Privacy Policy

1. Who is responsible for your data

FMV HealthSpace Community is operated by NeuroBalance Weight, a business registered in Germany as a Kleingewerbe, owned by Ionela Croitoru, at Bahnhofstraße 49, 71229 Leonberg, Germany. Full details are under Legal Information.

For anything concerning your personal data, write to contact@webicdp.com. We answer within one month, as the law requires.

Being the “controller” means we decide why and how your data is used. The responsibility is ours, including for the providers we rely on.

2. What we collect

Only what the platform needs to work. Specifically:

When you create an account: email address, display name, username. Optionally, a profile picture and a short bio.

When you use the community: your posts, comments, likes, saved material, the courses you enrol in and the lessons you mark complete.

If you are a professional: your application, the specialisations you declare, and the qualification documents you upload. These are visible to the administrators reviewing your application.

When you join a live session: that you registered and attended. If the host starts a recording, your image and voice are recorded — see section 6.

Automatically, for technical reasons: IP address, browser type and access time, in server logs. Used for security and for fixing faults.

3. Why we use it, and on what legal basis

The law requires us to state not just what we do, but what justifies it:

• Performance of a contract (Art. 6(1)(b) GDPR) — to give you the account, the feed, the courses and the sessions. Without this data the service cannot exist.
• Your consent (Art. 6(1)(a)) — for optional things: profile picture, bio, whatever you choose to publish. Withdrawable at any time.
• Our legitimate interest (Art. 6(1)(f)) — security, abuse and spam prevention, and understanding what breaks. It never overrides your rights.
• Legal obligation (Art. 6(1)(c)) — when we must answer an authority or keep accounting records.

4. Health data — please read this one

This is a community about nutrition and balance. People write here about weight, food, sometimes about diagnoses or treatment. The law calls this health data and protects it more strictly than the rest (Art. 9 GDPR).

We never ask you for medical information. No form field asks for a diagnosis, a weight or a treatment. Anything of that kind reaches us because you chose to write it.

When you publish such information in a post or comment, the basis is your explicit consent (Art. 9(2)(a)) — given by the act of publishing, having read this warning.

Please think twice. A public post can be read by anyone, copied, and preserved in archives that are not ours. If you want to discuss something sensitive with a professional, do not do it in the public feed.

5. Who else has access

We do not sell your data and we do not use it for advertising. There are no ads on this platform.

We do rely on technical providers, each under contract and none permitted to use the data for their own purposes:

• Supabase — the database, authentication and uploaded files. Hosted in the European Union.
• LiveKit — the audio and video sessions, and recording processing.
• Vercel — application hosting and page delivery.

The map on a specialist's profile is the one element loaded by somebody other than us: it comes from OpenStreetMap. It never loads on its own, though. It appears only if you press "Show the map", and until you do, your browser sends OpenStreetMap nothing at all. When you do press it, they receive your device's IP address, as any site you open does.

Beyond that, other members see what you publish publicly: your posts, comments and profile. That is the nature of a community, not a technical choice of ours.

6. Live session recordings

A session can be recorded only by its host, and only deliberately — nothing records automatically.

You are shown clearly when recording starts. If you would rather not appear, you can turn off your camera and microphone, or leave. Nobody is recorded covertly.

Recordings stay private. They are not published anywhere automatically and are reachable only by the host and administrators. Download links expire after ten minutes.

If you appear in a recording and want it deleted, write to us. We consider the request together with the host, weighing the other participants' rights too.

7. How long we keep it

• Account data — for as long as the account exists. Deleted with it.
• Posts and comments — while the account is active; removed when it is deleted.
• Qualification documents — during review and while you are an active professional here.
• Session recordings — until the host deletes them.
• Technical logs — at most 12 months, then automatically erased.
• Accounting records — 10 years, where tax law requires it.

8. Your rights

GDPR gives you concrete rights, not theoretical ones. Exercise them by writing to contact@webicdp.com, free of charge:

• Access — find out what we hold about you and get a copy.
• Rectification — correct what is wrong. Much of it you can change yourself in settings.
• Erasure (“the right to be forgotten”) — you can delete your own account under Settings → Delete account. It happens immediately and without passing through us. If you would rather ask us, write.
• Restriction — ask us to stop using it without deleting it.
• Portability — receive your data in a format you can take elsewhere.
• Objection — object to processing based on our legitimate interest.
• Withdraw consent — at any time, without affecting what came before.

We answer within one month. Complex requests may take two months more, and we will tell you why.

9. If you are not satisfied

Write to us first — most things are resolved directly and quickly.

If you still believe we are infringing your rights, you may complain to a supervisory authority. The one competent for us is Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI), Lautenschlagerstraße 20, 70173 Stuttgart, baden-wuerttemberg.datenschutz.de.

You do not have to complain in Germany. The Regulation gives you the right to approach the authority of the country you live in. If that is Romania, it is the National Supervisory Authority for Personal Data Processing (ANSPDCP), dataprotection.ro — which will cooperate with the German authority.

You also have the right to go to court, including in your own country.

10. Minimum age

This platform is for people aged 16 and over — the age GDPR sets for consent to online services, applicable both in Germany, where we are established, and in Romania.

If we learn that an account belongs to a child under 16, we delete it. If you are a parent and believe this applies, write to us.

11. How we protect your data

Access is enforced row by row inside the database itself (Row Level Security), not merely in the interface. A display bug therefore cannot expose somebody else's data.

Uploaded documents live in private storage, reachable only through signed links that expire. Your password is never visible to us.

No measure is perfect. If a breach occurs that puts your rights at risk, we will notify both you and the authority, as the law requires.

12. Changes to this policy

When something material changes, we update the date at the top and tell you in the app before it takes effect.

The version published here is always the one in force.