Privacy Policy

Vitalija Wellness Studio is the data controller for personal data processed via this website and in our studio in Mullingar, Ireland. You can reach us at info@vitalijawellness.com. We have not appointed a Data Protection Officer, as we are not required to do so.

We collect the following personal data:

• Identity and contact details: name, email address, phone number.
• Date of birth.
• Emergency contact name and phone number.
• How you found the studio, where you tell us.
• Booking history, attendance, cancellations and waitlist entries.
• Purchase and payment records.
• Package, membership, credit and Private programme credit data, including expiry dates.
• Private Movement Assessment and Private 1:1 session records (see the section below).
• Health and safety information: PAR-Q answers and any details you add to them, Health Questionnaire answers (current injuries or pain, previous surgeries, back/neck/spine issues, knee/hip/shoulder issues, osteoporosis or bone density concerns, high blood pressure, heart condition, diabetes, pregnancy or postnatal status, medications that may affect exercise, any other relevant health information), and your fitness or Pilates experience level.
• Health review status and whether your answers require review before you attend.
• Signed waiver / health declaration: your full name, the exact waiver text you agreed to, the waiver version, the date and time of signing, your electronic signature and your device user agent.
• Wellness Journal entries you voluntarily submit: daily ratings for energy, sleep, mood, stress and how your body feels, along with any optional written reflection.
• Email logs and transactional email records (for example booking confirmations, cancellations, waitlist notifications, programme and payment confirmations).
• Basic technical and session data needed to operate the app: device type, browser, IP address.

Payment card details are handled directly by Stripe — we never see or store full card numbers.

We only collect the categories listed above. We aim to keep personal data limited to what is reasonably necessary for the purpose it was collected for.

To support safe participation in group classes, Private Movement Assessments and Private 1:1 training, we may collect information about your health and physical condition. This is gathered through the onboarding forms listed above (PAR-Q, Health Questionnaire, waiver and health declaration, emergency contact details) and, where you attend a Private Movement Assessment, through what you tell us in person about your movement, physical capability, current limitations and relevant health history.

Health-related information may constitute special category personal data under data protection law, and we treat it accordingly.

We use this information to:

• assess whether participation in a service is appropriate from a studio safety perspective;
• support safe delivery of Mat Pilates, Tower / Reformer Pilates, Strength & Tone and Private 1:1 sessions;
• understand relevant injuries, physical limitations or movement considerations;
• support a Private Movement Assessment and record the studio’s recommended next step;
• maintain appropriate emergency and safety information;
• adapt your participation, ask you to seek medical advice, or decline participation where reasonably necessary for safety.

Vitalija Wellness Studio does not provide medical diagnosis, physiotherapy or medical treatment, and a Private Movement Assessment is none of these. Health information is never used for advertising or marketing.

If you book a Private Movement Assessment, we store records relating to the appointment itself: the date and time, your attendance status, the outcome recorded after your Assessment, the recommended next step (for example Private 5, Private 10, group classes, or a deferred / referral outcome), your resulting programme eligibility, and Assessment credit information where a credit applies.

Assessment outcomes and next steps are recorded manually by Vitalija or another authorised studio professional after your session. They are not generated automatically and are not a medical decision.

Where you go on to a Private programme, we also store your Private session bookings, reschedules, cancellations, attendance status and remaining Private credits. This information is used to administer your Private training journey and the related bookings, programmes and payments.

We process personal data to create and manage your account, take and manage class and Private session bookings, record attendance, handle cancellations and waitlist places, manage memberships, packages, class credits and Private programme credits, keep your booking history, and keep records of payments and refunds.

Payments are processed by Stripe. Stripe receives the information it needs to take and record your payment, and we store payment records (such as amount, date, product and payment reference) so we can manage your purchases and meet our accounting obligations. We do not use any other payment processor.

