Privacy Policy
Last updated: September 2026
This policy explains how Energy Clinic d.o.o. ("Energy Clinic", "we") processes personal data on energyclinic.com, in line with the General Data Protection Regulation (GDPR) and Croatian law.
Who is responsible
The controller is Energy Clinic d.o.o., Ulica Ivana Gorana Kovačića 14, 21300 Makarska, Croatia, info@energyclinic.com.
Visiting the website
When you visit the site, our server processes technical data (IP address, browser, pages visited) to deliver the pages, keep them secure and prevent abuse. We count visits with our own statistics tool, hosted on our server, without advertising cookies and without sharing the data with third parties. Legal basis: our legitimate interest in running a secure website (GDPR art. 6(1)(f)). Server logs are kept for a short period and statistics in aggregated form.
Contact form
When you write to us, we use your name, e-mail address and message to answer you (GDPR art. 6(1)(f), and art. 6(1)(b) where your request concerns a service). We keep the correspondence for up to 24 months unless it becomes part of a contract.
Newsletter
If you subscribe to the newsletter, your e-mail address is sent to our mailbox through the FormSubmit form service and used only to send you our news, until you unsubscribe (consent, GDPR art. 6(1)(a)).
Find My Match
Your answers to the questionnaire may reveal information about your health. We therefore process them only with your explicit consent (GDPR art. 9(2)(a)), given by ticking the box before your results are shown. The answers are used only to calculate your suggestions during your visit: they are not stored, not linked to your identity and not shared with clinics. To write the personalised explanations, the answers, without any information identifying you, may be sent to our AI provider Anthropic PBC, which acts as our processor and may keep them for a limited period for security purposes. You can withdraw your consent at any time by no longer using the tool.
Clinic space and memberships
For clinics, we process the name, e-mail address and sign-in records of their representatives, the profile information and the documents they upload (for example licences and diplomas, which may contain personal data of practitioners), and the record of the accepted membership agreement (name, role, date, IP address). Legal basis: the performance of the contract with the clinic (GDPR art. 6(1)(b)) and our legal obligations (art. 6(1)(c)). Qualification documents are visible only to the Energy Clinic team and are deleted within 12 months after the profile ends. Accounting records are kept as long as Croatian law requires.
Information about clinics and practitioners
To build the guide, we collect publicly available information about clinics and their practitioners, such as names, professional titles, specialties, licence numbers, contact details and photos, from clinic websites and public sources. We may also analyse a clinic's public website to prepare a private visibility report for that clinic. Legal basis: our legitimate interest in providing an accurate guide (GDPR art. 6(1)(f)). Clinics and practitioners can ask us at any time to correct or remove this information, or object to its use, at info@energyclinic.com.
Payments
Membership payments are processed by Stripe Payments Europe Ltd. (Ireland). Card details are entered on Stripe's pages; we never see or store card numbers.
Service providers
We use the following service providers, who process data only on our instructions: our hosting provider (servers in the European Union), Resend (sending of e-mails), FormSubmit (newsletter form), Anthropic (AI analysis and explanations) and Stripe (payments). Where a provider is located outside the European Economic Area, data is transferred under the safeguards required by the GDPR, such as the European Commission's Standard Contractual Clauses.
Your rights
You can ask to access, correct or erase your data, restrict or object to its processing, and receive it in a portable format. Where processing is based on consent, you can withdraw it at any time without affecting earlier processing. Write to info@energyclinic.com. You can also lodge a complaint with the Croatian Personal Data Protection Agency (AZOP, azop.hr).
Security
We use encrypted connections (HTTPS), restricted access, separate private storage for documents, and regular encrypted backups kept in the European Union.