Who we are
Luomedica Oy ("Luomedica," "we," "us"), Business ID 2947040-1, based in Kuopio, Finland, operates luomedica.fi and provides metabolic-health consultations, hair tissue mineral analysis (HTMA), and related programs.
Contact for privacy matters: [email protected]
What we collect
New-client questionnaire. If you fill in our intake questionnaire (sent to you privately before a consultation), we collect:
- Contact and identity details: name, email, phone, date of birth, occupation, country, city, height, weight, sex, preferred consultation language, how you found us
- Health information (special category data under GDPR Article 9): your main health concerns, health history, medications and supplements, lab results, family history, what has and hasn't helped before, symptoms you select from a checklist, diet and lifestyle habits, and any additional notes you provide
This is the only place on our site where health data is collected.
Questionnaires and HTMA results. Submitted questionnaires and your HTMA lab results are retained in our Google Drive, part of the same Google Workspace account used for our mailbox.
Booking. Consultations and programs are booked and paid for through TidyCal, a third-party scheduling service, and Stripe for payment. That booking and payment data (name, email, payment details) is collected and processed directly by TidyCal and Stripe under their own privacy policies — it does not pass through or get stored on Luomedica's own systems.
Bot protection. The questionnaire's final step uses Cloudflare Turnstile to distinguish human visitors from automated bots. Turnstile may process technical signals from your browser/device as part of this check; it is provided by Cloudflare and does not identify you personally.
In-progress answers. While you're filling in the questionnaire, your answers are temporarily saved in your own browser (not sent to us) so you can resume if you close the tab. This local copy clears automatically after 30 days, or once you submit.
What we don't currently collect. The newsletter signup field in the site footer is not yet connected to anything — submitting it does not send your email anywhere. We don't run analytics or use tracking cookies on the site.
Why we process it, and on what legal basis
- Health data is processed only with your explicit consent, given by ticking the consent checkboxes before submitting the questionnaire (GDPR Art. 9(2)(a)). You can withdraw this consent at any time by contacting us; this doesn't affect the lawfulness of anything already done with your consent.
- Contact and identity data is processed to prepare for and deliver your consultation (Art. 6(1)(b), steps taken at your request prior to entering a service arrangement).
- Bot-protection signals are processed under our legitimate interest in keeping the questionnaire free of spam and automated abuse (Art. 6(1)(f)).
Who we share it with
We use the following processors to run our service. None of them are permitted to use your data for their own purposes.
| Processor | Role | Location |
|---|---|---|
| Resend | Delivers the questionnaire by email to Dr. Shatillo | United States |
| Google Workspace | Hosts the [email protected] mailbox questionnaire answers arrive in, and stores retained copies of submitted questionnaires and HTMA lab results in Google Drive (same Google Workspace account) | EU (Google Ireland) |
| Cloudflare | Hosts the website, runs the submission process, provides bot protection | Global network |
| TidyCal / Stripe | Booking and payment (handled entirely on their own systems, see above) | United States |
Where a processor is based outside the EU/EEA (Resend, TidyCal, Stripe), we rely on their standard contractual safeguards for the transfer.
We never sell your data, and we don't share it with anyone beyond what's needed to deliver your consultation.
How long we keep it
We keep your questionnaire answers for as long as needed for your consultation and any ongoing care, and until you ask us to delete them. You can request deletion at any time (see "Your rights" below).
Your rights
Under GDPR, you have the right to:
- Access the data we hold about you
- Correct inaccurate data
- Request deletion ("right to be forgotten")
- Restrict or object to processing
- Receive your data in a portable format
- Withdraw consent at any time (for health data specifically)
To exercise any of these, email [email protected]. You also have the right to lodge a complaint with Finland's data protection authority, the Office of the Data Protection Ombudsman (tietosuoja.fi).
Security
We use industry-standard measures (encrypted transmission, access-limited email delivery, spam/bot filtering) to protect your data in transit and at rest with our processors. No system is 100% secure, but we take reasonable steps appropriate to the sensitivity of health data.
Children
Our services are intended for adults. We don't knowingly collect data from minors.
Changes to this policy
We may update this policy as our practices evolve. Material changes will be reflected here with an updated date.