymise it within 30 days unless it must be kept under points c) to f),
2. b)questionnaire answers where the order was not completed: until consent is withdrawn, and no later than 12 months after the questionnaire was last completed or updated,
3. c)healthcare data processed for the HCP: according to the HCP's instructions; the medical records are kept by the HCP for the period required of it by Slovak Act No. 576/2004 Coll. or by the law of the state in which the HCP operates,
4. d)a.clinic's accounting documents and records: 10 years following the year to which they relate, under Slovak Act No. 431/2002 Coll. on Accounting,
5. e)records of consents, orders, payments, withdrawals from the contract and complaints: for the duration of the Contract and then 3 years, having regard to the general limitation period under the Slovak Civil Code; where proceedings are pending, until they end,
6. f)communication through the contact form or by e-mail: while your request is being handled and then for no more than 2 years,
7. g)application error records and payment gateway event records for no more than 12 months, e-mail delivery records and other technical and security records for no more than 90 days, and the hash of the IP address that we use to limit the number of contact form messages for 2 days,
8. h)data about use of the Platform (point 4.10) for no more than 400 days from the visit; aggregate statistics from which no individual can be identified may be kept for longer,
9. i)answers to the optional questions under point 4.11: the options chosen for no more than 400 days, the text for no more than 12 months,
10. j)cookies and similar technologies: for the period of validity stated in the Cookie Policy.

Deleted data may remain briefly in database backups until the backups are overwritten, as a rule for no more than 7 days.

Under the conditions laid down in the GDPR, you have the right:

1. a)of access to your personal data (Article 15 GDPR),
2. b)to rectification of inaccurate or incomplete data (Article 16 GDPR),
3. c)to erasure of data (Article 17 GDPR),
4. d)to restriction of processing (Article 18 GDPR),
5. e)to portability of the data you provided to us on the basis of consent or the Contract (Article 20 GDPR),
6. f)to object to processing based on legitimate interest (Article 21 GDPR),
7. g)to withdraw consent at any time without affecting the lawfulness of processing before its withdrawal (Article 7(3) GDPR),
8. h)not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR).

You can exercise your rights by e-mail to martin@a.clinic or by letter to a.clinic's registered office. Exercising your rights is free of charge. We will reply without undue delay and at the latest within one month; in complex cases we may extend this period by a further two months, and we will inform you of this. If we have doubts about your identity, we may ask you to confirm it, for example by replying from your account's e-mail address.

You exercise rights relating to data processed by the HCP as controller, in particular the medical records, with the HCP. If you send such a request to us, we will forward it to the HCP without undue delay. The right to erasure does not apply to data that the HCP is required by law to keep.

You may change or withdraw your consent to analytics and marketing technologies at any time through “Cookie settings” in the footer of the website. Measurement stops immediately once you withdraw it.

If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. In Slovakia this is:

Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic)
Hraničná 12, 820 07 Bratislava 27
www.dataprotection.gov.sk

You may also lodge a complaint with the supervisory authority of the Member State of your habitual residence, place of work or place of the alleged infringement, for example the Úřad pro ochranu osobních údajů in the Czech Republic and the Agencia Española de Protección de Datos in Spain. This does not affect your right to bring proceedings before a court.

We take appropriate technical and organisational measures under Article 32 GDPR. Data is encrypted in transit and also encrypted in storage. Access rules in the database ensure that a Client sees only their own data and a doctor only the data of the Clients allocated to them. While a paid order is still waiting for a doctor, approved HCP doctors can see its data so that one of them can take it on.

Documents uploaded to the Platform are encrypted in the browser, with a separate key for each file. These keys are protected by a master key stored outside the database, and every release of a key is logged.

We do not put health data in web addresses or in analytics and marketing tools. Measurement of Platform use (point 4.10) does not record answers to health questions, height, weight, BMI or date of birth, does not record whether or why a notice of unsuitability was shown to you for a health reason, and does not run in the user account. Service e-mails do not contain questionnaire answers, a diagnosis, the name of a medicine or a dose; they contain only a notice and a link to the Platform.

Only persons whose access is necessary and authorised have access to the content of health data (clause 4.6 of the Terms).

If a personal data breach occurs that poses a risk to your rights, we will notify it to the Office for Personal Data Protection of the Slovak Republic and, in the cases under Article 34 GDPR, also to you.

We may change this information, in particular when legislation, our providers or the way the Platform works change. The current version is always available on the Platform. We will inform you of material changes in advance by e-mail or in your user account.

With every consent to the processing of health data, we record the version of this information that was made available to you.

This information takes effect on 7 October 2026.