Effective date: 23 April 2026 · Version: v1-2026-04-23
1. Who processes your data
ĀSHA Wellness, operated by Viltė Sabalienė (MB Emocingi aplodismentai, Lithuania), is the data controller for all personal information collected through this website and the intake process. For GDPR questions contact [email protected].
2. What data we collect
- Health questionnaire: your answers to the 26-question intake (age, weight, medical history, medications, digestion, sleep, energy, stress, emotional state, etc.).
- Health records you upload: lab results (PDF / image), biomarker values parsed from those documents, and any additional records you share during the program.
- Call and WhatsApp transcripts: when we record a consultation with your recording consent, the audio is transcribed and the summary is stored in your profile.
- Contact information: name, WhatsApp number, optional email, social handle.
- Technical data: IP address, user-agent, language, at the moment you submit intake and consent forms, used only for the legal audit trail, never for marketing.
3. Legal basis
The health information we process falls under GDPR Article 9 (2)(a) , special category data processed based on your explicit consent. You give that consent by checking the box on the intake form. Non-health contact data (name, WhatsApp) is processed under Article 6 (1)(b): performance of a contract.
This processing is for wellness consultation purposes. It is not medical diagnosis or treatment. We do not replace a doctor; for medical conditions we recommend a licensed physician.
4. Who sees your data
- Viltė Sabalienė, your consultant, the only human who sees your full profile.
- Our self-hosted server (Hetzner, Germany): the database and file storage live here, operated by us. No third-party cloud has a copy of the database.
- Wasabi Cloud Storage (EU region, Amsterdam): encrypted storage for uploaded files only; files are stored in a private bucket with random-hashed keys and served via short-lived presigned URLs.
- Groq Inc. (USA): transcription of consultation audio only. Audio is sent to Groq for speech-to-text and immediately discarded; Groq does not retain content. Used under Standard Contractual Clauses.
5. How long we keep your data
Active program duration + 5 years, unless you ask for earlier erasure. After 5 years of inactivity we soft-delete and then hard-delete. Consent logs and the GDPR audit trail are kept 5 years for legal defensibility even after you are deleted (without your content, just the fact that consent existed).
6. Your rights
- Access: get a copy of everything we store about you (Art. 15).
- Rectification: correct inaccurate data (Art. 16).
- Erasure: delete all your data (Art. 17).
- Portability: receive your data in JSON format (Art. 20).
- Withdraw consent at any time (Art. 7 (3)). Withdrawal does not affect prior lawful processing.
- Complaint: lodge a complaint with the Lithuanian State Data Protection Inspectorate (vdai.lrv.lt).
To exercise any of these, email Viltė at [email protected]. Response within 30 days.
7. Security
- TLS 1.2+ for all traffic.
- Database on private network only; no public Postgres port.
- Files in a separate Wasabi private bucket with unguessable key prefixes.
- Hourly encrypted backups to Wasabi with a separate key set.
- Row-level security: only admin authentication can read your profile.
8. Cookies
We only use functional cookies needed for authentication and language preference. No analytics, no advertising, no cross-site trackers.
9. Changes
When the policy changes materially we bump the version string and keep the previous version available on request. If the change expands processing, we ask you to consent again.