Privacy Notice

Website: https://www.myrto.care

1. Who We Are

This Privacy Notice explains how Myrto Care (“we”, “us”, “our”) collects and processes your personal data when you use our website or services.

If you have any questions about this notice or your rights, please contact us using the details above.

2. What Data We Collect

We collect the following information depending on how you interact with us:

2.1 Data You Provide Directly

• Name
• Email address
• Phone number
• Address (if provided)
• Messages or enquiries you send us
• Information submitted via contact forms, appointment/booking forms, chat features, or account registration
• Newsletter signup details
• Uploaded files or documents
• Clinical data: This may include information relating to symptoms, health concerns, case descriptions, or other clinical information you voluntarily submit to us in enquiries or assessment tools.

Clinical data is treated as special category data under the GDPR and receives enhanced protection.

3. Data Collected Automatically

When you use the website, we may automatically collect:

• IP address
• Device and browser information
• Pages visited and behaviour on the site
• Time spent on each page
• Referrer information

This is done through Google Analytics, using cookies and similar technologies.

4. How We Use Your Data (Purposes & Legal Bases)

4.1 To respond to enquiries or bookings

Legal basis:

• Performance of a contract
• Legitimate interests (providing support and communication)

4.2 To process clinical information you voluntarily provide

Legal basis: explicit consent (GDPR Art. 9(2)(a)). You may withdraw consent at any time by contacting us.

4.3 To manage newsletters and marketing (Mailchimp)

Legal basis: consent. You can withdraw consent at any time by unsubscribing.

4.4 To provide account or user profile functionality

Legal basis: performance of a contract and legitimate interests.

4.5 To improve our website, security, and performance

Using analytics and system logs. Legal basis: legitimate interests.

4.6 To comply with legal obligations

Including tax, regulatory, safeguarding, or documentation requirements.

5. Special Category (Clinical) Data

Any clinical or health-related data you voluntarily provide is treated strictly confidentially and is only used for the specific purpose for which you submitted it.

This data is never used for marketing, never shared with third parties without your explicit consent, and is protected with enhanced safeguards.

6. Who We Share Your Data With

We may share your data with trusted service providers who help us operate the website or deliver our services:

• Lovable – website hosting and infrastructure
• Mailchimp – email marketing and newsletter delivery
• Google Analytics – website usage analytics
• Google Cloud – secure data storage
• IT and security providers
• Professional advisers (e.g., legal representatives) if required
• Regulatory or legal authorities where required by law

We never sell your data.

All providers are contractually required to process data securely and in compliance with UK GDPR.

7. International Data Transfers

You indicated that your services do not transfer personal data outside the UK/EEA.

Although Google Cloud and Mailchimp are global companies, you have configured your services so that data is stored within the UK/EEA.

If any transfer occurs in the future, we will ensure appropriate safeguards (e.g., standard contractual clauses) are in place.

8. Data Retention

We retain your personal data only for as long as necessary for the purposes described above. If you prefer GDPR-standard defaults, we apply the following:

• Contact form enquiries: up to 12 months
• Clinical information you submit: up to 7 years (health-related data is typically retained for safety, regulatory, and professional standards)
• Account information: until you delete your account or are inactive for 24 months
• Analytics data: 26 months (Google default)
• Newsletter subscribers: until you unsubscribe
• Website logs: up to 12 months

We securely delete or anonymise data when it is no longer needed.

9. Your Rights Under GDPR

You have the right to:

• Access your personal data
• Correct inaccurate or incomplete data
• Request deletion of your data (“right to be forgotten”)
• Object to processing
• Restrict processing in certain circumstances
• Withdraw consent at any time (especially for marketing or clinical data)
• Data portability, where applicable

To exercise any of these rights, contact us at: info@myrto.care.

10. Security Measures

We take the protection of your data seriously. Measures include:

• SSL encrypted website
• Access controls and authentication
• Encrypted storage of clinical information
• Secure hosting environment via Lovable & Google Cloud
• Limited access to data on a need-to-know basis
• Regular monitoring and security updates

However, no system is completely secure, and we cannot guarantee absolute security.

11. Cookies and Tracking Technologies

We use cookies on our site for:

• Website functionality
• Analytics (Google Analytics)
• Performance monitoring
• Security & session management

You can control or disable cookies through your browser settings.

By continuing to use the site, you consent to the use of cookies as described in this notice.

12. Changes to This Privacy Notice

We may update this notice from time to time. Updates will be posted on this page with a new “Last Updated” date. Significant changes may be communicated directly if required.

13. Complaints

If you have concerns about how we handle your data, please contact us first.

If you are not satisfied, you may lodge a complaint with: