Legal Notice & Privacy Policy

Appointments, payment processing, and related personal data handling are managed via our external partner Bokadirekt under Bokadirekt’s terms of service and privacy policy. Payments can be completed online via Bokadirekt or on-site using credit or debit card or Swish.

Champ Massage Therapy (Waraporn Doungprakhon) is the data controller responsible for processing your personal data. We collect personal details and health information via our consultation and intake form solely to assess treatment suitability, identify potential contraindications, ensure your safety, and tailor your session appropriately.

This processing is carried out based on your explicit consent pursuant to GDPR Article 6(1)(a) and Article 9(2)(a) regarding special categories of health data. Your data is handled confidentially and stored securely in our GDPR-compliant Google Workspace Business system under an active Data Processing Addendum (DPA) with Google Ireland Limited. All stored information remains within the EU and EEA, and data is never disclosed to unauthorized third parties or sold for external commercial purposes.

Health records and intake details are retained only for as long as necessary to fulfill treatment safety requirements or until consent is withdrawn, after which they are permanently and securely erased. You may withdraw your consent at any time, or request access to, correction of, or deletion of your data by contacting us at contact@champ-spa.com. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. If you believe your personal data is handled in breach of current data protection laws, you also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten - IMY).