Privacy policy

1. Who we are

Aventra is a service for following exercise, care and recovery programmes with a team of therapists.

Responsible for your data: [POTVRDITI: legal entity, address, e-mail].

2. What we keep

We keep only what you or the team working with you enter:

• account: e-mail, first and last name, language, password (only in encrypted form);
• contact: phone number, country and city, if you enter them;
• getting to know you: your answers about goals and how you like to work;
• health answers: the health questionnaire and the checks for individual methods;
• documents and photos: findings, referrals and, only when a programme asks for them, body photos;
• daily and weekly check-ins, your starting point and measurements;
• questions and requests to the team, with their messages;
• studio appointments and the answers before and after a visit;
• payments: the amount, the programme and the outcome; we never see or keep the card number, only a masked record;
• use of the app: which lessons you watched and when you signed in.

3. Why, and on which consent

The consents are separate, and you can give or withdraw each on its own, in Profile → Privacy:

• health processing and the service: “I agree that Aventra stores and uses my health information to provide the service.”
• marketing messages: “Send me news and offers by email. I can unsubscribe at any time.”
• public use of photos or your experience: “I agree that Aventra may publicly use my photos or experience, agreed with me before each use.” We never ask for this at registration and it is never ticked in advance.
• body photos for an assessment: a separate consent, tied to the programme that asks for them.

Consent for assessment is not consent for marketing. Without the health consent you can still use the Library; tracking stays off. Legal basis of the processing: [POTVRDITI: legal basis for each kind of data].

4. Who has access

Access is limited to authorised people who need the data to provide the agreed service:

• the owner and the therapists see your record, including health data and documents;
• administration (support) sees your account, contact, programmes, payments and appointments, but not your health data, documents or internal notes;
• the owner can decide that therapists see only the clients they work with.

Every access is recorded: who opened which part of your data, and when. In Profile you see who opened your data in the last 30 days. Every change the team makes to your record is recorded too.

5. Where the data is kept

The app and its database run at Railway [POTVRDITI: region]. For parts of the service we use:

• Resend, to send e-mails;
• Monri, for card payments (the card number never reaches us);
• Setmore, to book studio appointments, if the studio uses it [POTVRDITI: whether Setmore is used];
• Meta (WhatsApp), only if and when we switch on WhatsApp messages [POTVRDITI].

Backups and encryption: [POTVRDITI: backups, encryption].

6. How long

• we keep your data while your account exists;
• a removed document is deleted for good after 30 days [POTVRDITI: how long findings are kept after the work together ends];
• access records are kept for 24 months;
• payment records are kept after the account is deleted, no longer linked to you, as long as the law requires [POTVRDITI: 10 years].

7. Photos

Body photos are not required by default. Only a programme for which they help the assessment asks for them, explaining why; you can buy and start the programme without them.

We use photos only for assessment and follow-up in this program. We never publish them. Photos are never used publicly without a separate consent. If you withdraw your consent for photos, they are deleted.

8. Your rights

In Profile → Privacy you can:

• download all your data, with your documents, in one ZIP file;
• ask for incorrect data to be corrected;
• delete your account: you have 14 days to change your mind, then we delete your data; payment records remain, no longer linked to you.

You can complain to the supervisory authority: [POTVRDITI: Personal Data Protection Agency of Bosnia and Herzegovina].

9. Contact

For questions about privacy, write to us: [POTVRDITI: privacy e-mail].