Privacy Policy

Maarwell is based in Portugal. This policy explains how we handle personal data in the Maarwell wellness marketplace and practice-management platform.

Data controller: Maarwell.

Privacy contact: support@maarwell.com. We have not appointed a Data Protection Officer: the GDPR (Art. 37) does not require one for what we do. The privacy contact handles all data-protection questions.

When a practitioner or studio keeps their own client notes, intake answers and records on Maarwell, they decide how that data is used and are responsible for it; Maarwell processes it for them.

What we collect depends on whether you use Maarwell as a member, guest, practitioner, studio, event attendee or someone contacting support.

• Account and contact details, profile photo, goals, interests and privacy settings.
• Bookings: name, email, notes for the practitioner, time, timezone, payment reference and status. Guest bookings can later be matched to an account with the same email.
• Phone number: when you book an event, a class or a studio service without an account, we ask for a phone number. Only the host or studio of that booking sees it, so they can reach you about it.
• Client lists: practitioners and studios may add or import your contact details. Importing alone sends no email.
• Practitioner profiles: services, prices, availability, approximate location, credentials, certificates and verification materials.
• Messages, reviews, intake forms, follow-up notes, journal entries, mood check-ins, reflections, nutrition and movement plans.
• Payment data: payment links, IBAN and account holder, MB WAY number, payment status, passes, subscriptions and shop orders.
• Technical data: essential cookies and operational booking, security and error records, which may include IP address and user-agent.
• Visit steps and source: whether a visit reached search, a profile, a chosen time and a booking, linked by a random code that lives only in that browser tab. No IP address, device details or account are stored with it. If you arrived through a campaign link or from another website, we keep the campaign tags (such as utm_source), the referring website's name and the first page you opened, and save them with your sign-up or booking. Other optional activity (quiz, sharing, embeds) stays paused.

Each use of your data needs a legal basis under the GDPR (Art. 6, and Art. 9 for health data). The table lists every purpose, the data involved, the basis we rely on and how long we keep it.

"Contract" means we need the data to give you the service you asked for. "Legitimate interest" means we have a balanced business reason you can object to (see §10). Where we rely on consent you can withdraw it at any time; this does not affect processing before the withdrawal.

Intake forms, health notes you send to a practitioner or studio (for example injuries, allergies, medication or pregnancy) and mood check-ins can reveal information about your health. This is special-category data under Art. 9 GDPR.

We only process it with your explicit consent (Art. 9(2)(a)), asked separately the first time you send an intake form, a health note or a mood check-in.

Health notes a practitioner or studio writes about you (for example on a client record) are their responsibility: the Practitioner Terms require them to get your explicit consent before recording them.

• Who sees it: you, and the practitioner or studio you shared it with. Maarwell staff only for support or safety, under access controls.
• It is never used for advertising and never sold.
• Withdraw consent at any time in Account › Privacy & security › Health information. We stop accepting new entries; what you already shared stays with the practitioner, marked as no longer consented, until you ask us to delete it.

Maarwell is not an emergency, medical or psychological service.

When personalisation is on, we use the goals, interests and kinds of support you chose in your profile to order recommendations and prompts. Search results are ranked by relevance, distance, availability and ratings, never by payment (see Terms › Ranking).

This is automated, but it never makes decisions with legal or similarly significant effects about you (Art. 22). You can switch personalisation off in Account › Privacy & security, and you can object at any time.

• Practitioners and studios see what they need to run your bookings, messages, intake, passes and payments.
• Clients see practitioners' public profiles, policies, payment instructions and session details.
• Maarwell staff access data for support, verification, safety, disputes and privacy requests, with access logged.
• Payment providers chosen by a practitioner (bank transfer, MB WAY, payment links) handle payment data under their own terms as independent controllers.

Service providers that process data for us

We do not use third-party analytics, advertising trackers or web fonts from third parties. Each provider is bound by a data-processing agreement (Art. 28). Stripe and Google also handle some data as independent controllers, for their own legal and fraud-prevention duties.

We keep our database in the EU (Ireland). Some providers are US companies and may access or process data in the US. When they do, we rely on:

• the EU-US Data Privacy Framework, for providers certified under it (adequacy decision of 10 July 2023); and
• the European Commission's Standard Contractual Clauses (2021/914) in each provider's DPA, with supplementary measures such as encryption in transit and at rest.

You can ask for a copy of the safeguards at the privacy contact.

We only use what the site needs to work. There are no analytics, advertising or tracking cookies, so we don't ask for cookie consent.

Cookies

Stored in your browser

Event pages show the address and a link to open it in Google Maps. No map loads on our pages, so no map provider sets cookies. You can clear all of the above in your browser settings; signing out removes the sign-in session.

We keep data for the periods in §3. In short:

• Account deletion: once we approve your request there is a 7-day grace period in which you can cancel. Then your personal data is erased. Booking, payment and order records the law requires us to keep stay, but no longer identify you. Reviews stay, shown as "Former client".
• Accounting records (invoices, payments, subscriptions): 10 years, as tax law requires.
• Short-lived records: an unpaid shop order is cancelled after 72 hours; an abandoned guest shop bag is deleted after 30 days; review invitations expire after 30 days; a practitioner's unsent session draft after 30 days.
• Security and usage logs: 90 days. Admin action logs: 2 years. Payment and refund history (who marked a booking paid, unpaid or refunded, and when): 10 years. Then they are deleted.
• Invitation objections are kept while invitations exist, so we never email you again.
• Inactive accounts are not deleted automatically. You can delete yours at any time.

You have these rights under the GDPR. We answer within one month (30 days) and verify that the request comes from you.

• See and copy your dataAccount › Privacy & security › Download my data. Guests: the form below.
• Correct itEdit your profile and settings, or ask us.
• Delete itAccount › Privacy & security › Request account deletion (7-day grace). Guests: the form below.
• Take it elsewhereThe export is a ZIP of machine-readable JSON files, with your attachments.
• Object or restrictEmail the privacy contact. Applies to anything we do on legitimate interest, including personalisation and invitations.
• Withdraw consentHealth information and marketing emails: switch them off in Privacy & security or use the unsubscribe link.
• ComplainComissão Nacional de Proteção de Dados (CNPD), cnpd.pt. You can also contact us first.

We use access controls, encryption in transit and at rest, row-level database policies and audit logs. No system is perfect; use a strong password and protect your device.

If we change this policy we publish the new version here with a new date. For material changes we also email account holders at least 30 days before they take effect.