Privacy policy

This notice explains in plain language what personal data we process at the MozgásKlinika clinic in Terézváros and on this website, on what legal basis, for how long, who we share it with, and what rights you have under the GDPR (Regulation (EU) 2016/679). The clinic is a member of the national MozgásKlinika franchise network, so this notice also describes the joint controllership with the network centre.

1. The controllers and joint controllership

The controller of the website and the clinic (within the meaning of Article 4(7) GDPR) is Fizio Medical Kft., which operates the MozgásKlinika Terézváros clinic. Processing related to healthcare, in particular health data and medical records, falls under the responsibility of Fizio Medical Kft. as an independent controller.

The central functions of the MozgásKlinika franchise network (brand management, quality assurance, professional methodology, network administration and communication) are carried out by Physio Consulting Kft. as the Franchise Centre. The Franchise Centre does not provide healthcare services and does not operate clinics.

Because of how the franchise works, some processing is joint controllership between the Franchise Centre and Fizio Medical Kft. under Article 26 GDPR. This typically covers network quality assurance and professional audits, running a unified professional and documentation framework, network-level administration and communication, and maintaining brand and service quality. Joint controllership does not mean that the Franchise Centre provides healthcare or interferes in the professional content of individual patient care: decisions about healthcare and the resulting responsibility always rest with Fizio Medical Kft.

We are not required to appoint a data protection officer. We answer data protection questions at the contact details below.

2. What we process, why, and on what legal basis

We only process as much data as is strictly necessary for each purpose (data minimisation). The table below shows, by purpose, the data processed, the legal basis and the retention period.

Purpose	Data processed	Legal basis	Retention
Online booking (Salonic)	name, phone number, email, chosen service and time, comment	performance of a contract, Art. 6(1)(b) GDPR	1 year after the booking, 8 years if invoiced
Treatment, physiotherapy records	name, date of birth, contact details, complaint, medical history, treatment log (health data)	legal obligation, Art. 6(1)(c) and Art. 9(2)(h) GDPR, under the Hungarian Health Act and Decree 62/1997 NM	30 years, as required for medical records
Contact by email or phone	name, email, phone number, content of the enquiry	legitimate interest, Art. 6(1)(f) GDPR: answering enquiries	1 year after the enquiry is closed
Newsletter (“Practical tips”)	email address, time of subscription, IP address	consent, Art. 6(1)(a) GDPR	until you unsubscribe, then 5 years to prove the unsubscription
Invoicing, accounting	name, billing address, service, amount	legal obligation, Art. 6(1)(c) GDPR under the Accounting Act	8 years
Network quality assurance and professional audit (joint controllership with the Franchise Centre)	booking and documentation data, limited to quality assurance purposes	legitimate interest, Art. 6(1)(f) and Art. 26 GDPR: maintaining consistent professional standards	2 years after the audit is closed
Website operation, security, necessary cookies	IP address, browser and device data, cookie identifiers, error logs	legitimate interest, Art. 6(1)(f) GDPR: secure operation of the website	up to 12 months
Statistics and marketing cookies (Google Tag Manager / Analytics)	device and visit data, cookie identifiers	consent, Art. 6(1)(a) GDPR and the Hungarian E-Commerce Act	until consent is withdrawn, up to 12 months
Displaying Google reviews	name, rating and text published publicly on the Google profile	legitimate interest, Art. 6(1)(f) GDPR: presenting the service truthfully	as long as the review is available on the Google profile

Health data is a special category of data under Article 9 GDPR. We process it only for treatment and for the documentation required by law. Only the treating physiotherapist and staff who have access to the records can see it, and they are bound by confidentiality.

3. Who we share data with

We do not sell your data or use it for purposes other than those described in this notice. The partners below act on our instructions as processors (Article 28 GDPR), under data processing agreements. Physio Consulting Kft. (Franchise Centre) is not a processor but a joint controller under Article 26 GDPR for network quality assurance and communication; data entered in the booking system may also be shared with it to fulfil the booking.

