Legal

Privacy Policy

Last updated: 19 October 2026

1. Data protection information

At Respiro Health, your privacy matters as much as your breathing. Here you will find, in plain language, what is and is not done with your personal data on this website.

This policy explains how the personal data of everyone who interacts with Respiro Health through respirohealth.eu is processed and protected. We also recommend that you read the Legal Notice, the Cookie Policy and the Terms and Conditions of Sale before using this website.

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), Yovanka Grueso, as data controller, informs you how the data you provide is processed, subject to the technical and organisational security measures required by current legislation.

2. Who is responsible for this website?

Data controller: Yovanka Grueso
Trading name: Respiro Health
Tax ID (NIF): 02659068S
Address: Centro Comercial Mar y Sol, Local 5, 11310 Sotogrande (Cádiz), Spain
Email: info@respirohealth.eu
Activity: breathing retraining using the Buteyko Method, Pilates and NeuroKinetic Therapy®; private and group sessions, in person and online
Qualifications: Certified Buteyko Method Instructor (Buteyko Clinic International), Pilates Teacher and NeuroKinetic Therapy® Practitioner
Data Protection Officer: not appointed, as it is not mandatory for this activity. For any privacy question, write to info@respirohealth.eu.

3. What personal data is collected?

Respiro Health only collects the data needed to look after you. Depending on how you interact with us, this may include:

Identification data: first name and surname.
Contact data: email address and phone number.
Booking data: type of session (private or group, in person or online), preferred language and requested dates.
Billing and payment data: what is needed to issue an invoice (name, tax ID and address, if you request one) and payment confirmation. Your card details are handled directly by Stripe; Respiro Health never has access to them.
Health data: only if you book sessions, and always outside the website forms (see the next section).
Browsing data: IP address, device and browser type, and the information collected by cookies, as explained in the Cookie Policy.

Health data

To tailor the breathing work to you, it may be necessary to know about your health: for example, asthma or other respiratory issues, sleep problems (insomnia, snoring, sleep apnoea), stress, anxiety or any medication you take. Under Article 9 of the GDPR this is a “special category” of data and receives enhanced protection:

It is only collected with your explicit consent, in the client intake form or questionnaire, never through the website forms.
It is used solely to plan and follow up your sessions.
It is not shared with anyone without your express authorisation, unless required by law.
Respiro Health sessions do not replace medical diagnosis or treatment.

Please do not include health information in the contact form or the booking form. If you do, it will be treated with the same confidentiality and used only to reply to your enquiry.

Minors

Respiro Health offers sessions from age 4. When the person concerned is under 14, the data must be provided, and consent given, by their parent or legal guardian (Art. 7 LOPDGDD). Young people aged 14 and over may consent to the processing of their data themselves, although sessions will be booked by their legal representative. If we find that we have received data from a child under 14 without that consent, we will delete it.

4. On what legal basis is your data processed?

Performance of a contract or pre-contractual steps (Art. 6.1.b GDPR): to manage your booking request, deliver the sessions you book, take payment and send you related information.
Consent (Art. 6.1.a GDPR): to reply to enquiries you send through the contact form or by email. For health data, explicit consent (Art. 9.2.a GDPR).
Legal obligation (Art. 6.1.c GDPR): to issue invoices and meet tax and accounting obligations.
Legitimate interest (Art. 6.1.f GDPR): to protect the website and its users from abuse, spam and fraud.

5. For what purposes is your data processed?

Contact form. The data you provide (name, email and message) is used only to answer your questions or suggestions and send you the information you ask for.

Booking request form. The data you provide is used to review your request, confirm availability, agree the date and format of the session with you and send you the payment link.

Booking and payment of sessions. Your data is processed to manage the purchase of private or group breathing retraining sessions (Buteyko Method), including payment through a secure Stripe link, invoices and receipts, and confirmation, reminder and follow-up emails.

Online sessions. If you choose an online session, we will use your name and email address to send you the Zoom video call link. Sessions are not recorded unless we agree to it in advance and you expressly authorise it.

Session follow-up. With your explicit consent, the health data in your client file is processed to adapt the exercises to your needs and assess your progress.

