Privacy policy

Updated: 26 October 2026

We handle your personal data, especially health information, responsibly and only as far as needed to provide our service. We follow the General Data Protection Regulation (EU) 2016/679 (GDPR) and Lithuanian law. This page explains what we collect, why, how long we keep it and what rights you have.

1. General

1.1. Data controller: Edmundas Zlatkus ("KINERA", "we"), self-employed (individual activity certificate No. 1171634), address Viršilų g. 6, Vilnius, email info@kinera.lt, phone +370 657 87253.

1.2. Personal data means any information that can identify you directly or indirectly, such as your name, email or phone number.

1.3. This policy applies when you visit the site, book a consultation, order a plan, fill in the questionnaire or contact us in any other way.

1.4. We may update this policy. The latest version is always published on this page, with the update date shown at the top.

2. How we get your data

You are responsible for the accuracy of the data you provide. If you provide someone else's data (e.g. your child's), you must be entitled to do so on their behalf.

When you give it to us: signing up, filling in the questionnaire or contact form, emailing us.
When it arises from the service: notes about your fitness taken during the consultation and the exercise plan we create.
From providers that help us work: for example, Stripe tells us a payment was received.

3. Why we process data and what data

Providing consultations and plans

Data processed: Name, email, phone, health information (injuries, pain, surgeries, activity level), training goals, consultation notes, the plan created.
Retention period: For the duration of the service and 10 years after the last service, unless you withdraw consent earlier.
Legal basis: Performance of a contract (GDPR Art. 6(1)(b)); for health data, your explicit consent (GDPR Art. 9(2)(a)).

Diary and progress tracking

Data processed: Workout check-ins, wellbeing and pain ratings (0–10), comments, plans prepared for you.
Retention period: While you use the service and 10 years after, unless you withdraw consent earlier and ask us to delete it.
Legal basis: Your explicit consent, given when you first open the diary (GDPR Art. 9(2)(a)).

Reminders on your phone (push notifications)

Data processed: Your device's notification address and keys (created by the browser), browser type, when we last sent one. Notifications contain no health data – only the workout name and a reminder.
Retention period: While notifications are on; deleted when you turn them off in the diary or in your phone settings.
Legal basis: Your consent, given by tapping "Įjungti priminimus" and allowing notifications (GDPR Art. 6(1)(a)).

Publishing testimonials on the site

Data processed: The public name you choose (e.g. "Tom K."), your rating (1–5), the testimonial text and, optionally, your sport and result. Your surname, email and health data are never published.
Retention period: Until you withdraw consent (write to info@kinera.lt) or delete the testimonial yourself in the diary.
Legal basis: Your consent, ticked when leaving the testimonial (GDPR Art. 6(1)(a)).

Website assistant (artificial intelligence)

Data processed: Your questions and the assistant's answers, the time, where the chat took place (on the site or in the diary; in the diary – which client), a hashed IP address for the question limit. Please don't share health or other personal details.
Retention period: 90 days, then deleted automatically.
Legal basis: Legitimate interest in answering your questions and improving the site's information (GDPR Art. 6(1)(f)). Answers are written by Anthropic's Claude model; Anthropic processes the data as a processor and does not use it to train models.

Discount code and KINERA news by email

Data processed: Email, language, when the code was sent; if you ticked the box – your consent to tips and offers and its date.
Retention period: Sending the code – 1 year; news – until you unsubscribe (the "Unsubscribe" link in every email or by writing to info@kinera.lt).
Legal basis: Sending the code – your request (GDPR Art. 6(1)(b)); news – your consent, given by ticking the box (GDPR Art. 6(1)(a)).

Bookings and reminders

Data processed: Name, email, chosen service, specialist, date and time, video call link.
Retention period: Until the service is provided and 1 year after.
Legal basis: Entering into and performing a contract (GDPR Art. 6(1)(b)).

Payments and accounting

Data processed: Name, email, service, amount, payment date and status. We never receive card details; Stripe handles them.
Retention period: As required by accounting law (usually 10 years).
Legal basis: Legal obligation (GDPR Art. 6(1)(c)); performance of a contract (GDPR Art. 6(1)(b)).

Handling questions, requests and complaints

Data processed: Name, email, content of the message and reply.
Retention period: For the duration of the correspondence and 1 year after; in a dispute, until it is resolved and 3 years after.
Legal basis: Your consent (GDPR Art. 6(1)(a)); legitimate interest in replying and defending our rights (GDPR Art. 6(1)(f)).

Site operation and security

Data processed: IP address, browser type, request times (server logs).
Retention period: As set by the hosting provider, but no longer than 30 days.
Legal basis: Legitimate interest in keeping the site secure (GDPR Art. 6(1)(f)).

