Privacy policy

01Who is responsible for your data

The data controller is xKinesi Movement Science Magdalena Wybraniec, based in Gdańsk, Poland. For anything related to your data, write to hello@xkinesi.com.

02What I collect and why

The form before our first call

Your name, email, city, a description of what is going on with your health and wellbeing, your goals, what you have tried before, your history of injuries and surgeries and (if you choose) how you heard about me. These answers let me come to the call prepared and judge whether and how I can help.

Legal basis: your consent (Art. 6(1)(a) GDPR) and your explicit consent to the processing of health data (Art. 9(2)(a) GDPR), which you give in the form.

Booking a call

Your name, email and the time you choose. I need them to schedule the call and send you a confirmation with a Google Meet link and a reminder.

Legal basis: steps taken at your request before a possible contract (Art. 6(1)(b) GDPR).

Call recordings

I may record our call, but only if you agree. I will ask at the start, and saying no changes nothing. I record with a Plaud voice recorder, which encrypts recordings. The recording becomes a transcript and a note, so I don’t miss anything.

Legal basis: your consent (Art. 6(1)(a) GDPR) and your explicit consent to the processing of health data (Art. 9(2)(a) GDPR).

Analysis with AI tools

I may analyse your form answers and call notes with the help of AI tools. Before I do, I replace your details with a pseudonym: the tool doesn’t receive your name or email address. AI helps me organise information, but the conclusions and decisions are always mine.

Legal basis: the same consent as for the form or the recording (Art. 6(1)(a) and Art. 9(2)(a) GDPR).

Working together

If we start working together (screening, coaching, 1:1 sessions), I will also process test results, data from your watch or apps and notes from our sessions. We agree the scope when we start, and you give separate consent for health data at that point. I keep invoicing data because tax law requires it.

Legal basis: contract (Art. 6(1)(b)), explicit consent for health data (Art. 9(2)(a)), legal obligation for invoices (Art. 6(1)(c) GDPR).

Email

When you email me, I process your address and the content of your message to reply and keep a record of what we agreed.

Legal basis: my legitimate interest in handling correspondence (Art. 6(1)(f) GDPR).

Newsletter

Your email address and, in the emails I send, whether they were opened and which links were clicked, so I know which topics interest you. You can unsubscribe with one click in the footer of every email.

Legal basis: your consent (Art. 6(1)(a) GDPR).

The site itself

This site sets no cookies and has no visitor statistics or advertising pixels. The server it runs on (Cloudflare) automatically logs technical data such as your IP address and browser type to protect the site from attacks. Fonts load from Google’s servers, so Google sees your IP address.

Legal basis: legitimate interest in the security and operation of the site (Art. 6(1)(f) GDPR).

03Who has access

I have access to your data. I use a few services that store or transmit data on my behalf and only on my instructions:

• Tallythe form before our callTally BV, Belgium · data in the EU
• Cal.combooking (name, email, time)Cal.com, Inc., USA
• Googleemail, Calendar, Google MeetGoogle Ireland Ltd, Ireland
• Plaudcall recordings and transcripts (with your consent)Plaud Inc., USA · encrypted recordings
• AI toolsanalysis of answers and notes under a pseudonymClaude (Anthropic, USA), Gemini (Google)
• MailerLitenewsletter deliveryUAB MailerLite, Lithuania · EU
• Cloudflaresite hosting and email forwardingCloudflare, Inc., USA

If you choose an xKinesi package, where a team of specialists works with you, I will share your data with them only after you consent, and only as much as they need.

04Transfers outside the EU

Cal.com, Cloudflare, Plaud and Anthropic are US companies, and Google may also process data outside the EU. These transfers rely on a European Commission decision (the EU-US Data Privacy Framework) or on standard contractual clauses approved by the Commission. That is exactly why Cal.com only receives your name, email and booking time, AI tools only receive pseudonymised data, and the form with your answers stays in Tally in the EU.

05How long I keep data

• Form, booking and call recording, if we don’t start working together: up to 12 months after the call (in case you want to come back), or deleted straight away if you ask.
• Data from working together: for as long as we work together, then until any possible claims become time-barred.
• Invoices: 5 years from the end of the year they were issued (tax law).
• Newsletter: until you unsubscribe.
• Email: for as long as it is needed for what we agreed.

If you withdraw consent, I delete the data that relied on it, unless I have to keep it for another reason (such as invoices).

06Your rights

You have the right to:

• access your data and get a copy,
• have it corrected,
• have it deleted (the “right to be forgotten”),
• restrict its processing,
• data portability,
• object to processing based on legitimate interest,
• withdraw consent at any time (this does not affect the lawfulness of what happened before).

Just email hello@xkinesi.com. If you believe I process your data unlawfully, you can lodge a complaint with the Polish data protection authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or with the authority in your own EU country.

07Other

Providing your data is voluntary. Without the form and an email address you can’t book a call through the site, but you can always simply write to me.

I don’t make automated decisions about you and I don’t profile you. AI tools only help me; the decisions are mine.

If anything in this policy changes, I will update the date at the top of the page.