Privacy policy

DRAFT for legal review. This text is a starting point aligned with the GDPR and Kosovo Law No. 06/L-082 on Personal Data Protection. It must be reviewed by Vimea’s lawyer before publication.

Who we are

Vimea Baby SPA & Wellness, Rr. Enver Maloku (Rruga B), Lin Projekt Complex, Entrance 1, 10000 Prishtina, Kosovo — data controller. Privacy contact: [email protected].

What we collect

• Account data: name, email, phone, addresses.
• Children’s data (baby passport): name, date of birth, gender, photo (optional), allergies and health conditions (optional), measurements and milestones, session notes.
• Bookings, orders and payments (no card data — payments are processed by the bank).
• Your consents, with date, text version and IP address.

Why we use it

• To provide our services and keep your child safe during therapy (basis: contract and, for health data, your explicit consent).
• For appointment and order notifications (contract).
• For marketing only with your separate consent, which you can withdraw at any time.

Children’s data

Health details are encrypted. Only the therapists and reception staff caring for your child can see them, and every access is logged. Photos are stored privately and never published without your separate social-media photo/video consent, which you can withdraw in one tap.

Retention

Children’s records are archived 24 months after the last visit and erased on request. Financial records are kept for the statutory period.

Your rights

Access, rectification, erasure, restriction, portability (JSON + passport PDF export from your account), objection and withdrawal of consent. You may complain to Kosovo’s Information and Privacy Agency.

Processors

Hosting (EU), email, SMS and media providers — under data processing agreements.