2.1. Who this notice is for
This notice is for people who are cared for by a physiotherapist, massage therapist, doctor, sports coach or other specialist who uses Kusties (your "specialist"), and for parents and guardians (a child's legal representatives) who fill in forms on a child's behalf. It explains how your data is processed when you:
- open an exercise programme that your specialist sent you through a personal link;
- save a workout and your feedback on it;
- fill in a form before a visit;
- receive an e-mail or SMS about a visit or a form;
- use the client cabinet, once it is switched on (client cabinet terms: https://kusties.com/en/cabinet-terms).
Kusties is an online tool for specialists. Specialists' use of it is governed by the Terms of Service (https://kusties.com/en/terms) and the Privacy Policy (https://kusties.com/en/privacy).
2.2. Who is responsible for your data
- Your specialist is the controller. Your specialist decides what data about you to collect and how to use it: creates your record, writes notes and documents, prepares programmes, books visits and sends reminders and forms. The specialist's name is shown on the programme and form pages, in e-mails and in SMS.
- Kusties is the processor. SIA "Kusties.com" provides the app and processes this data on your specialist's behalf under a data processing agreement (GDPR Article 28). Kusties does not sell your data and does not use it for advertising or analytics.
- When Kusties is the controller. Kusties processes in its own name:
- your IP address, briefly, to protect the service from abuse (point 2.4);
- your client cabinet account, if you create one (point 13 of the client cabinet terms).
2.3. What data is processed
| When | What data | Who enters it |
|---|---|---|
| Your specialist cares for you | First and last name, e-mail address, phone number, contact language, date of birth (if given). The specialist's notes. Clinical documents (for example an examination, a visit note, a discharge summary), which may contain your personal code, address, family doctor, occupation, findings, diagnoses and plans. Safety alerts (for example about a pacemaker). Programmes and the specialist's private note on a programme. Visits: time, type, status, title and description. | the specialist |
| You open a programme link | The day the programme was last opened. Your browser sends your IP address and a description of your browser and device (user agent); they are received by the hosting provider and by Cloudflare, which plays the videos and shows the images. | your browser |
| You save a workout | Time, duration, the exercises done, feedback on difficulty and length, and any notes you write. Your IP address is used briefly (up to one hour) to limit the number of requests; it is not stored with the workout. | you |
| You fill in a form | Your answers (they may be health data), the name you type to confirm, the confirmation tick and the time of submission. In the parent or guardian form, also the parent's or guardian's name, personal code, status, phone, e-mail and address, and a contact person. Unsent answers are kept in your browser until the link expires. When you submit the form, your specialist receives an e-mail that contains your first name. | you |
| You receive an e-mail or SMS | E-mail address or phone number, message content, language, purpose, time sent and status. Kusties keeps this in a message log; one-time links are not stored in the log. Appointment e-mails may contain the visit title and description as the specialist typed them, and a calendar file with your name may be attached to them. SMS contain no visit title, no name of yours and no health data. | the specialist, the system |
| You use the client cabinet (once it is switched on) | See point 13 of the client cabinet terms. | you |
2.4. Purposes and legal basis
- Your specialist processes the data to care for you: to prepare programmes, follow your progress, plan visits, remind you of them and receive your answers before a visit. The legal basis is the specialist's to determine. Usually it is the provision of health care (GDPR Article 9(2)(h)) or your explicit consent (GDPR Article 9(2)(a)).
- Kusties processes this data on your specialist's behalf (GDPR Article 28) to show programmes, store workouts and forms, send messages and keep the service running and secure.
- Kusties in its own name uses your IP address briefly to limit excessive requests and protect the service from abuse. The basis is Kusties' legitimate interests (GDPR Article 6(1)(f)).
2.5. Who receives the data
- Your specialist. Each specialist has their own record about you. Other specialists do not see your data, and Kusties does not merge records.
- Kusties administrators. In the app, administrators can open specialists' client records (contact details), programmes, the workouts and feedback you saved, visits and the log of messages sent to patients, including message content. The specialist's notes, clinical documents, safety alerts and the programme's private note are visible in the app only to the specialist who created them. Persons with access to Kusties' infrastructure (the database, backups and the encryption key) are technically able to access all data.
- Sub-processors that Kusties uses:
| Recipient | Purpose | What it receives | Where |
|---|---|---|---|
| DigitalOcean | hosting the app and the database | all app data | Frankfurt, Germany (EU); company registered in the USA |
| Redis Cloud | short-lived security data | IP address in request counters and sign-in data; no health data | Frankfurt, Germany (EU) |
| Brevo | sending SMS; sending e-mail | e-mail address, phone number, message content | EU (France) |
| Cloudflare | showing videos and images | IP address and browser and device description when a page loads videos and images | global network; company registered in the USA |
- Message carriers: your e-mail provider and your mobile operator.
- Public authorities, where the law requires it.
