Privacy policy

Who is responsible for your data

Data controller: Anastasiia Matsola.

Email for data questions: privacy@drmatsola.com.

What the request form collects

• your name;
• a username or phone number to reach you;
• the messaging app you prefer;
• a description of your situation, if you write one (optional);
• your consent to the processing of your data.

Along with your request, the site automatically saves the time it was sent, the page language, the page version, the result of the bot check and, if you came from an ad, the ad campaign tags (UTM).

The description can contain health information, for example about your skin. I process it only on the basis of the explicit consent you give in the form, and only to contact you and book a consultation.

Please do not send skin photos or medical documents through the form. You will send them in our chat once we are in touch.

Why I use your data

Only to reply to you and arrange a consultation. I do not send newsletters, sell your data or share it with anyone except those named below. The legal basis for processing is the consent you give in the form.

Technical data needed to run and protect the site (your IP address, the bot check and the hashed IP address for the request limit) is processed on the basis of my legitimate interest in keeping the site secure and free of spam.

Who else sees the data

The site is hosted by Cloudflare (Cloudflare, Inc., USA). Cloudflare delivers the pages and processes technical data about your visit, such as your IP address and browser type, to run and protect the site. Form requests are stored in Cloudflare KV, Cloudflare’s data storage service. When you send a request, the site keeps your IP address in hashed form for 10 minutes so that nobody can send requests in bulk. Cloudflare’s privacy policy: cloudflare.com/privacypolicy.

When you scroll to the request form, Cloudflare Turnstile loads and checks that the visitor is a person and not a bot. For this it processes signals from your browser, such as your IP address, the User-Agent and a technical fingerprint of the TLS connection. Cloudflare processes these signals for this site and also on its own behalf to improve its bot detection. The check is usually invisible and only sometimes asks you to tick a box. About the data Turnstile processes: cloudflare.com/turnstile-privacy-policy.

Each request is also emailed to my Gmail inbox. The email is sent through Cloudflare Email Routing to Gmail, so Google (Google LLC, USA) processes the request too. Google’s privacy policy: policies.google.com/privacy.

The person who maintains the site and its Cloudflare account on my behalf gets a copy of every request email, has technical access to stored requests and keeps them confidential.

Cloudflare and Google process data in data centres in many countries, including the USA. Safeguards for the transfer: Cloudflare, Inc. and Google LLC are certified under the EU-U.S. Data Privacy Framework, and Cloudflare’s data processing agreement adds the EU Standard Contractual Clauses if that certification lapses.

If you message me on Telegram, Viber, WhatsApp or Instagram, that app’s own terms also apply.

Cookies and browser storage

This site does not set cookies itself. Cloudflare may set strictly necessary cookies to protect the site from bots. An unsent request is kept temporarily in your browser (sessionStorage) so it is not lost if you open another page, and the ad campaign tags are kept there so I know which ad brought your request. Both are removed when you close the tab, and the request also once it is sent.

How long data is kept

A request is deleted from the site’s storage automatically 12 months after you send it. I delete the emails about it from both inboxes, mine and the maintainer’s, no later than 12 months after our last contact, and sooner if you ask.

Your rights

• to find out what data I hold about you;
• to have it corrected;
• to have it deleted;
• to have its processing restricted;
• to receive your data in a common format (portability);
• to object to processing based on my legitimate interest;
• to withdraw your consent at any time;
• to lodge a complaint with the data protection authority in your country.

Withdrawing consent does not affect processing done before it. To use any of these rights, write to privacy@drmatsola.com.

How to ask for deletion

Write to privacy@drmatsola.com or message me on Instagram at @dr.anastasiia_matsola. I will delete your data within one month and let you know when it is done.