Messaging with your physiotherapist on WhatsApp

Data processed: Phone number, name, messages about your plan and training.
Retention period: While the service is provided; you can delete messages in WhatsApp at any time and withdraw consent by writing to info@kinera.lt.
Legal basis: Your consent given at sign-up (GDPR Art. 6(1)(a)). Without it we talk by email.

Measuring ad performance (Meta Pixel)

Data processed: Cookie identifiers, pages visited and actions on the site (e.g. you booked, started a payment, bought a service and for how much), IP address, browser and device information. We also report purchases to Meta from our server (Meta Conversions API), together with a hashed version of your email address so Meta can match the purchase to an ad; Meta never sees the address itself. We don't send questionnaire answers or health information to Meta, and the Meta Pixel doesn't run in the cabinet or diary.
Retention period: Cookies up to 90 days; Meta keeps the data it receives under its own privacy policy.
Legal basis: Your consent (GDPR Art. 6(1)(a)) given in the cookie banner. You can withdraw it at any time on the cookie page ("Cookies" link at the bottom of the site) with "Turn cookies off".

Gift voucher

Data processed: Buyer's name and email, recipient's name, message, service, voucher code, validity; once used – the recipient's email and order.
Retention period: As required by accounting law (usually 10 years).
Legal basis: Entering into and performing a contract (GDPR Art. 6(1)(b)); legal obligation (GDPR Art. 6(1)(c)). The recipient's name is given by the buyer and used only on the voucher.

Discount code via a Facebook / Instagram ad form

Data processed: The details given in the form (name, email and, if asked, phone number), when it was sent, and the ad it was sent from.
Retention period: 1 year from sending the form; if you become a client, as stated in the other rows of this table.
Legal basis: Your request for a discount code (GDPR Art. 6(1)(b)); news only if you agreed to it in the form (GDPR Art. 6(1)(a)).

Where we rely on your consent, you can withdraw it at any time. Withdrawal doesn't affect processing carried out before it.

4. Our principles

We collect only the data needed for the stated purposes.
We process it lawfully, fairly and transparently.
We promptly correct or delete inaccurate data.
We don't keep data longer than necessary.
We never sell your data or share it except as described in this policy.

5. Who we share data with

5.1. We share data only with service providers (processors) that help us work, and only as far as they need it:

Stripe Payments Europe Ltd. (Ireland): payment processing.
Cal.com, Inc. (USA): booking, calendar and video call links.
Google Ireland Ltd. (Ireland): Google Calendar and Google Meet for consultation scheduling and video calls.
Resend (Plus Five Five, Inc., USA): sending email from the website.
Anthropic, PBC (USA): answers of the website assistant (Claude).
ImprovMX (USA): forwarding email sent to info@kinera.lt.
Vercel Inc. (USA): website hosting and visitor statistics (Vercel Web Analytics: no cookies, only aggregated, non-identifying data such as pages visited, referrers, country and device type).
Supabase Inc. (data stored in the EU, Frankfurt): client accounts, diary and plan files.
WhatsApp Ireland Ltd. (Ireland): messaging with your physiotherapist, if you agreed to it at sign-up.
Meta Platforms Ireland Ltd. (Ireland): measuring ad performance (Meta Pixel), only if you accept cookies, and ad forms (if you used one to ask for a discount code). For collecting and sending this data to Meta we are joint controllers; Meta then processes it under its own privacy policy.

5.2. Where the law requires, we may provide data to public authorities such as the State Tax Inspectorate, courts or law enforcement.

5.3. Some providers are outside the European Economic Area (EEA). In that case data is transferred only under GDPR safeguards: the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.

6. Your rights

6.1. Send requests to info@kinera.lt. We may ask you to confirm your identity.

6.2. We'll reply within 1 month. For complex requests we may extend this by 2 more months and will tell you so within the first month.

6.3. After erasure we may keep only what the law requires (e.g. accounting records) or what is needed to resolve a dispute.

To know how your data is processed.
To access your data and get a copy.
To have inaccurate data corrected or incomplete data completed.
To have your data erased (the "right to be forgotten") when it is no longer needed, you withdraw consent, or it is processed unlawfully.
To restrict processing while we look into your request.
To receive your data in a common machine-readable format and move it to another controller.
To object to processing based on legitimate interest.
To withdraw consent at any time.
To complain to the State Data Protection Inspectorate (vdai.lrv.lt). We'd encourage you to contact us first; we'll try to resolve things quickly.

7. How we protect data

7.1. We use technical and organisational measures: encrypted connections (HTTPS), access limited to the specialists who need the data, strong passwords and two-factor authentication on provider accounts.

7.2. Our specialists are bound not to disclose your data to third parties.

7.3. To avoid data loss we make a backup once a week. Backups are kept for 3 months and then deleted automatically, so erased data disappears from backups within 3 months at most.

8. Cookies

How we use cookies is described on the Cookies page.