Back to home
Legal information

Privacy policy

What data is handled, what for, for how long, and what you can do about it.

Draft pending completion and legal review. The highlighted gaps are details only the site owner can supply. This notice, and the box around it, must be deleted before the document is considered published.

1. Who handles your data

Depending on which entity invoices you, the data controller is one of the two below. You are told which one before booking.

This website is run by two owners, depending on which one issues the invoice. You are told which one provides the service before you book, and that entity is the one answerable for that relationship and the one acting as data controller.

Spanish entity

Owner
[FULL NAME]
Tax ID (NIF)
[NIF]
Address
[BUSINESS ADDRESS IN SPAIN]
Email
[EMAIL ADDRESS]
Activity
Online nutrition guidance and coaching

Swiss entity

Owner
[NAME OR COMPANY NAME]
UID / IDE no.
[CHE-000.000.000]
Address
[BUSINESS ADDRESS IN SWITZERLAND]
Email
[EMAIL ADDRESS]
Activity
Online nutrition guidance and coaching
Phone
+41 78 229 52 48
Website
https://enaya.es
Trading name
Enaya Salud Integral

Each entity is answerable for its own clients' data. Data is not passed from one to the other unless it is essential in order to look after you, and you are told beforehand.

For anything concerning your data, write to [EMAIL ADDRESS] or call +41 78 229 52 48.

2. What data is handled

  • Identity and contact: name, phone number, email address.
  • Billing: what is needed to issue the invoice and meet tax obligations.
  • Health data: weight, body measurements, body composition, eating habits, physical activity, medical history, conditions, allergies and intolerances, medication, supplementation, digestion, menstrual cycle, sleep, blood tests and progress photographs, if you choose to share them.
  • Conversation: the messages we exchange during the coaching.

You provide the data yourself, through the initial questionnaire, the video call and the follow-up. None of it is obtained from third parties.

Health data is a special category (Art. 9 GDPR), so it is handled only with your explicit consent, collected separately before starting, which you may withdraw at any time.

3. Why it is handled, and on what legal basis

Answering your enquiry
PurposeReplying to what you ask on WhatsApp or by email before booking, and helping you work out which service fits.
Legal basisYour consent and pre-contractual steps taken at your request (Art. 6(1)(a) and 6(1)(b) GDPR).
Providing the nutrition service
PurposeAssessing your starting point, drawing up the plan, reviewing it and supporting you through the process.
Legal basisPerformance of the contract (Art. 6(1)(b) GDPR) and, for health data, your explicit consent (Art. 9(2)(a) GDPR).
Invoicing and tax obligations
PurposeIssuing invoices and keeping them for as long as the law requires.
Legal basisCompliance with a legal obligation (Art. 6(1)(c) GDPR).
Publishing your review
PurposeShowing your testimonial on the site, under the name or initials you choose.
Legal basisYour consent, asked for separately and withdrawable at any time (Art. 6(1)(a) GDPR).

No automated decisions are taken and no profiling with legal effects on you is carried out. No marketing messages are sent unless you ask for them.

4. How long it is kept

  • Enquiries that do not lead to a booking: up to one year from the last message.
  • Coaching data, including health data: for as long as the relationship lasts and, afterwards, blocked for the limitation periods of any possible liabilities. If you withdraw consent, it stops being used immediately, except where the law requires it to be kept.
  • Invoices and accounting records: the periods set by the tax and commercial rules applying to each entity.
  • Published reviews: until you withdraw consent.

5. Who it is shared with

Your data is never sold or shared with third parties for commercial purposes. Only the providers needed to deliver the service have access, acting either as processors or as controllers of their own service:

  • Vercel Inc. — hosting for this website. It handles technical connection data (IP address, browser) in order to serve the pages and for security.
  • WhatsApp / Meta Platforms Ireland Ltd. — the communication channel. Messages travel end-to-end encrypted, so Meta cannot read their content, but it does handle metadata: phone numbers, times and frequency of messages. See their privacy policy.
  • [NAME OF THE ACCOUNTANCY FIRM] — tax and accounting advisers, for invoicing.
  • Public authorities, where there is a legal obligation.

On WhatsApp and health data: it is a convenient channel, but it is not a clinical tool. Share only what you are comfortable sharing there; if you would rather use another route for the more sensitive information, say so and an alternative will be arranged.

6. International transfers

  • To Switzerland, where the Swiss entity is the controller. The European Commission has found that Switzerland offers an adequate level of protection, so the transfer needs no additional safeguards.
  • To the United States, to the extent that Vercel or Meta process data there. Both rely on the EU–US Data Privacy Framework and on the standard contractual clauses approved by the European Commission.

Because it directs its activity at people resident in the European Union, the Swiss entity is subject to the GDPR (Art. 3(2)) and has appointed a representative in the Union under Art. 27: [NAME AND CONTACT DETAILS OF THE EU REPRESENTATIVE]

7. Your rights

You may exercise the following rights at any time:

  • Access: find out what data of yours is held.
  • Rectification: correct anything inaccurate.
  • Erasure: ask for it to be deleted once no longer needed.
  • Objection: object to a particular use.
  • Restriction: ask that it be kept but not used.
  • Portability: receive your data in a machine-readable format, or have it sent to another professional.
  • Withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand.

To do so, write to [EMAIL ADDRESS] saying which right you wish to exercise. You will get a reply within one month. You may be asked to prove your identity, so that your data is not handed to someone who is not you.

8. Complaints

If you believe your data is not being handled properly, you can raise it with [EMAIL ADDRESS] first, and in any case lodge a complaint with the supervisory authority:

  • Spanish Data Protection Agency (AEPD) — C/ Jorge Juan 6, 28001 Madrid — www.aepd.es
  • And, as regards the Swiss entity, the Federal Data Protection and Information Commissioner (FDPIC) — www.edoeb.admin.ch

9. Security

Reasonable technical and organisational measures are in place to protect your data: limited access to the devices where it is stored, strong passwords, encryption of equipment and of the communication channel, and backups. No measure removes risk entirely; should a breach occur that could affect you, you will be told and the supervisory authority notified within the periods the law sets.

10. Minors

The service is aimed at adults. Bookings by minors are not accepted without the consent of whoever holds parental responsibility or guardianship.

11. Changes to this policy

This policy may be updated if the services, the providers or the law change. The version in force is the one published here. If a change affects you significantly, you will be told through the usual channel.

Last updated: 6 September 2026