Privacy policy
Updated 9 September 2026
1. Data controller
Olva Oy (Business ID 3646592-6). HierontaAuto is a brand name used by Olva Oy. Contact person: Joona Leppänen Email: joona@hierontaauto.fi
2. What data is collected
At booking: name, phone number, email address, visiting address and the appointment time. During treatment: background information on your state of health to the extent it affects the safe delivery of the treatment, and a treatment record. For invoicing (business customers): company name, business ID and e-invoice address.
3. Why data is processed
To carry out the booking and the treatment, to arrive at the right address at the right time, and to fulfil the statutory obligation to draw up and retain patient records.
4. Legal basis for processing
Performance of a contract (booking and treatment) and the controller's legal obligation (drawing up and retaining patient records). For health data, processing is based on Article 9(2)(h) of the General Data Protection Regulation (the provision of health and social care services).
5. Where data is stored
Patient records and health data are stored in the Ajas patient information system. Ajas Oy acts as a data processor on our behalf under the GDPR; the system is certified as an A1-class patient information system and its server is located in UpCloud Oy's data centre in Helsinki (within the EU). Statutory health data is transferred to the national Kanta archive. Booking contact details and the visiting address are additionally processed in Google Workspace Calendar to schedule treatments and plan visit routes; the visiting address is stored in the calendar temporarily for this purpose. No health data is stored in the calendar. The website runs on the Render platform, whose server environment is located within the EU. No patient data is stored on the website, and booking contact details are deleted from the website database automatically soon after the treatment.
6. Who processes the data
The data is processed by the person responsible at the company. In addition, service providers process data on our behalf: Ajas Oy (patient information system, with limited access for technical support and maintenance only), Google (calendar) and Render (website server platform). Card payments are handled by Stripe and e-invoices through Holvi. The server providers have no access to health data in plain text. Data is not disclosed except on lawful grounds and is not transferred outside the EU or the EEA.
7. How long data is retained
Patient records are retained in accordance with the Finnish Ministry of Social Affairs and Health's decree on patient records. Booking contact details are deleted from the website database automatically soon after the treatment, and the visiting address is deleted from the calendar once routing is no longer needed. Accounting vouchers are retained for the period required by the Accounting Act.
8. Data protection
The data is protected with usernames and passwords, and user accounts have two-factor authentication enabled. The information security of the Ajas patient information system has been verified in an external audit (A1 certification). The data is not kept on paper.
9. Rights of the data subject
You have the right to access the data concerning you, to request the rectification of incorrect data and to restrict processing. Requests are sent by email to joona@hierontaauto.fi. You also have the right to lodge a complaint with the Office of the Data Protection Ombudsman.
10. Cookies and usage statistics
The website does not use tracking cookies or third-party analytics. Only technical data necessary for the site to function is stored in your browser, such as an unfinished booking. In addition, we collect anonymous, aggregated usage statistics on our server to improve the service: for example, how many times each postal code is searched (including areas outside the service area, so we know where it is worth expanding) and how the booking flow progresses. The statistics are stored as daily totals and cannot be linked to an individual visitor.