Privacy policy

1. Who is responsible for your data

1.1. Your personal data is controlled by Gor Hovhannisyan, trading as Warm Hands massage studio ("we", "us").

1.2. Address: 6 Ordzhonikidze Street 1st Lane, Dilijan 3906, Tavush Province, Armenia. Email: hello@warm-hands.am. Phone, Telegram, WhatsApp: +374 93 581886.

1.3. We process personal data under the Law of the Republic of Armenia on Protection of Personal Data (HO-49-N of 18 May 2015).

2. What data we collect

2.1. Data you give us:

• your name;
• your phone number;
• your email address, if you give one;
• your Telegram and Instagram usernames, if you give them;
• your date of birth, if you give it.

2.2. Data created when you use our services:

• your visit history: which services, when, and any cancellations or changes;
• notes the therapist may write after a session. These can include how you were feeling and which areas were worked on. This is health information;
• records of your consent: which document and version you accepted, when, and from which IP address and browser.

2.3. Technical data: the cookies described in section 10.

2.4. We do not collect passport details, card details, or anything else we do not need to book and carry out your sessions.

3. Why we use your data and on what basis

3.1. We use your data to:

• book your sessions and manage the schedule;
• send reminders one day and one hour before a session;
• show your visit history in your account;
• take your wellbeing and past sessions into account during a massage;
• suggest services that may suit you;
• give you a birthday gift;
• send greetings and invitations, if you have agreed to them;
• prove that consent was given.

3.2. Our legal bases are:

• the service contract formed when you book. On this basis we use the data needed to book, remind you and carry out the session;
• the consent you give by accepting the terms of service when you book. It covers health information, recommendations, and transfers to service providers outside Armenia;
• your separate, optional consent to receive messages from the studio.

3.3. Your consent lasts while you use the studio's services, or until you withdraw it. Section 9 explains how to withdraw it.

4. Health information

4.1. Health information is a special category of personal data. We only process it with your consent.

4.2. This consent is part of the consent you give when booking. By giving it, you agree that the therapist may record notes about your wellbeing after a session.

4.3. Notes are not made after every session and are optional. You can ask the therapist not to keep notes, or to delete them.

4.4. Only the therapist can see the notes. They are not shown in your account and are not shared with anyone.

4.5. Health information is never added to Google Calendar and is never sent to the AI service in a form that could identify you.

5. AI-assisted recommendations

5.1. Service recommendations in your account may be prepared by an AI service, the Claude API from Anthropic (USA).

5.2. We send it only pseudonymised data: service codes, visit dates and short tags such as "back" or "neck". We never send your name, phone number, email or the text of the therapist's notes. Your name is replaced with a random ID that Anthropic cannot link to you.

5.3. A recommendation is only a suggestion. It does not affect your rights, prices or ability to book. You and the therapist decide what the session will be.

6. Who we share data with

6.1. We do not sell personal data or share it for other companies' advertising.

6.2. To run the website and bookings, we use the following providers. They process data on our behalf and only as far as needed for their service:

• Hetzner Online GmbH: hosting for the server, database and encrypted backups, in Germany or Finland;
• Google: Google Calendar for the schedule. A calendar event contains only the service name and your name. Your phone number and health information are not included;
• Telegram: messages, reminders and login codes sent through Telegram Gateway. Telegram receives your phone number and the message text;
• Resend: email delivery, if you have given an email address;
• Anthropic: recommendations based on pseudonymised data (section 5).

6.3. We may disclose data to public authorities where Armenian law expressly requires it.

7. Transfers outside Armenia

7.1. The providers in section 6 are based outside Armenia: in Germany, Finland, other EU countries and the USA. Telegram processes data on servers in several countries.

7.2. Armenia, Germany and Finland are all parties to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data. Our main data is stored on servers in these countries.

7.3. Data goes to countries where protection may be lower than in Armenia, such as the USA, on the basis of your consent and only as far as needed for the purposes in section 3. We keep these transfers to a minimum: Google receives your name and the service name, Telegram and Resend receive your contact details and the message text, and Anthropic receives only pseudonymised data.

8. How long we keep data

8.1. We keep your account data and visit history while you use the studio's services and for 3 years after your last visit. After that, the data is deleted or anonymised.

8.2. If you delete your account or withdraw consent, we delete or anonymise your data within 10 working days, unless the law requires us to keep it longer.

8.3. We keep consent records for as long as we process your data and for 3 years afterwards, as proof that consent was given.

8.4. Backups are kept for 14 days and then deleted automatically. Deleted data disappears from backups within that time.

8.5. Messages sent through Telegram, WhatsApp and Instagram are also stored by those services under their own rules.

9. Your rights

9.1. You have the right to:

• know what data we hold about you, why, where we got it and who we share it with;
• get a copy of your data;
• correct data that is inaccurate or out of date;
• ask us to delete or block data that is incomplete, inaccurate, out of date, unlawfully obtained or no longer needed;
• withdraw your consent, either fully or only for studio messages;
• delete your account;
• complain about us to the Personal Data Protection Agency or go to court.

9.2. You can do much of this yourself in your account: view your visit history, update your details, turn off studio messages and delete your account. When you delete your account, your contact details are erased and your visit history is anonymised. Consent records are kept for the period in clause 8.3.

9.3. For anything else, write to hello@warm-hands.am or message +374 93 581886 on Telegram. We may ask you to confirm that the request comes from you.

9.4. We reply to requests about your data within 5 days. We correct inaccurate data straight away, or within 3 working days if that is not possible. There is no charge.

9.5. If you withdraw consent to the data we need for bookings, we will no longer be able to take your bookings online.

10. Cookies

10.1. The website uses only essential cookies:

• a session cookie, so you stay signed in to your account;
• a language cookie, so the site opens in the language you chose.

10.2. We do not use analytics or advertising cookies. If that changes, we will update this policy and ask for your consent.

10.3. On your first visit, the site shows a cookie notice.

11. How we protect your data

11.1. The website uses a secure connection (HTTPS). Only the therapist and the site administrator can access the database and the therapist's notes.

11.2. Backups are encrypted.

11.3. Each service provider receives only the data it needs to do its job.

11.4. If a data breach occurs, we will publish a notice on the website and report it to the Police of the Republic of Armenia and the Personal Data Protection Agency, as the law requires.

12. Complaints

12.1. If you think we are not respecting your rights, please contact us first and we will try to put it right.

12.2. You can also complain to the Personal Data Protection Agency of the Ministry of Justice of the Republic of Armenia (moj.am) or go to court.

13. Changes to this policy

13.1. We may update this policy. Each new version is published on the website with a new date and version number.

13.2. If a change affects what data we collect, why, or who receives it, we will ask for your consent again the next time you book.

14. Contact

Gor Hovhannisyan, Warm Hands massage studio

Address: 6 Ordzhonikidze Street 1st Lane, Dilijan 3906, Tavush Province, Armenia

Email: hello@warm-hands.am

Phone, Telegram, WhatsApp: +374 93 581886