Privacy Policy
1. Controller and contact
This policy covers revito.lv visitors, patients and customers. Controller: SIA REVITO, registration No. 40203630876, registered address: Gramzdas iela 80-18, Rīga, Latvia. Contact us about your data at revitopasts@gmail.com, +371 29548315 or by post to the registered address.
2. Patient information we store
Patient information is stored in the REVITO information system database after a booking is made. Depending on the service, we store your full name, phone number, email, customer profile, phone verification records and a password hash if you set a password.
We also store booking and visit history: specialist, service, date, time, location, status, cancellations and internal staff notes; pass validity and use; course orders, access and delivery address; payment amounts, statuses and identifiers; and notification delivery statuses. Login security records include IP addresses, attempt times and counts, and hashes of verification codes and session tokens.
3. Data sources and health information
Data come from you or your representative, specialists and administrators, and payment and messaging providers reporting transaction or delivery status. The use of a healthcare service, symptoms or health information in notes may constitute special category personal data; we process these only to the extent necessary. Detailed diagnoses or medical documents are not required for online booking. When booking for a child or another person, provide only necessary data and ensure you are authorised to represent them.
4. Purposes and legal bases
Bookings, profiles, services, passes, courses, delivery and related communications rely on performing a contract or taking steps before entering into one (GDPR Article 6(1)(b)). Accounting and statutory duties rely on legal obligations (Article 6(1)(c)). Access protection, prevention of misuse and defence of legal claims rely on legitimate interests in security and protecting rights (Article 6(1)(f)), taking your rights into account.
Health data also require an Article 9 basis. Healthcare processing relies on Article 9(2)(h) where performed by, or under the responsibility of, a healthcare professional subject to Article 9(3) confidentiality requirements. Otherwise, separate explicit consent or another applicable Article 9 exception is required before processing. Reading this policy or booking does not itself constitute such consent. Advertising based on consent requires a separate consent request.
5. Recipients and external services
Authorised REVITO administrators and relevant specialists access data for their duties. Necessary data may be received by hosting, IT support, accounting and requested delivery services. Telnyx processes phone numbers and SMS content, including booking notices to patients or specialists. For online payments, Stripe processes payments, email if provided, and transaction information including service descriptions. Full card numbers and CVC are not stored in the REVITO database. Data may be disclosed to authorities when required by law.
The site loads Google Fonts and course videos using YouTube privacy-enhanced mode; this can disclose your IP address and browser technical information to Google. External links, such as WhatsApp or Google Maps, are subject to those services’ privacy terms.
6. Transfers outside the EEA
International services may process data outside the European Economic Area. Transfers require a GDPR Chapter V basis: an applicable European Commission adequacy decision or standard contractual clauses with additional safeguards where necessary. You can request details of specific recipients, countries and applicable safeguards, and a copy of those safeguards, from the controller.
7. Retention
Retention depends on purpose: profiles and visit history support customer services; course and pass records support the respective entitlements; transaction and accounting records follow statutory periods; dispute records follow claim resolution and applicable limitation periods. Medical records, if maintained, follow the period for the particular document under Latvian Cabinet Regulation No. 265. You can request the specific period or its determining criteria. Data without a continuing lawful retention basis must be deleted or anonymised; statutory duties can limit deletion.
SMS codes last 10 minutes; code records older than one day and expired sessions are deleted on the next code request. Login attempts older than one day are deleted on the next password login check. Client sessions last up to 90 days. These technical periods do not mean that profiles or visit history are deleted.
8. Cookies
revito_lang stores your language for up to one year; revito_client_session contains a random token rather than your phone number and supports your requested account session for up to 90 days; the PHP session cookie supports the site session. Signing out removes the client access cookie. You can delete or block cookies in your browser, although this may limit account functionality. Any introduction of analytics or advertising cookies requires separate prior consent and a way to withdraw it.
9. Your rights
In your account, type delete to remove your profile, contacts, reviews, appointments, passes and orders from the website’s active database. Access and future appointments are cancelled, and all sessions end. Past appointments are hidden from the patient information card; their details are automatically deleted seven days after the visit ends. Contacts and aggregate used pass counts remain until the account is deleted. This does not cover separate medical/accounting documents, provider records or protected backups; ask REVITO about erasure or the retention basis for those records.
Where GDPR provides, you may access and obtain a copy of your data, correct inaccuracies, request deletion or restriction, receive data in a portable format and object to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing. Erasure is not absolute: records subject to mandatory retention may be kept. We may request proportionate identity verification before disclosing data.
We respond without undue delay, normally within one month of receiving a request. Complex requests may take up to two additional months, with reasons provided within the first month. You may complain to Latvia’s Datu valsts inspekcija (www.dvi.gov.lv) or another competent EU supervisory authority.
10. Required data, protection and changes
Required form fields are needed for the service; without them we may be unable to confirm a booking, provide access or arrange delivery. Additional data are voluntary unless required for your selected service. The booking and account system does not use solely automated decisions or profiling producing legal or similarly significant effects.
Access uses phone verification or a password and a session token; passwords and verification codes are stored as hashes. Staff access is restricted by roles. Do not share codes or passwords, and sign out on shared devices. Policy changes are published here with an updated date; any new purpose requiring consent will have a separate request.
Reviews and Google Maps
Website reviews publish immediately after automatic text validation and profanity replacement; your first name and surname initial are public. Posting on Google is voluntary and takes place in your Google account. This website does not automatically send your review or account details to Google.
When Google reviews are enabled, public data are loaded through the Google API and author images from Google servers. Loading these images sends Google your IP address and browser request information. Google reviews are not stored in our review database. Google Privacy Policy.
revitopasts@gmail.com · +371 29548315 · Latvian Data State Inspectorate