Privacy policy

1. Who is responsible for your data

Data controller (responsable del tratamiento): Dr Violina Volkova — VIOLINA VOLKOVA, NIF/NIE Y9599022D, address: Via Augusta 134, 08006 Barcelona.

For any questions about your data, write to hello@femedology.violina.es. We will reply within one month, usually much sooner.

2. What data we collect and why

• Tests on the website. Answers are calculated directly in your browser and are not sent anywhere: we see neither your answers nor the result.
• Account. Your e-mail address for signing in by link, or your name and e-mail from your Google account (if you sign in with Google). Optionally, a name, phone number, city and photo that you add yourself.
• Purchases. Name, e-mail, order contents and amount, payment status. You enter your card details in the Stripe form — we do not see or store them.
• E-mails. Sign-in links, e-mails with purchased guides and service notifications; a sending log (address, subject, delivery status). We do not send marketing e-mails without your consent.
• Booking a consultation via the Telegram bot. Name, contact details (Telegram username, phone number or e-mail), preferred format and time, and a brief reason for the visit. The reason may concern health, so the bot asks for explicit consent before saving anything.
• Booking a time. If you pick a time in the bot, an event with your first name and the format is created in the doctor's calendar (Google Calendar) — without the reason for your visit or your contact details.
• Customer record. Your orders and requests, a status (for example "buyer" or "patient"), the team's notes about arrangements, and your profile photo if you uploaded one. Only the doctor and her assistant can see it.
• Visit statistics. Which pages are opened and which buttons are clicked, so we can see what is useful. No IP address, no test answers or results. We store the device's system (iOS, Android, Windows, Mac), the in-app browser (Instagram, Telegram and so on), the country from the network, the language and where you came from. Which test you took is not linked to your account.

3. Legal bases

• Performance of a contract (Art. 6(1)(b) GDPR): signing in to your account, buying and delivering guides, booking a consultation.
• Explicit consent (Art. 6(1)(a) and 9(2)(a) GDPR): the reason for the visit given in the booking bot. You can withdraw consent at any time with the /delete command.
• Legal obligation (Art. 6(1)(c) GDPR): keeping sales records for accounting and tax purposes.
• Legitimate interest (Art. 6(1)(f) GDPR): anonymised visit statistics and protecting the website from abuse.
• Customer record and team notes — legitimate interest (Art. 6(1)(f) GDPR): managing bookings and answering you; the "patient" status and health-related notes — your explicit consent and the provision of medical care (Art. 9(2)(a) and 9(2)(h) GDPR).

4. How long we keep data

• Reason for the visit in the bot — deleted 90 days after the request is closed; the request itself after 12 months.
• An unfinished conversation with the bot — deleted after 24 hours.
• Account sign-in session — 30 days; a sign-in link is valid for 15 minutes.
• Account and purchased materials — for as long as you use the account or until you ask us to delete it.
• Order data — 6 years as required by Spanish accounting and tax rules.
• Visit statistics — 24 months.
• Customer record, status, notes and photo — while you use your account or book with the doctor; deleted on request or with /delete.

5. Who else processes data

We do not sell data or share it for advertising. The website works with the help of these services (processors):

• Cloudflare — website hosting, database and file storage; Cloudflare Access — the team's sign-in to the CRM.
• Resend — sending e-mails.
• Google — signing in with a Google account (if you choose it) and the doctor's Google Calendar (the booking event with your first name).

Stripe processes payment data as an independent controller under its own privacy policy: only Stripe receives your card details.

Telegram is a channel you choose yourself for booking. Your chat with the bot goes through Telegram's servers, including outside the EU, and Telegram's policy applies to it. The doctor is notified of a request in her private Telegram channel — without the reason for your visit or your contact details.

Some of these companies are based in the USA. Data transfers rely on the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

6. Your rights

You can request access to your data, its rectification, erasure, restriction of processing and portability, object to processing and withdraw your consent. Write to hello@femedology.violina.es; you can delete your data in the booking bot yourself with the /delete command.

If you believe we have infringed your rights, you can lodge a complaint with the Spanish Data Protection Agency — AEPD (www.aepd.es).

7. Cookies and browser storage

• fm_session — the account sign-in cookie (HttpOnly, only after you sign in). The account does not work without it.
• fm_oauth — for 10 minutes while you sign in with Google, to protect the sign-in against forgery.
• The cart is stored in your browser’s localStorage and is not sent anywhere until you go to payment.
• The site stores nothing in your browser for statistics: the identifier lives only in the open tab. That is why there is no cookie banner.
• The Stripe payment form loads only on the checkout page and sets its own technical cookies to prevent fraud: __stripe_mid (about a year) and __stripe_sid (30 minutes).

8. Changes

If this policy changes, we will update this page and the version date at the top. We will notify account holders of significant changes by e-mail.