The Wellness Journal is an optional, private feature. If you choose to use it, your daily check-ins and any wellbeing summaries derived from them (such as weekly and monthly reflections) are treated as personal wellbeing information.

This information is collected only to help you better understand your own wellbeing over time and to allow your Vitalija Wellness Studio coach to provide more personalised support. It is never sold, never shared with other members, and never used for advertising.

Access is restricted to you and authorised studio staff. You can stop using the Wellness Journal at any time, and you can request deletion of your entries as part of an account deletion request.

The Wellness Journal is not a medical service and is not used to make any medical diagnosis.

We use your contact details to send service (transactional) communications that are part of using the studio, including booking confirmations, cancellation and reschedule notifications, waitlist notifications, class change notices, Assessment outcome and next-step emails, programme and payment confirmations, membership renewal and cancellation notices, and other operational notices.

These are separate from optional marketing emails. Marketing emails are only sent where you have asked to receive them, and every marketing email includes a one-click unsubscribe. Unsubscribing from marketing does not stop service emails, which are necessary to manage your bookings and purchases.

For ordinary personal data we rely on:

• performance of our contract with you — your account, bookings, packages, memberships, Private programmes and payments;
• legal obligation — accounting and tax records, and health and safety duties;
• legitimate interests — running a safe, well-organised studio, keeping accurate records and preventing misuse;
• consent — optional marketing emails, optional advertising measurement (Meta) and optional product analytics (PostHog), which you can withdraw at any time.

Health and safety information (including PAR-Q answers, Health Questionnaire responses, injuries, medical conditions, medications, pregnancy or postnatal information, signed health declarations and health information shared during a Private Movement Assessment) is special category data. We ask for this information as part of the mandatory onboarding and Assessment process before you take part in physical activity, and we use it only for the safety purposes described above. If you would like written confirmation of the specific Article 9 condition we rely on, please contact us and we will provide our current position in writing.

Access is limited to Vitalija and other authorised studio staff with an admin account, and only for legitimate studio, safety and service-delivery purposes such as running classes, managing bookings and payments, recording Assessment outcomes and responding to your requests. Health information is only accessed where it is needed for those purposes.

Service providers that operate parts of the app may process personal data on our instructions, as set out below. We do not sell your data.

• Supabase — database, authentication and storage for your account, bookings, health and safety records and Assessment records.
• Stripe — payment processing and payment records.
• Our application hosting and infrastructure provider — running this website and app.
• Transactional email delivery provider used by our application platform — sending the service emails described above.
• MailerLite — sending optional marketing emails to people who have opted in.
• PostHog — optional product analytics, hosted in the European Union, only where you have accepted analytics cookies. PostHog acts as a service provider (data processor) on our instructions.
• Google services, including Google sign-in where you choose it and Google Workspace for studio email correspondence.
• Meta — website and advertising measurement, only where you have accepted marketing cookies.

These providers process personal data only for the purposes described here.

Some of the providers above are international organisations and may process personal data outside the European Economic Area. Where that happens, we rely on the transfer safeguards put in place by the provider in their data processing terms. If you would like details of the safeguards that apply to a particular provider, contact us and we will share the current position.

We keep personal data for as long as we need it for the purpose it was collected for, and then for as long as we are required or reasonably need to keep it. In practice:

• Account records — while your account is active, and for a limited period afterwards to handle queries or reactivation.
• Bookings, attendance, packages, credits and Private programme records — while your account is active and afterwards where needed for records, disputes or legal claims.
• Payment and accounting records — for the period required by Irish tax and accounting law.
• Health and safety information, signed declarations and Private Assessment records — while your account is active and afterwards only for as long as reasonably necessary for health and safety, insurance or legal-claim purposes.
• Transactional email records — for a limited period so we can confirm what was sent and troubleshoot delivery.
• Optional product analytics data (PostHog) — for no longer than 12 months, and only where you have accepted analytics cookies.

