Privacy Policy
1. Who we are
The controller responsible for the processing of personal data under this Privacy Policy is:
Elan Clinic OÜ
Registry code: 17338832
Address: Sepapaja 12/1, Tallinn 11415, Estonia
Email: info@elanclinic.ee
2. What personal data we collect
Depending on how you interact with us, we may process the following categories of personal data:
2.1 Booking and communication data
- Name
- Email address
- Phone number
- Communication content (messages you send to us)
- Appointment details (requested time, service type, notes relevant to scheduling)
2.2 Health and intake data (special category data)
If you complete an intake form or provide medical information in connection with consultations and services, we may process health information (special category personal data). This may include information you provide about your symptoms, medical history, medications, lab results, lifestyle factors, and other information relevant to providing medical services.
2.3 Website usage data
When a page loads, our hosting provider may process technical request data such as your IP address, browser details and the address of the page visited. The website uses Google Fonts. Loading external services involves your browser sending the technical data required for the request to the service provider.
3. Purposes of processing
We process personal data for the following purposes:
- Scheduling consultations and managing bookings (including confirming appointments and communicating practical details).
- Providing medical services and ensuring continuity and quality of care.
- Fulfilling legal obligations applicable to healthcare providers, including requirements related to medical documentation and accounting.
- Operating, securing, and improving our website and understanding how visitors use it where a page uses analytics.
- Processing orders for digital products (where applicable) and managing customer support.
4. Legal bases (GDPR)
We process personal data based on one or more of the following legal bases:
- Consent (GDPR Article 6(1)(a)) – for example, where you choose to submit information via forms, and where consent is requested for certain cookies/technologies.
- Performance of a contract (GDPR Article 6(1)(b)) – to handle your booking request and provide the services you request.
- Legitimate interests (GDPR Article 6(1)(f)) – to operate our business, secure our services, prevent abuse, and improve our website and communications.
- Legal obligation (GDPR Article 6(1)(c)) – for example, statutory requirements related to healthcare documentation and accounting.
For health data (special category data), we process such data only when a valid condition under GDPR Article 9 applies – typically your explicit consent (Article 9(2)(a)) and/or where processing is necessary for the provision of health care (Article 9(2)(h)).
5. Data retention periods
We keep personal data only for as long as necessary for the purposes described above, unless a longer retention period is required or permitted by law.
- Booking and communication data: retained as long as necessary to manage the booking and related communications, and thereafter for a reasonable period to handle follow-up, disputes, or legal claims.
- Medical records and health information: retained in accordance with applicable Estonian and EU legal requirements for healthcare documentation.
- Accounting and transaction data: retained as required by applicable accounting and tax rules.
- Analytics data (cookies): retained according to the settings of our analytics tools and only as long as needed to generate aggregated statistics.
6. Third-party processors and data transfers
We may use trusted service providers (processors) to help us operate our website and deliver services. When we do, we ensure appropriate contractual safeguards are in place.
6.1 Hosting, fonts and appointment requests
Zone hosts this website. Google Fonts supplies the typefaces. You can contact the clinic by email, telephone or WhatsApp to arrange an appointment. The WhatsApp link opens an external service provided by Meta; WhatsApp terms also apply to conversations there. Use this channel for general scheduling and service questions. Do not send detailed medical history, identification numbers, documents or test results through WhatsApp or ordinary email. We discuss medical details during a consultation. When online booking is connected, this notice will identify the provider and explain how booking information is processed.
6.2 Gumroad (digital products)
If we offer digital products, payments and order fulfillment may be handled by Gumroad. Please review Gumroad's privacy documentation for details.
6.3 International transfers
Some of our service providers may process data outside the European Economic Area (EEA). Where required, we use appropriate safeguards (such as adequacy decisions and Standard Contractual Clauses).
Your notice dismissal is saved in browser local storage under elan-cookie-info-v1. It is not an analytics or advertising cookie and is not sent to us. It remains until you clear the site’s browser data. You can reopen the notice through “Cookie information” in the footer.
7. Cookies and external services
We use Google Tag Manager, Google Analytics 4 and Google Ads measurement only with your consent. Before consent no Google script or cookie is loaded (Google Consent Mode v2, all signals denied by default). We ask on your first visit; rejecting is as easy as accepting, and you can change your choice at any time via the “Cookie choice” button in the footer — on withdrawal we stop sending data and delete the Google cookies within our reach.
With consent we send Google page views and the following anonymous events: booking button click, opening the e-Kliinik calendar, starting and completing the initial guide. The only information sent is the event name and the page language. Guide answers or results, contact form content, e-mail addresses and any other health or personal data are never sent to analytics. Google’s processing is described in the Google Privacy Policy.
