Who we are
Luomedica Oy ("Luomedica," "we," "us"), Business ID 2947040-1, based in Kuopio, Finland, operates luomedica.fi and provides metabolic-health consultations, hair tissue mineral analysis (HTMA), and related programs.
Contact for privacy matters: [email protected]
What we collect
New-client questionnaire. If you fill in our intake questionnaire (sent to you privately before a consultation), we collect:
- Contact and identity details: name, email, phone, date of birth, occupation, country, city, height, weight, sex, preferred consultation language, how you found us
- Health information (special category data under GDPR Article 9): your main health concerns, health history, medications and supplements, lab results, family history, what has and hasn't helped before, symptoms you select from a checklist, diet and lifestyle habits, and any additional notes you provide
This is the only place on our site where health data is collected.
Questionnaires and HTMA results. Submitted questionnaires and your HTMA lab results are retained in our Google Drive, part of the same Google Workspace account used for our mailbox.
Booking. Consultations and programs are booked and paid for through TidyCal, a third-party scheduling service, and Stripe for payment. When you book or pay through TidyCal, that booking and payment data (name, email, payment details) is collected and processed directly by TidyCal and Stripe under their own privacy policies — it does not pass through or get stored on Luomedica's own systems.
Bot protection. The questionnaire's final step uses Cloudflare Turnstile to distinguish human visitors from automated bots. Turnstile may process technical signals from your browser/device as part of this check; it is provided by Cloudflare and does not identify you personally.
In-progress answers. While you're filling in the questionnaire, your answers are temporarily saved in your own browser (not sent to us) so you can resume if you close the tab. This local copy clears automatically after 30 days, or once you submit.
What we don't currently collect. The newsletter signup field in the site footer is not yet connected to anything — submitting it does not send your email anywhere. We don't run analytics or use tracking cookies on the site.
Gift cards
When you buy a gift card, we store the names and the personal message you choose to show on the card, your email address (to send you the gift link and receipt), and the payment reference from Stripe.
When a gift is redeemed, we store the recipient's name, email address, preferred language and, if given, phone number, so we can send the next steps and deliver the service. We also tell the buyer that the gift was redeemed, without any details about the recipient's health.
We automatically delete the names, the message, the email addresses and the phone number from our gift records 30 days after a gift is redeemed, expires or is refunded. The names and message are also saved with the payment record at Stripe, which keeps payment records under its own retention rules; we can ask Stripe to remove them on request. Copies of the related emails may remain in our mailbox until you ask us to delete them. We keep the payment record itself (gift code, service, amount and dates) for as long as Finnish bookkeeping law requires.
Why we process it, and on what legal basis
- Health data is processed only with your explicit consent, given by ticking the consent checkboxes before submitting the questionnaire (GDPR Art. 9(2)(a)). You can withdraw this consent at any time by contacting us; this doesn't affect the lawfulness of anything already done with your consent.
- Contact and identity data is processed to prepare for and deliver your consultation (Art. 6(1)(b), steps taken at your request prior to entering a service arrangement).
- Bot-protection signals are processed under our legitimate interest in keeping the questionnaire free of spam and automated abuse (Art. 6(1)(f)).
Who we share it with
We use the following processors to run our service. None of them are permitted to use your data for their own purposes.
| Processor | Role | Location |
|---|---|---|
| Resend | Delivers the questionnaire by email to Dr. Shatillo, and sends gift card emails | United States |
| Google Workspace | Hosts the [email protected] mailbox questionnaire answers arrive in, and stores retained copies of submitted questionnaires and HTMA lab results in Google Drive (same Google Workspace account) | EU (Google Ireland) |
| Cloudflare | Hosts the website, runs the submission process, stores gift card records (Cloudflare D1), provides bot protection | Global network |
| Stripe | Processes gift card payments on its own hosted checkout page | EU (Stripe Payments Europe, Ireland); also processed by Stripe, Inc. in the United States |
| TidyCal | Booking (handled entirely on their own systems, see above) | United States |
Where a processor is based outside the EU/EEA (Resend, TidyCal, Stripe), we rely on their standard contractual safeguards for the transfer.
We never sell your data, and we don't share it with anyone beyond what's needed to deliver your consultation.
How long we keep it
We keep your questionnaire answers for as long as needed for your consultation and any ongoing care, and until you ask us to delete them. You can request deletion at any time (see "Your rights" below).
Your rights
Under GDPR, you have the right to:
- Access the data we hold about you
- Correct inaccurate data
- Request deletion ("right to be forgotten")
- Restrict or object to processing
- Receive your data in a portable format
- Withdraw consent at any time (for health data specifically)
To exercise any of these, email [email protected]. You also have the right to lodge a complaint with Finland's data protection authority, the Office of the Data Protection Ombudsman (tietosuoja.fi).
Security
We use industry-standard measures (encrypted transmission, access-limited email delivery, spam/bot filtering) to protect your data in transit and at rest with our processors. No system is 100% secure, but we take reasonable steps appropriate to the sensitivity of health data.
Children
Our services are intended for adults. We don't knowingly collect data from minors.
Changes to this policy
We may update this policy as our practices evolve. Material changes will be reflected here with an updated date.