Partner	Role	Data transferred	Location / transfer
Lovable (Lovable Labs Incorporated)	hosting, operation and development platform of the website, technical logging	data entered on the website, IP address, technical logs	servers inside the EU/EEA and in the USA; transfers to third countries under the European Commission’s Standard Contractual Clauses (SCC), lovable.dev/privacy
ActiveCampaign	sending newsletters, managing the subscriber list, open and click statistics	email address, time of subscription, IP address, campaign statistics	cloud servers in the USA, under the European Commission’s Standard Contractual Clauses (SCC), mozgasklinika.activehosted.com
Salonic (online booking system)	managing online bookings, booking confirmations	name, phone number, email, chosen service and time	EU/EEA, salonic.hu
Google Ireland Ltd.	Google Tag Manager, Google Analytics (only with consent), displaying Google reviews	IP address, device and visit data, cookie identifiers	EU/EEA and USA, under SCCs and Google’s data protection framework, policies.google.com/privacy
Our accountant and invoicing partner	invoicing, accounting obligations	name, billing data, service, amount	Hungary

Transfers outside the EEA

For the hosting and platform provider (Lovable), the newsletter provider (ActiveCampaign) and Google’s services, your data may also be processed on servers in the United States. In these cases the transfer is based on the Standard Contractual Clauses adopted by European Commission Decision 2021/914 or certification under the EU–US Data Privacy Framework, with additional technical safeguards (encrypted transfer and storage).

4. Cookies and similar technologies

We use cookies necessary for the website to work on the basis of our legitimate interest, but statistics and marketing cookies only if you consent in the cookie banner. Measurement runs through Google Tag Manager with Google Consent Mode: without consent, statistics and marketing storage stays denied by default. You can withdraw your consent at any time, just as easily as you gave it. The full cookie list is in the cookie policy.

5. Your rights

Under the GDPR you have the rights below. We fulfil your request free of charge within 30 days at the latest; for complex requests we may extend this by up to two months and will let you know. If we cannot verify that the request came from you, we may ask for additional information to identify you.

• Information and access (Art. 15)
  You can ask whether we process data about you and request a copy.
• Rectification (Art. 16)
  You can ask us to correct inaccurate data or complete incomplete data.
• Erasure (Art. 17)
  You can ask us to delete your data if it is no longer needed or you have withdrawn your consent. We cannot delete medical records and invoices before the end of the retention period because of legal obligations.
• Restriction of processing (Art. 18)
  You can ask us to store your data but not use it, for example while the accuracy of disputed data is being clarified.
• Data portability (Art. 20)
  We provide data processed on the basis of consent or contract in a machine-readable format (e.g. CSV) or transfer it to another provider.
• Objection (Art. 21)
  You can object to processing based on legitimate interest; for direct marketing we always comply.
• Withdrawing consent (Art. 7)
  You can unsubscribe from the newsletter with one click at the bottom of every email, and withdraw cookie consent in the cookie settings. Withdrawal does not affect the lawfulness of earlier processing.
• Automated decision-making (Art. 22)
  We do not use automated decision-making or profiling that has legal effects on you.

6. Complaints and remedies

If you feel we are not handling your data properly, please write to us first; we can clarify most questions quickly. You can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, 1055 Budapest, Falk Miksa utca 9-11., postal address: 1363 Budapest, Pf. 9., phone: +36 1 391 1400, email: ugyfelszolgalat@naih.hu, web: naih.hu), or go to court: you can also bring the case before the regional court of your place of residence or stay.

7. How we protect your data

The website is only available over an encrypted (HTTPS) connection. Only staff who need it for their work get access to our systems, with individual password-protected accounts. Paper records are kept in a locked cabinet. Data is backed up regularly and access rights are reviewed every year. In the event of a data breach we report it to NAIH within 72 hours, and if the breach poses a high risk to you, we also notify you directly.

8. Children’s data

Treating a child under 16 and processing their data requires the consent of a parent or legal guardian; visitors under 16 may not subscribe to the newsletter. If we learn that we have received such data without consent, we delete it without delay.

9. Changes to this notice

We update this notice from time to time when our services or the legal environment change. The current version is always available on this page, with the effective date shown at the top. We announce significant changes in the newsletter or in a highlighted notice on the site.

10. Contact for data protection questions

For data protection questions, requests and complaints, contact us: Fizio Medical Kft., 1026 Budapest, Házmán utca 4. (clinic: 1065 Budapest, Podmaniczky u. 7.), email: belvaros@mozgasklinika.hu, phone: +36 30 403 1857. We reply to your request within 30 days.