Practitioner rules for processing client data

These rules govern the practitioner's access to their clients' data on strannik.online, in compliance with the GDPR (EU 2016/679). They supplement the privacy policy.

1. General principle

The practitioner accesses only the data strictly necessary to support their clients. In processing this data, the practitioner acts as a data controller (or joint controller) and undertakes to comply with the GDPR.

2. Data accessible to the practitioner

  • client identity and contact details;
  • registration status and progress through the stages;
  • test history and results;
  • recommendations and assigned materials;
  • information on access to materials.

3. Practitioner obligations

  • use the data only for support within the service (purpose limitation);
  • ensure a valid legal basis and the client's consent where required;
  • respect confidentiality and any applicable professional secrecy;
  • not disclose the data to third parties or publish it;
  • not use the data for personal purposes outside the service;
  • apply appropriate security measures (protected access, secure devices);
  • facilitate the exercise of the client's rights (access, rectification, erasure, objection, withdrawal of consent);
  • report without delay to the data controller any suspected breach or unauthorised access.

4. Informational nature of the service

The practitioner takes into account that the service's results and recommendations are informational and constitute neither a medical diagnosis, a prescription, nor a substitute for a consultation with a healthcare professional.

5. Responsibility

Any breach of confidentiality or unlawful use of client data may result in restriction of the practitioner's access to the service, termination of the collaboration, and any other measure provided for by law and by the agreements entered into with the practitioner.

6. Data processing agreement

The detailed terms (respective roles, sub-processing, retention, security) are set out in a data processing agreement between the practitioner and Un Œil Nouveau, the operator of the service. The practitioner may request a copy at any time using the contact given in the privacy policy.