Certain records may be retained for up to 6 years where required for legal, accounting, insurance, health & safety, dispute or legitimate business purposes. We do not keep health information indefinitely. You can ask us to delete your account at any time.

We use reasonable technical and organisational measures to protect your personal data, including authenticated access, database-level access rules, role-restricted admin access and encryption in transit. No online service can be guaranteed to be completely secure, but we work to reduce risk and to keep access limited to those who need it.

We do not make decisions about you with legal or similarly significant effect using only automated processing. Health reviews and Private Movement Assessment outcomes and recommendations are decided and recorded by studio staff, not by an algorithm.

Clients under 16 require parent or guardian consent before attending, and we ask them to contact the studio directly before booking so that consent and health information can be handled appropriately.

You have the right to access your data, to have inaccurate data corrected, to request erasure, to restrict or object to processing, and to data portability where it applies. Where we rely on your consent — for example marketing emails or non-essential cookies — you can withdraw it at any time. You may also withdraw consent for health information processing, although this may mean you cannot participate in classes or Private sessions. To exercise these rights, email info@vitalijawellness.com. You may also lodge a complaint with the Irish Data Protection Commission (dataprotection.ie).

You can request deletion of your account from your profile page or by emailing info@vitalijawellness.com. Full details of what we remove and what we may retain are on our account deletion page.

We use a small number of essential cookies to keep you signed in and to remember your preferences, including your cookie choice. Essential cookies remain active for security and core app operation and are not optional.

In our cookie banner you can choose two optional categories:

• Analytics — controls PostHog product analytics (see the next section).
• Marketing — controls Meta advertising measurement (the Meta Pixel and related conversion measurement).

The two categories are independent: you may grant one and reject the other. PostHog is not initialised unless you explicitly grant Analytics consent, and Meta advertising measurement only loads if you grant Marketing consent. Rejecting Analytics does not prevent account access, purchases, bookings, class or Private session booking, or any other essential app function. You can change or withdraw either choice at any time through “Cookie settings”. We do not use health information for any of these purposes.

The website and the app share a single consent preference (the vws_consent_v1 preference) across the vitalijawellness.com domain. This means a choice made on the website is honoured in the app and vice-versa, and prevents conflicting choices across the two.

Where you accept Analytics cookies, Vitalija Wellness Studio uses PostHog Product Analytics, hosted in the European Union, to understand how the app is used so we can improve it. Specifically, it helps us understand:

• which app screens and journeys are used;
• where users encounter technical friction;
• where registration, purchase or booking journeys are abandoned;
• which app functionality may need clarification or improvement.

The product analytics data that may be collected includes only:

• the app screen or route path you are on;
• navigation and explicitly defined product actions;
• approximate session timing;
• browser, device and technical information;
• referrer and campaign attribution where available;
• a pseudonymous analytics identifier;
• for a consenting signed-in user, the internal system user ID only — without your name or email.

PostHog must not receive:

• names, email addresses or phone numbers;
• dates of birth or emergency contacts;
• passwords, authentication codes or account-recovery data;
• free-text form content;
• payment card or Stripe payment details;
• H&S, PAR-Q or Health Questionnaire answers;
• injury, medical, pregnancy, medication or health-condition information;
• wavers or signatures;
• Wellness Journal check-ins, scores, entries or reflections;
• private assessment answers or private-session notes;
• administrator content or client-management records.

Automatic click capture is not currently enabled, session replay is not currently enabled, and sensitive form fields and sensitive routes are not being recorded.

The lawful basis for optional product analytics is your consent. PostHog acts as a service provider (data processor) on our instructions and the project uses PostHog EU infrastructure. Analytics data is retained for no longer than 12 months, access is restricted to authorised studio administration, and the data is used only to improve the app and client journey. It is not sold and is not used to make solely automated decisions about clients. Withdrawing Analytics consent stops further collection going forward.

This is separate from Meta advertising measurement, which is governed by the Marketing consent category described above.