Privacy notice

The data controller is PaphosMassage.cy, Mariou toka 14a, Chlorakas 8221, Paphos, Cyprus. Contact: WhatsApp or phone on +357 95 091 026.

Pages that show the Google rating also embed a Google map. That map is loaded from Google’s own servers, so when it appears Google receives your IP address and can set its own cookies under its privacy policy, independently of this site. This embedded content is loaded lazily (so it is not fetched unless you scroll to it), and nothing on this site reads or uses whatever Google sets. If you would rather avoid it, blocking third-party frames or scrolling past it is enough — no feature here depends on it.

The site sets no cookies. Two things are recorded when you visit:

• Server logs kept by the hosting provider (Vercel) for security and reliability — IP address, browser type and the page requested — and retained for a short period.
• Aggregate analytics via Vercel Web Analytics and Speed Insights. These are cookieless: no personal identifiers are stored, IP addresses are not retained, and the result is counts (page views, page-speed measurements) rather than profiles. That is why there is no consent banner — nothing here requires one.

No advertising, tracking pixels or third-party marketing tools are used.

If you choose “Enable notifications” and allow them in your browser, we store that browser’s push endpoint, encryption keys, consent time and notification policy version. We use them only for English Sunday booking reminders and updates about confirmed openings. You do not need to provide a name, email address or health information to subscribe.

Your browser’s push provider delivers the message. Subscription records are kept in a dedicated Redis store configured by the practice, for up to 180 days after signup or renewal on this website. Expired or invalid subscriptions are removed. Delivery markers are kept for up to 14 days to reduce repeat messages.

Your choice to subscribe is the consent for these messages. You can withdraw it on the notification settings page in the same browser, or block notifications in browser settings. Successful website removal deletes the server subscription; blocking at browser level stops delivery, and the server record is removed when the push provider reports it invalid or its retention period expires.

The website remembers “Not now” for seven days and subscription status in local browser storage. These preferences are not used for advertising profiles. Short-lived, hashed network identifiers help limit abusive signup requests and expire after two minutes.

Bookings are arranged in a WhatsApp conversation or by phone. Tapping a “Book on WhatsApp” link opens WhatsApp with a short pre-written message; nothing is sent until you press send in the app. WhatsApp is operated by Meta Platforms, which processes your messages under its own privacy policy.

Providing any of this is voluntary and only needed to arrange treatment: if you would rather not share something, say so and we will work around it.

To arrange treatment you may choose to share health information — an injury, a pregnancy, a chronic condition. This is special-category data. It is used only to plan and carry out your session, is kept in the chat thread and in brief treatment notes, is not shared with anyone outside your treatment, and is deleted on request.

Legal basis: your consent when you get in touch (Article 6(1)(a)), and for any health details, your explicit consent (Article 9(2)(a)). You can withdraw it at any time by asking for your notes to be deleted.

Hosting and messaging providers handle data on the way to or from this site. The notification store and browser push provider handle only the notification data described above; treatment notes are not included in notification messages.

• Vercel Inc. — hosting, server logs and the cookieless analytics described above, acting as a processor. Data is handled in the EU region where available; any transfer outside the EEA is covered by the European Commission’s standard contractual clauses.
• Meta Platforms Ireland Ltd. — WhatsApp. Meta is an independent controller for the messaging service itself, under the EEA privacy policy linked above; the content of a booking conversation is handled by me as described in this notice.

Chat history and treatment notes are kept for as long as you remain a client so that follow-up sessions build on the last one. Treatment notes are deleted after 24 months without a session, or sooner on request. Analytics data is aggregate and contains nothing about you individually.

You can ask at any time what is held about you, have it corrected or deleted, or object to its use. Send the request over WhatsApp or phone on +357 95 091 026. You also have the right to complain to the Office of the Commissioner for Personal Data Protection, Cyprus.