Plazia
Sign in

Privacy policy

In force since

Controller

Plazia, S.L. (demostración) (Plazia), tax ID B00000000, with its address at Calle de Ejemplo, 1, 23001 Jaén. For anything about your data: recepcion@plazia.example.com.

What we process and why

  • Your account: name, email and password (stored only as a cryptographic hash), to give you access and to tell you about your bookings and your account. Legal basis: performance of the contract (art. 6.1.b GDPR).
  • Your classes: the ones you book, your passes and their history, to provide the service. Basis: the contract.
  • Your appointments: the ones you ask for and their history, to treat you. Basis: the contract.
  • Contact form messages: to answer you. Basis: your consent, given by sending it.
  • Your sports activities: the files you upload or that arrive from the accounts you connect, with their GPS track, times, distances, power and heart rate. A track reveals where you live and where you go; heart rate is health data.
  • Your nutrition: plans and the food diary, with your allergies and intolerances, which are health data.
  • Your rehabilitation: the phased plans, how you feel and the pain you record, which are health data.
  • Your clinical record: what the professional treating you writes in each episode, and its attachments.
  • Your payments and invoices: billing details and charges. Basis: the contract and tax and commercial obligations (art. 6.1.c GDPR).
  • Your conversations with the team: the text is stored ENCRYPTED in the database and is read only by the people in the conversation.
  • Chat video calls: only the team member you are talking to can start one, from your conversation; it rings in the app and you decide whether to answer or decline. If you answer, your camera and microphone turn on and only the two people in the conversation see and hear each other. They are not recorded or stored anywhere: the video travels encrypted and only through the platform's servers. The conversation notes that there was a call and how long it lasted, or that it was missed or declined. Basis: the contract (art. 6.1.b GDPR).
  • Live sessions and recordings: the club's sessions can take place live. They are only recorded if the person running them turns recording on and you are told beforehand; for a one-to-one session, also only with the recording consent you gave in advance. The recording of a class can only be watched by the people booked into it. That of a one-to-one session, only by you and the team treating you. None is published anywhere, and all are deleted automatically after 90 days. The video travels encrypted and only through the platform's servers. Basis: the contract; for recording, your consent (arts. 6.1.a and 9.2.a GDPR).
  • Rehabilitation video calls: the professional in charge of your plan can call you from a session; it rings in the app and you decide whether to answer or decline. Only they can start it, never you or anyone else. If you answer, your camera and microphone turn on so they can see and hear you —you can turn them off at any time— and only the professional treating you sees it. The session notes that there was a call and how long it lasted, or that it was missed or declined. If the session is recorded, both views (theirs and yours) are kept under the same rules as above.
  • The messages of each rehabilitation session: what you write about a session is stored ENCRYPTED and only you and the team running your plan can read it. The notifications you get on your phone do not contain the text.
  • What you watch in the video library: which videos you open and how long you watch them, as viewing statistics so the team knows which content is used.

Health data (art. 9 GDPR)

Health data is a special category. We process it only with your explicit consent (art. 9.2.a), given in a separate checkbox when you register (or the first time you sign in after it starts being processed, if you registered before), which you can withdraw at any time by writing to recepcion@plazia.example.com: withdrawing does not affect what was processed before, but we stop processing that data. The clinical record is also processed for the provision of health care (art. 9.2.h), under professional secrecy. Your rehabilitation, its messages, its video calls and its recordings are also processed for the provision of health care (art. 9.2.h), by professionals bound by secrecy.

The application does not give medical advice: it describes what your data shows and the decision is yours.

How long we keep it

  • For as long as you have an account; deleting it removes your data, files and sessions, except what the law requires us to keep.
  • Clinical record: at least five years from the discharge of each episode (art. 17 of Spanish Law 41/2002), or the longer period the club sets.
  • Invoices and payments: six years (art. 30 of the Spanish Commercial Code), plus the tax periods.
  • Recordings of live sessions: 90 days after they end; then they are deleted automatically. Before that, you can ask for yours to be deleted by writing to recepcion@plazia.example.com.
  • Staff working-time records: four years (art. 34.9 of the Spanish Workers' Statute). Only relevant to people who work at the club.
  • Contact form messages: the period the club sets, one year unless it says otherwise.

Who else processes it (processors)

We do not sell or share your data. These process it on the club's behalf, under contract and only to provide the service:

  • The provider of the platform this service runs on, and its hosting provider.
  • The email service that sends the notifications.
  • Strava and Polar, only if you connect your account: we then fetch your activities from there, and you can disconnect it at any time.
  • YouTube, only for the classes the club decides to broadcast on its channel too.
  • Stripe or Redsys, whichever gateway the club uses to take payments. Card details are collected by the gateway; the club never sees them.

Your rights

You can access, rectify and erase your data, restrict or object to its processing, and ask for its portability by writing to recepcion@plazia.example.com. From your account you can export your data and delete the account. If you believe your rights have not been respected, you can complain to the Spanish Data Protection Agency (www.aepd.es).

What is stored in your browser

See the cookie policy.