2.6. Transfers outside the EEA
The database that holds your data is in the EU (Frankfurt). DigitalOcean and Cloudflare are US companies, and Cloudflare runs a global network. Where data is transferred outside the European Economic Area, this is based on a European Commission adequacy decision (GDPR Article 45) or on standard data protection clauses (GDPR Article 46(2)(c)).
2.7. How long data is kept
| Data | Retention |
|---|---|
| The specialist's record, notes, clinical documents, programmes, workouts, visits | As long as the specialist keeps them under the specialist's own professional and legal obligations. At present, a record deleted in the app is hidden rather than permanently deleted, and finalised clinical documents cannot be deleted. |
| Safety alerts | Until the specialist deletes them (they are then permanently deleted). |
| Form link | Valid for 14 days. |
| Unsent answers in your browser | Until you submit or until the link expires. |
| Message log (recipient and content) | At present with no end date; after the specialist's agreement ends, it is deleted under the data processing agreement. |
| IP address in request counters | From one minute to 24 hours (depending on the limit). |
| The hosting provider's technical logs | Under the hosting provider's retention policy. The app's own logs contain no IP addresses. |
| Client cabinet account | See point 13 of the client cabinet terms. |
2.8. How data is protected
- The database is in the EU.
- The specialist's notes, clinical documents, safety alerts and the programme's private note are encrypted with a separate encryption key (AES-256-GCM). Other data, such as contact details, visits, workout feedback and the message log, is not separately encrypted.
- A programme link contains two random identifiers. A form link is single-use and valid for 14 days, and the server stores only its hash.
- The app's logs do not record IP addresses, e-mail addresses, phone numbers, links or message content.
- Access is limited by role. Two-step sign-in is mandatory for Kusties administrators.
What you can do:
- don't forward a programme or form link to others;
- on a shared computer, don't leave a form unsubmitted;
- if a link has reached someone else, contact your specialist: the specialist can finish the programme (new workouts can then no longer be saved, but the programme and its videos can still be seen through the link), ask Kusties to disable the programme so that it no longer opens through the link, and send a new form link.
2.9. Cookies and browser storage
Patient pages use no analytics or advertising cookies, and no analytics tools are loaded on these pages.
| Name | Type | Purpose | How long |
|---|---|---|---|
locale | cookie | interface language | 1 year |
theme, workout-theme, videos-paused | browser storage | the look you chose and video playback | until you clear your browser data |
kusties-form-draft:<…> | browser storage | a form's unsent answers, so they are not lost if the page reloads | until you submit or the link expires |
| Cloudflare video player | third-party embedded page | playing videos | under Cloudflare's terms |
The Android app stores only the player's colour theme on the device.
2.10. Minors
- A specialist may also care for children. A child's forms are usually filled in by a parent or guardian, and the parent or guardian consent form also collects the parent's or guardian's own data (point 2.3).
- A child's data rights are usually exercised by the parent or guardian.
- The client cabinet is not available to children: it can be used only from the age of 18 (point 4 of the client cabinet terms).
2.11. Automated decisions
No decisions are made about you based solely on automated processing that have legal or similarly significant effects on you (GDPR Article 22), and no profiling takes place. Only technical steps happen automatically:
- a programme ends automatically on the day after the end date set by the specialist;
- too many requests from one IP address are limited for a short time;
- a cabinet invitation is withdrawn after five wrong birth-year entries (once the cabinet is switched on).
2.12. Your rights
Under the GDPR you have the right to:
- access your data and get a copy (Article 15);
- have inaccurate data corrected (Article 16);
- ask for your data to be erased (Article 17) where the controller has no duty to keep it;
- restrict processing (Article 18);
- receive the data you provided in a machine-readable format and transfer it to another controller (Article 20);
- object to processing based on legitimate interests (Article 21);
- withdraw consent at any time where processing is based on consent (Article 7(3)). Withdrawal does not affect the lawfulness of processing before it.
Patients also have the rights set out in the Pacientu tiesību likums (Patients' Rights Law).
How to use your rights:
- Contact your specialist. The specialist is the controller and answers your request. The controller must answer within one month; in certain cases this period can be extended (GDPR Article 12(3)).
- If you write to Kusties at [email protected], we will forward your request to your specialist without undue delay and help them answer it (GDPR Article 28(3)(e)). To protect your data, we may ask you to confirm your identity.
- Patients cannot currently download their own data themselves; the specialist prepares the copy.
- The app has no permanent deletion function at present; on the specialist's instruction, Kusties deletes the data manually.
Complaints. If you believe your data is processed unlawfully, you can complain to the Datu valsts inspekcija (Data State Inspectorate, www.dvi.gov.lv) or to the supervisory authority of the EU member state where you live or work (GDPR Article 77).
2.13. Changes and contacts
- We may update this notice, for example when the app's features or the law change. Each version has a number and a date. The current version is always on this page.
- For questions about your care and the data your specialist keeps, contact your specialist.
- Kusties: SIA "Kusties.com", registration No. 50203259371, legal address: Ābolu iela 14C, Mārupe, Mārupes nov., LV-2167, e-mail: [email protected].