Privacy Policy

Version v0.1

1. Who we are

NaturClinica is operated by MGR Group UAB (Lithuania). For data-protection inquiries write to privacy@naturclinica.com.

2. What data we process

Account data (practitioner email + locale). Practice data (records the practitioner creates about their clients). Health data falls under GDPR Article 9 and is processed only with explicit consent captured in the platform.

3. Where data lives

All practitioner + client data is stored on Supabase EU (Frankfurt) and Vercel EU edge. We do not transfer data outside the EU.

4. Access (GDPR Art. 15)

Clients exercise data-subject rights through their treating practitioner, who can export the full client record on demand. Direct platform requests can be sent to privacy@naturclinica.com.

5. Erasure (GDPR Art. 17)

Records are soft-deleted with audit trail; physical deletion follows the practitioner's retention policy and legal-hold flags.

6. Retention

Default retention follows Romanian healthcare-records law; configurable per-practice within the limits set by applicable national rules.

7. Sub-processors (GDPR Art. 28)

Supabase (EU hosting + Auth), Vercel (EU edge), Stripe (billing), Resend (transactional email), Trigger.dev (background tasks). See the DPA at /legal/dpa for the current list.