GDPR — Your Data Rights

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) · 2026

Who We Are

ZORYX Team s.r.o. is the data controller within the meaning of GDPR Art. 4(7), responsible for the processing of personal data in connection with the Zoryx web application at zoryx.app and mobile application.

Data Protection Officer (DPO): Yauhen Zorych

DPO Email: yauhen.zorych@zoryx.app

General Contact: yauhen.zorych@zoryx.app

Phone: +420 776 540 503

Your Rights Under GDPR

📋 Right of Access (Art. 15)

You have the right to obtain confirmation of whether we process your personal data, and if so, to receive a copy of that data along with information about how and why it is processed.

✏️ Right to Rectification (Art. 16)

You have the right to have inaccurate personal data corrected without undue delay. This includes the right to have incomplete data completed.

🗑️ Right to Erasure — "Right to be Forgotten" (Art. 17)

You have the right to request the deletion of your personal data when: it is no longer necessary for the purpose it was collected, you withdraw consent, or it has been unlawfully processed.

⏸️ Right to Restriction of Processing (Art. 18)

You may request that we restrict processing of your data (i.e. store but not use it) while you contest its accuracy, while we assess your objection, or if processing is unlawful but you do not want erasure.

📦 Right to Data Portability (Art. 20)

Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your data in a structured, commonly used, machine-readable format (e.g. JSON).

🚫 Right to Object (Art. 21)

You have the right to object at any time to processing of your data that is based on legitimate interest, including profiling. We will cease processing unless we demonstrate compelling legitimate grounds.

↩️ Right to Withdraw Consent

Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.

How to Exercise Your Rights

Send a request to our DPO at yauhen.zorych@zoryx.app. Please include:

Your name or identifier used in the service (e.g. review pseudonym)
The specific right you wish to exercise
Any relevant details (e.g. clinic you reviewed, date of submission)

We will respond within 30 days. In complex cases, we may extend this by a further 2 months and will inform you accordingly.

Information About Your Health

When you book, you are asked why you are coming. What you write there — symptoms, a diagnosis, a question for the doctor — is data concerning health, a special category under GDPR Art. 9. It is not covered by accepting these terms in general, so the booking form asks separately, with a box that starts unticked. Without that consent the booking cannot carry a reason for the visit.

It is used for one thing: letting the clinic prepare for your appointment. It is not used for advertising, is never sold, and is not shared with anyone but the clinic you chose and the doctor you are seeing. You may withdraw the consent at any time by writing to us; we then remove what you wrote, and the appointment itself stands.

A clinic also keeps its own patient documentation under its own obligations as a healthcare provider. That documentation is separate from what is described here.

Messages and the AI Assistant

A clinic may answer you in chat itself, or let an assistant do it. When the assistant replies, the text of your conversation is sent to Anthropic, our AI processor, to produce that reply. Anthropic processes it on our instructions under a data processing agreement and does not use it to train models.

Messages are stored so the conversation is still there when you come back, and are deleted after a year without activity, or immediately if you close your account. If you would rather an assistant did not see something, write it to the clinic by telephone or e-mail instead.

Who Can See What

The clinic you booked with sees your name, contact details, the appointment and the reason you gave for it.

The doctor you booked with sees the same, for their own appointments only. A doctor cannot see another doctor's patients, and cannot reach the clinic's settings. Doctors are given this access by the clinic; nobody can declare themselves a doctor here.

Other visitors see only what you deliberately publish: a review you wrote, under the name on your account.

Zoryx staff reach personal data only where support or security requires it.

How Long We Keep Things

Nothing is kept indefinitely. These periods run automatically:

What	Kept for
What you wrote about your health	90 days after the appointment, then deleted
Your name and contacts on a booking	2 years after the appointment, then removed from it
The fact that an appointment happened	Kept, with nothing left that identifies you
Messages with a clinic or doctor	Deleted after a year with no activity
Your account	Until you close it

Pausing or Closing Your Account

Pausing hides your profile and your reviews and stops all email. Nothing is thrown away and signing in again brings it back. It exists because most people who want to leave want the service to stop, not their own history to vanish.

Closing deletes your messages, reviews, collected hearts, your profile and your sign-in. Bookings are the one exception: the appointment happened and the clinic has its own reasons to record that it did, so the record stays while your name, email, phone and the reason for the visit are stripped out of it. Nothing left in it says who came. Both are in your profile, at the bottom.

Data Processing Purposes & Bases

Purpose	Data	Legal basis (GDPR Art. 6)
Making and honouring a booking	Name, email, phone, chosen clinic, doctor, date and time	Contract (6.1.b)
Preparing for your visit	What you write about your symptoms	Explicit consent (6.1.a + 9.2.a)
Confirmation and reminder emails	Email address, booking details	Contract (6.1.b)
Messages with a clinic or doctor	Chat messages, stored until deleted	Contract (6.1.b)
Your Zoryx account	Name, email, profile photo you upload	Contract (6.1.b)
Displaying clinic reviews	Name, rating, comment	Consent (6.1.a)
Hearts and the mosaic game	Account identifier, counters	Legitimate interest (6.1.f)
Donor lead collection	Phone number	Consent (6.1.a)
Service analytics	IP (anonymised), device, pages	Legitimate interest (6.1.f)
Security & fraud prevention	IP address, request rate	Legitimate interest (6.1.f)

Supervisory Authority

You have the right to lodge a complaint with the Czech supervisory authority:

Úřad pro ochranu osobních údajů (ÚOOÚ)

Pplk. Sochora 27, 170 00 Praha 7

Web: www.uoou.cz

Email: posta@uoou.cz