Privacy policy.

1. Who we are

Spark X Agency is a marketing-technology company registered in Estonia. We build and run patient-flow systems for premium clinics in the Gulf and work with sports and wellness businesses in Europe.

For the purposes of the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act, Spark X Agency is the controller of the personal data described in this policy. You can reach us at business@sparkxagency.com or on +372 5354 1211.

This policy covers the website sparkxagency.com. It does not cover the patient data we handle on behalf of client clinics; that is governed by the written data processing agreement we sign with each clinic, under which the clinic remains the controller and we act as processor (see section 9).

2. What we collect, and why

We collect as little as the site needs to work. In practice there are four situations.

You send us a message through the contact form

We receive your name, email address and message. We use them to reply to you and, if you ask for one, to prepare a diagnostic or a proposal. The legal basis is taking steps at your request before entering into a contract (GDPR Article 6(1)(b)), and our legitimate interest in answering enquiries (Article 6(1)(f)).

You book a free diagnostic

Bookings run through Calendly. When you pick a time, Calendly asks for your name, email address and any notes you add, and shares them with us so we can hold the call. Calendly processes this data under its own privacy policy as well as ours. Legal basis: steps before a contract (Article 6(1)(b)).

You simply visit the site

Our hosting provider records standard server logs (IP address, time, pages requested, browser type) to serve the pages and to protect the site against abuse. These logs are kept briefly and are not used to identify visitors. Legal basis: legitimate interest in running a secure website (Article 6(1)(f)).

If analytics is enabled for your visit (see section 4), Google Analytics collects usage data such as pages viewed, approximate location derived from a truncated IP address, device and browser type, and how you arrived at the site. We use it only to understand which pages are read and where visitors drop off. Legal basis: your consent where it is required (Article 6(1)(a)), otherwise our legitimate interest in improving the site (Article 6(1)(f)).

You use the "Ask your own" box

Your question is sent to our server and to Anthropic, whose Claude model generates the answer from our own written materials. We keep a log of the questions asked, with the time and whether an answer was given, so we can improve the written answers on the site. The log contains no IP address and no account details; your IP is used only, in hashed form, to limit how many questions can be sent per minute. Please don't put personal or patient details in the box. Legal basis: our legitimate interest in answering visitors' questions (Article 6(1)(f)).

You use the calculator

The figures you enter in the "Put your own numbers in" calculator never leave your browser. They are not sent to us or to anyone else, and they are not stored.

3. Who we share data with

We do not sell personal data and we do not share it with advertisers. We use a small number of service providers who process data on our instructions:

Where these providers are outside the European Economic Area, transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses. We may also disclose data if the law requires it.

4. Cookies and similar technologies

The site uses no advertising or tracking cookies. What it does use:

How consent works. If your browser's time zone places you in the European Union or the United Kingdom, analytics is switched off until you choose "Accept" in the cookie notice, and we honour Google Consent Mode so that no analytics cookies are set before then. Visitors elsewhere, including the Gulf, have analytics enabled by default. Everyone can change their choice at any time via "Cookie settings" in the footer of every page. Declining has no effect on how the site works.

5. How long we keep data

• Contact-form messages and emails: for as long as we need to deal with your enquiry, then up to 24 months so we can pick the conversation back up if you return. If we go on to work together, the correspondence becomes part of the client file and is kept for the duration of the engagement plus the period Estonian accounting and limitation rules require.
• Calendly bookings: kept in Calendly and in our calendar for 24 months after the call.
• Server logs: retained by our hosting provider for a short period (typically under 30 days).
• "Ask your own" question log: kept for 12 months, then deleted.
• Analytics: Google Analytics event data is kept for 14 months, then aggregated.

You can ask us to delete your data sooner (see section 7).

6. How we protect it

The site is served over HTTPS only. Form submissions are stored by our hosting provider with access limited to the two founders. Our email and documents are protected with two-factor authentication. Nobody outside the company has standing access to enquiries.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate data;
• delete your data, unless we have a legal reason to keep it;
• restrict or object to processing based on our legitimate interests;
• receive the data you gave us in a portable format;
• withdraw consent at any time, for example via "Cookie settings" in the footer, without affecting processing that happened before.

To exercise any of these, email business@sparkxagency.com. We answer within one month. There is no charge.

If you are unhappy with how we handle your data you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or to the supervisory authority where you live. We would rather hear from you first.

If you are in the United Arab Emirates or Saudi Arabia, you have comparable rights under the UAE Personal Data Protection Law and the Saudi Personal Data Protection Law, and the same email address applies.

8. Links to other sites

The site links to our profiles on Instagram, LinkedIn, Facebook, X, TikTok, YouTube, Threads, Rumble and Telegram. Those platforms have their own privacy policies; we do not receive data from them simply because you followed a link.

9. Patient data we handle for clinics

When a clinic engages us, we work inside the clinic's own systems — its WhatsApp Business account, CRM and calendar — and handle enquiry and patient data on the clinic's behalf. In that relationship the clinic is the controller and Spark X Agency is a processor. The terms are set out in a written data processing agreement signed before any access is granted, including that data stays in the clinic's own systems, is used only for the agreed purposes, and that nothing leaves the clinic without its authorisation.

If you are a patient of a clinic that works with us and have a question about your data, please contact the clinic directly; it is the party responsible for answering you, and we will support it in doing so.

10. Children

The site is aimed at clinic owners and business operators. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us data, email us and we will delete it.

11. Changes to this policy

We will update this page when our practices or the law change, and show the date of the latest version at the top. Significant changes will be noted here for at least 30 days.