1. Controller & Contact
VitalPath ("we", "us", "our") is the data controller for personal data processed via this website and our services.
- Legal entity: [COMPANY NAME — e.g., VitalPath Limited]
- Registered address: [FULL IRISH ADDRESS — e.g., 123 Main Street, Dublin 2, D02 XX00, Ireland]
- Company Registration Number (CRO): [CRO NUMBER]
- VAT ID: [IE + 8-9 digits — e.g., IE1234567AB]
- Email: [email protected]
- Phone: +353 1 234 5678
No Data Protection Officer (DPO) is appointed (not required under Art. 37 GDPR). Privacy inquiries: [email protected].
2. Data We Process
| Category | Data Types | Source |
|---|---|---|
| Contact / Lead | Name, email, phone, message, service interest | Contact form, email, phone, WhatsApp |
| Client / Service Delivery | Health/lifestyle data (weight, measurements, dietary habits, medical history), photos, progress notes, payment details | Directly from you during onboarding & coaching |
| Website Analytics | IP address (anonymised), device/browser, pages visited, referrer | Self-hosted / EU analytics (if enabled) |
| Technical | Server logs, error reports, cookie consent preference | Automatic via hosting / cookie banner |
Special category data (health) under Art. 9 GDPR is processed only with your explicit consent (Art. 9(2)(a)) for service delivery.
3. Purposes & Lawful Bases (Art. 6 GDPR)
| Purpose | Lawful Basis | Retention |
|---|---|---|
| Respond to inquiries / book discovery calls | Art. 6(1)(b) — pre-contractual steps | 12 months after last contact |
| Deliver coaching programmes & on-site services | Art. 6(1)(b) — contract performance + Art. 9(2)(a) explicit consent for health data | Duration of contract + 6 years (tax/accounting) |
| Send service-related emails (scheduling, resources, follow-ups) | Art. 6(1)(b) — contract / legitimate interest | Duration of relationship + 12 months |
| Marketing emails (with consent) | Art. 6(1)(a) — consent | Until withdrawal (unsubscribe link in every email) |
| Website operation & security | Art. 6(1)(f) — legitimate interest | Server logs: 30 days |
| Analytics (anonymised) | Art. 6(1)(a) — consent via cookie banner | Per analytics provider (e.g., Matomo: 13 months) |
| Legal compliance (tax, regulatory) | Art. 6(1)(c) — legal obligation | Per applicable law (min. 6 years IE) |
4. Recipients & Processors (Art. 28 GDPR)
We engage the following processors with Data Processing Agreements (DPAs) in place:
- FormSubmit.co — contact form forwarding (US; EU-US DPF certified). DPA: formsubmit.co/legal
- WhatsApp Business (Meta) — client communication (US; EU-US DPF certified). Explicit consent obtained at onboarding. Alternative EU channels offered (Signal, Threema, email).
- Email provider — [e.g., Proton Mail / Fastmail / Microsoft 365 EU region] — DPA in place.
- Hosting / CDN — [e.g., Netlify / Vercel / Hetzner EU] — DPA in place.
- Analytics — [e.g., Matomo Cloud EU / Plausible EU / Fathom EU] — no US transfer if self-hosted or EU-only.
We do not sell personal data. No third-party advertising pixels (Meta Pixel, Google Ads) are deployed without prior consent.
5. International Transfers
Where processors are outside the EEA (FormSubmit.co, Meta/WhatsApp), transfers rely on:
- EU-US Data Privacy Framework (DPF) adequacy decision (Commission Implementing Decision (EU) 2023/1795)
- Standard Contractual Clauses (SCCs) as fallback
- Your explicit consent for WhatsApp health-data communication (Art. 49(1)(a))
You may request a copy of transfer safeguards via [email protected].
6. Your Rights (Art. 15–22 GDPR)
- Access — receive a copy of your data
- Rectification — correct inaccurate data
- Erasure ("right to be forgotten") — delete data where no legal retention applies
- Restriction — limit processing
- Portability — receive data in structured, machine-readable format
- Objection — object to processing based on legitimate interest or direct marketing
- Withdraw consent — at any time (does not affect prior lawful processing)
Exercise rights by emailing [email protected]. We respond within 30 days. Identity verification may be required.
7. Automated Decision-Making & Profiling
We do not use solely automated decision-making with legal or similarly significant effects (Art. 22 GDPR). If the future Guide app uses AI for meal recognition or coaching suggestions, it will be human-in-the-loop and labelled "AI-assisted".
8. Security
Security measures are implemented at our hosting provider and internal systems. Specific configurations (TLS version, HSTS, encryption at rest) depend on the hosting setup — verify before publishing this claim.
- Encrypted transport (HTTPS) for all traffic
- Health data access limited to coaching staff on a need-to-know basis
- Incident response process in place
9. Cookies & Tracking
See our dedicated Cookie Policy. In summary:
- Necessary: session, cookie consent preference — no consent required
- Analytics: only with your consent via cookie banner
- Marketing: none currently deployed
10. Children
Our services are not directed to individuals under 16. We do not knowingly collect data from children. If you believe a child has provided data, contact us for immediate deletion.
11. Changes to This Policy
We may update this policy. Material changes will be notified via email (if we have your address) and/or a prominent website notice. The "Last updated" date above reflects the latest revision.
12. Supervisory Authority
You have the right to lodge a complaint with the Irish Data Protection Commission (DPC):
Data Protection Commission21 Fitzwilliam Square South
Dublin 2, D02 RD28, Ireland
dataprotection.ie