Privacy Policy

Last updated: 11 October 2026

This policy explains how personal data is processed in FasciApp (app.bodyawareness.ee) under the EU General Data Protection Regulation (GDPR).

1. Controller

Integral Body Institute sp. z o.o., ul. Gipsowa 42, 25-752 Kielce, Poland (KRS 0000643440, NIP 9591978899, REGON 365695077). Contact: contact@integralbodyinstitute.com. We have not appointed a data protection officer.

2. What we process, why, on what basis and for how long

• Account (email, password stored hashed by Supabase, sign-in times): to give you an account and run the service. Basis: contract, Art. 6(1)(b). Kept until your account is deleted.
• Practitioner listing (name, optional practice / business name, phone, WhatsApp availability, email, website, up to 3 locations with address and map coordinates, photo, training tags, bio): to show you in the directory. Basis: contract, Art. 6(1)(b); it is public only when you tick "Show me publicly on the map", and you can untick it at any time. When public, everything in your listing, including email and phone, can be seen by anyone, without signing in. Kept until you delete the listing or your account.
• Messages (sender, recipient, text up to 1,000 characters, sent and read times): to deliver private messages between signed-in users. Basis: contract, Art. 6(1)(b). Only sender and recipient can read them; IBI reads a message only when handling a report about it or where required by law (legitimate interest in safety, Art. 6(1)(f)). Private messages are kept for 12 months and then deleted automatically, and are also deleted when the account is deleted.
• Session log (client initials, date, duration, optional comment): stored in our database (Supabase, EU) so you can use it on any device. For this content you are the controller and IBI is your processor (see Terms §15). Do not enter names, health details or identifying notes. Kept until you delete the entry or your account. PDF and email exports are created on your device and sent from your own email app; IBI does not receive them.
• Reports and support emails: to handle them. Basis: legal obligation (EU Digital Services Act, Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)). Kept up to 2 years after the case closes.
• Technical data (IP address, browser, time of request) in server logs of our providers: to deliver and secure the service. Basis: legitimate interest, Art. 6(1)(f). Kept for the providers' short log periods.

Providing data is voluntary, but without an email and password you cannot create an account. We make no automated decisions or profiling with legal or similarly significant effects. We do not sell your data and use no advertising or analytics tools.

3. Processors and other recipients

• Supabase Inc. (database, sign-in, messaging) – data stored in the EU (Frankfurt, Germany), under a data processing agreement. Supabase is a US company; any access from outside the EEA is covered by the EU Standard Contractual Clauses.
• GitHub Inc. (hosting of the app via GitHub Pages, USA) – receives your IP address and request data when the app loads. Transfers rely on the EU–US Data Privacy Framework.
• OpenStreetMap Foundation (Nominatim address search, UK) – receives the address you type and your IP when you place a location on the map. The UK has an EU adequacy decision.
• Esri (map tiles, server.arcgisonline.com, USA) – receives your IP address and the map area you view.
• Content delivery networks loading the app's code and fonts: Google Fonts (Google, USA), unpkg and cdnjs (Cloudflare, USA) and jsDelivr – they receive your IP address. Transfers rely on the Data Privacy Framework or Standard Contractual Clauses.
• Authorities, courts or advisers where required by law or to defend legal claims.

4. Cookies and device storage

FasciApp sets no tracking or advertising cookies. It stores in your browser's local storage only what is strictly necessary: your sign-in session, and a cache of the app's files so it works as an installed app. No consent is needed for this; you can clear it in your browser settings at any time (you will be signed out).

5. Minors

FasciApp accounts are for people aged 18 and over. We do not knowingly process data of children; if you believe a child has an account, tell us and we will delete it.

6. Your rights

You can ask for access, correction, deletion, restriction, data portability, and object to processing based on legitimate interest. You can untick public visibility, edit or delete your listing and session entries in the app at any time. To delete your whole account (including messages and session log) or use any right, email contact@integralbodyinstitute.com; we reply within one month. You may complain to the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warszawa, Poland (uodo.gov.pl), or to the authority in your country.

7. Security

Data is encrypted in transit, and database rules (row-level security) ensure that private listings, messages and session logs can be read only by the users they belong to.

8. Changes

We will update this policy when our processing changes and tell account holders about material changes.

9. Contact

contact@integralbodyinstitute.com