Web fonts are loaded from Google Fonts and some photographs from the Valvekliinik website. Those servers receive technical connection information, including the IP address, when files are requested. The hero video is hosted on our own server. The eKliinik calendar and Google Maps open as external links, not embedded content. The external provider’s privacy and cookie terms apply when you visit its site.
You can remove cookies left by earlier visits through your browser settings. Technical information needed for hosting security is covered by this privacy policy.
Initial weight-management guide
Answers in the homepage guide stay in the current browser window and are not stored or transmitted to the clinic, Google or Meta. They reset when the page reloads. The guide helps identify a next step; it does not determine medication suitability. The separate contact form sends only your email address, contact request and consent confirmation. It is not a marketing or newsletter signup.
8. Your rights under GDPR
Subject to GDPR conditions and limitations, you have the following rights:
- Right of access – obtain confirmation whether we process your data and access to your personal data.
- Right to rectification – request correction of inaccurate or incomplete data.
- Right to erasure – request deletion of your data in certain circumstances.
- Right to restriction of processing – request limitation of processing in certain circumstances.
- Right to data portability – receive certain data in a structured, commonly used format.
- Right to object – object to processing based on legitimate interests.
- Right to withdraw consent – where processing is based on consent, you can withdraw it at any time.
To exercise your rights, contact us at info@elanclinic.ee.
9. Security
We implement reasonable technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or disclosure.
10. Contact & complaints
For data protection requests and questions, contact: info@elanclinic.ee.
You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate:
https://www.aki.ee
This Privacy Policy may be updated from time to time. The latest version will be published on this page.
Weight-management contact request
The homepage contact form asks for your name, phone number and/or email address, an optional short message, adult confirmation and explicit consent to reply to your enquiry. We process these details only to reply to your enquiry and do not keep them longer than necessary for that purpose. The form does not ask for your weight, height, medication or other health answers and does not give an automated treatment-suitability assessment; please do not include health information in the message.
If you want a reply from the team, you can separately send your email address and contact request. Elan Clinic OÜ processes these, together with the consent confirmation, time and wording version, on the basis of your explicit consent to answer the enquiry (GDPR Article 6(1)(a) and, where applicable, Article 9(2)(a)). The team replies within two working days at the latest. If you entered an email address, one automatic confirmation email with a reference number is sent to it; it does not contain health information. The request is sent to the clinic mailbox info@elanclinic.ee. Questionnaire answers and the result are not included.
The request is received by authorised clinic staff handling enquiries. The hosting provider Zone provides technical delivery and mailbox services. Data are used to resolve the enquiry and related correspondence and retained for as long as necessary for that purpose or to comply with a legal obligation. Sending a request does not subscribe you to marketing or newsletters. Please do not send health information by ordinary email; we can arrange an appropriate channel when needed.
You may withdraw consent at any time by contacting info@elanclinic.ee, without affecting processing carried out before withdrawal. The rights and supervisory-authority contact options described in this privacy notice apply.
Submitting the form uses a necessary session cookie, elan_contact (Secure, HttpOnly and SameSite=Strict), which contains no questionnaire answers. The submission token is valid for 30 minutes. A temporary hash of the network address and request counter are used on the server to limit abuse. Counter files older than two hours are removed during subsequent form requests. Hosting logs are covered by the general privacy notice.
Newsletter and interest-list sign-ups
The newsletter page (Élan Evidence Letter) and the Men over 40 page have a sign-up form. The form asks for your email address, optionally your name, general topics you are interested in, an optional short question and your consent to receive email updates. Please do not include health information in the form. Because chosen topics (for example, considering medication or fertility questions) may relate to health, we use them only to choose relevant content.
We process these details, together with the consent confirmation, time, wording version and reference number, on the basis of your consent (GDPR Article 6(1)(a) and, where applicable, Article 9(2)(a)), to send you the updates you chose and, where suitable, to reply to your question. The sign-up is sent to the clinic mailbox info@elanclinic.ee and handled by authorised clinic staff; the hosting provider Zone provides technical delivery and mailbox services. We use the Smaily service to send newsletters; to receive newsletters, your email address and name may be added there and are processed on our behalf. Sign-ups made before 7 October 2026 were delivered to the same mailbox through the FormSubmit form-forwarding service.
After you sign up, one automatic confirmation email with a reference number is sent to the address you entered. If you did not sign up, you can ignore it or write to info@elanclinic.ee and we will remove the address.
We keep these details until you withdraw your consent or ask us to remove them, and then delete them when they are no longer needed for this purpose. You can withdraw consent at any time by contacting info@elanclinic.ee, without affecting processing carried out before withdrawal. The rights and supervisory-authority contact options described in this privacy notice apply.
Submitting the form uses a necessary session cookie, elan_signup (Secure, HttpOnly and SameSite=Strict), valid for 30 minutes, which contains no form answers. A temporary hash of the network address and a request counter limit abuse; counter files older than two hours are removed during later form requests.