Respiro Health does not send marketing communications or newsletters without your prior consent, does not sell your data, and does not use it for automated decision-making or profiling.

6. How long is your data kept?

Your data is kept for the minimum time needed for the purpose for which it was collected:

Type of data	Retention period
Contact form enquiries	As long as needed to reply and then up to 1 year, unless you ask for earlier deletion
Unconfirmed booking requests (prospective clients)	Up to 2 years from the last contact, unless you ask for earlier deletion
Client data and client file (including health data)	For the duration of the relationship and, once it ends, up to 5 years to handle any claims (Art. 1964 Spanish Civil Code)
Invoices and accounting data	4 years (Arts. 66 et seq. Spanish General Tax Law) and up to 6 years (Art. 30 Spanish Commercial Code)

When these periods end, the data is securely deleted or anonymised.

7. Who is your data shared with?

Your data is not disclosed to third parties, except where required by law (for example, to the Spanish Tax Agency). To provide the service, Respiro Health works with providers that process data on behalf of Respiro Health, as data processors, under their own privacy terms and with the level of protection required by the GDPR:

Web hosting and email: BanaHosting, where the website is hosted and form messages are stored.
Forms: WPForms, whose submissions are stored on the website itself.
Payments: Stripe Payments Europe, Ltd. (Ireland), which processes card payments.
Video calls: Zoom Communications, Inc. (USA), for online sessions.
Email: website emails (form notifications and confirmations) are sent from WordPress through the WP Mail SMTP plugin; administrative email is received in Microsoft (Outlook).

Occasionally, the hosting company or the person in charge of website maintenance may access the website. They are required to maintain the same level of confidentiality that applies to the processing carried out on this website.

International transfers

Some of these providers are based in the United States or may access data from there. In those cases, transfers are covered, as appropriate, by the EU-US Data Privacy Framework adequacy decision, where the provider is certified, or by other appropriate safeguards such as the Standard Contractual Clauses adopted by the European Commission, supplemented by any additional measures needed to ensure the level of protection required by the GDPR.

8. What are your rights?

You have the right to know whether Respiro Health is processing your personal data and, if so, to:

Access your data.
Ask for it to be corrected if inaccurate, or deleted.
Ask for its processing to be restricted.
Object to its processing.
Ask for data portability.
Withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise these rights, write to info@respirohealth.eu stating which right you wish to exercise. If needed to verify your identity, we may ask for a copy of your ID document. If you are acting on behalf of someone else (for example, your child), you will need to prove that you represent them. You can also use the forms provided by the Spanish Data Protection Agency. We will reply within one month at the latest.

If you believe your rights have not been respected, you can file a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

9. Confidentiality and data security

Respiro Health is committed to treating your data confidentially, in line with its purpose, and to applying the measures needed to prevent its alteration, loss, processing or unauthorised access, in accordance with current legislation. Health data is stored with enhanced security measures and restricted access.

This website has an SSL certificate: the data you send travels encrypted between your browser and the server.

Even so, no transmission over the Internet is completely invulnerable, so the absence of fraudulent access by third parties cannot be absolutely guaranteed.

Anyone authorised by Respiro Health to process your data (collaborators or providers) is bound by a duty of confidentiality, whether contractual or legal.

10. Data breach notification

If a security breach affecting your personal data occurs (loss, misuse, unauthorised access or acquisition by a third party), Respiro Health will notify the Spanish Data Protection Agency within 72 hours where required and will inform you without undue delay if the breach poses a high risk to your rights, with the information available at the time.

11. Accuracy of data

You are responsible for ensuring that the data you provide is truthful, correct and up to date, and you agree to tell us about any changes. This is especially important for information about your health, so that sessions can be safely adapted to you.

12. Withdrawal of consent

You can withdraw any consent you have given at any time by writing to info@respirohealth.eu, as described in the rights section. Withdrawal does not have retroactive effect.

13. Changes to this privacy policy

Respiro Health may amend this policy to reflect changes in legislation, case law or its own activity. Any changes will be published on this page reasonably in advance of taking effect.