Privacy Notice
Version of 27 October 2026
Who is responsible for your data
Your data is processed by Dr. Vasyl Pavliuk (“the doctor”, “we”). For any question about your data write to us on Instagram @dr_vasul.
What we collect when you book
- your name, Instagram handle or phone number, and optionally your email;
- the clinic, treatment, date and time you choose;
- your booking comment — it may contain health information (for example an allergy or previous treatments);
- a record of your consent: which boxes you ticked, the version of this notice, language and time;
- technical data used to block automated bookings (your IP address and browser signals are processed by Cloudflare Turnstile).
Why, and on what legal basis
| Purpose | Basis (GDPR / UK GDPR) |
|---|---|
| Booking your appointment and contacting you about it | steps taken at your request before a contract (Art. 6(1)(b)) |
| Health information in your comment, to prepare for your visit | your explicit consent (Art. 9(2)(a)) |
| Protecting the booking page from spam and abuse | legitimate interests (Art. 6(1)(f)) |
| News and offers — only if you ticked the separate box | your consent (Art. 6(1)(a)) |
Medical records kept during your visit are processed for the provision of healthcare (Art. 9(2)(h)); you will be informed about this in the clinic and asked to sign a separate consent form, including for photos.
Who else sees your data
- Taras Smaliukh, sole proprietor (Kuznya Studio), Ukraine — developer and technical support of the Vela system, acting only on the doctor’s instructions under a data processing agreement;
- Cloudflare — hosting, bot protection and backup storage (data stored in the EU);
- Neon — database (Frankfurt, Germany).
We do not sell your data or share it for advertising. If you message us on Instagram, Meta processes your messages as an independent controller under its own terms.
Cloudflare and Neon are US companies, and technical support is provided from Ukraine. Any transfer outside the EU/UK is protected by EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework.
How long we keep it
- a booking with no visit — 12 months after the last contact, then deleted;
- if you attend — medical records are kept as long as the law of the country where you were treated requires;
- your consent record — as long as the data it covers;
- backups — up to 35 days: after deletion, data may remain in encrypted backups for up to 35 days and is then permanently gone.
Your rights
You can ask for access to your data, correction, erasure, restriction, a copy in a portable format, object to processing, and withdraw your consent at any time (this does not affect processing before withdrawal). Write to us on Instagram @dr_vasul — we reply within one month.
You can complain to a supervisory authority:
- Austria — Datenschutzbehörde, dsb.gv.at
- Cyprus — Commissioner for Personal Data Protection, dataprotection.gov.cy
- United Kingdom — Information Commissioner’s Office, ico.org.uk
Other
- Online booking is for people aged 18 and over.
- The site uses no advertising or analytics cookies. Your browser only stores your choice of clinic and language; Cloudflare Turnstile may use technical data to check that you are human.
- If this notice changes, the new version will appear here with a new date.
Version of 27 October 2026