Privacy notice

Updated 14 November 2026

1. In short

I collect only the information I need to book your visits, treat you safely and send you an invoice. Health information is confidential. I never sell your data or use it for advertising.

2. What data I process

• Contact details: name, phone number, email address and, for home visits, your address.
• Booking details: the service, date and time, and anything you write in the booking notes.
• Health information: what you tell me about your condition, my findings, the treatment given and the plan we agree on. As a physiotherapist I am required to keep patient records.
• Billing details: the services you have used, invoices and payments.
• Messages: what you send me by WhatsApp, text message or email.

3. Why and on what legal basis

• Providing the service you booked (contract, GDPR Article 6(1)(b)).
• Health care and patient records (legal obligation, Article 6(1)(c), and provision of health care by a professional bound by confidentiality, Article 9(2)(h)).
• Invoicing and accounting (legal obligation, Article 6(1)(c)).
• Answering your messages (legitimate interest, Article 6(1)(f)).

4. This website

• The website has no contact form, no analytics and no advertising cookies.
• Your language choice is saved in your own browser (local storage). It is not sent to me.
• The fonts are loaded from Google Fonts, and the site is hosted by Hostinger. Both receive your IP address in order to deliver the page, as with any website.

5. Who else handles the data

I use these service providers, who process data on my behalf or as independent providers:

• Online booking: Cal.com booking page (Cal.com, Inc.). It stores the details you enter when booking and adds the appointment to my Google Calendar. The booking window is loaded from Cal.com's servers only when you open the booking window. Cal.com's servers then set a short-lived security cookie (Cloudflare).
• Messaging: WhatsApp (Meta), if you choose to contact me that way. Please avoid sending detailed health information by WhatsApp.
• Clinic bookings: bookings are saved in a separate Google Calendar that Fysioona (Oona Nikkanen) and the Clínica Sandalf reception can also see. They can make, move and cancel bookings on my behalf. They see the booking details (name, contact details, service, time and any notes you add), and they are bound by confidentiality.
• Patient records: I keep patient records on paper. They are stored locked away and are not in any electronic system.
• Accounting and invoicing: my accounting service provider.

I do not share your data with anyone else unless you ask me to (for example, a report for your doctor or insurer) or the law requires it.

Google and Meta may process data outside the EU/EEA, mainly in the United States. These transfers are covered by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

6. How long I keep the data

• Patient records: for as long as health care legislation requires.
• Invoices and accounting records: for the period required by accounting law, at least six years from the end of the year in which the financial year ended.
• Bookings and messages: deleted when they are no longer needed for your care or for invoicing.

7. How the data is protected

Only I handle your health information, and I am bound by professional confidentiality. Paper patient records are kept locked away. Booking and contact details are kept in password-protected services.

8. Your rights

You can ask to see the data I hold about you, have errors corrected, and in some cases have data deleted or its use restricted. Patient records that I must keep by law cannot be deleted on request. Where processing is based on consent, you can withdraw it at any time.

To use your rights, contact me using the details at the top of this page. If you think your data has been handled incorrectly, you can complain to a supervisory authority: the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi) or the Agencia Española de Protección de Datos in Spain (aepd.es).

9. Changes

I update this notice when my services or tools change. The date at the top shows the latest version.