Last updated: October 4, 2026

This Privacy Policy explains how SpineX ("SpineX", "we", "us", or "our") collects, uses, stores, shares, and otherwise processes personal information when you visit https://www.spinex.digital (the "Site"), purchase or use our services, participate in an assessment or personalized training program, communicate with us, or otherwise interact with SpineX (collectively, the "Services").

For purposes of this Privacy Policy, "you" and "your" may refer to a website visitor, purchaser, client, participant, parent, legal guardian, or another individual whose personal information is processed by SpineX.

Where a parent or legal guardian provides information concerning a minor, this Privacy Policy also applies to the personal information relating to that minor.

Please read this Privacy Policy carefully.

1. WHO IS RESPONSIBLE FOR YOUR PERSONAL INFORMATION

SpineX is responsible for determining how and why personal information covered by this Privacy Policy is processed, except where another organization acts as an independent controller under applicable law.

Questions concerning this Privacy Policy or the processing of personal information may be sent to:

SpineX
Marcina Kasprzaka 31
01-234 Warsaw
Poland
Email: contact@spinex.digital

2. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes to our Services, technology, business practices, service providers, or applicable legal and regulatory requirements.

When this Privacy Policy is updated, the revised version will be posted on the Site and the "Last updated" date will be changed accordingly.

3. PERSONAL INFORMATION WE COLLECT

The personal information we collect depends on how you interact with SpineX and which Services you use.

Contact and Identification Information

This may include:

• name;
• email address;
• telephone number;
• billing address;
• country or region;
• communication preferences; and
• information necessary to identify the purchaser or participant.

Order and Transaction Information

This may include:

• products or Services purchased;
• order dates;
• transaction amounts;
• payment confirmation;
• billing information;
• refund or cancellation information; and
• information associated with invoices or payment records.

SpineX generally does not receive or store complete payment-card details. Payment information may be processed directly by payment providers used in connection with our Site or Services.

Assessment and Personalized Program Information

Clients participating in assessments or personalized SpineX programs may be asked to provide information necessary to evaluate, personalize, update, or deliver the purchased Service.

This may include:

• posture photographs;
• front, side, and back photographs;
• movement and assessment videos;
• exercise-performance videos;
• progress photographs and videos;
• X-ray images;
• radiology reports;
• Cobb-angle information;
• information concerning spinal curves or rotation;
• age and skeletal-maturity information;
• height and growth information;
• pain or symptom information;
• previous treatment or training history;
• information concerning braces or previous surgery;
• physical-activity and sports information;
• exercise equipment available to the participant;
• information submitted through questionnaires;
• progress updates; and
• other information voluntarily supplied for assessment or personalization.

Communication and Customer Support Information

We may collect information contained in communications between you and SpineX, including communications concerning:

• assessments;
• program instructions;
• progress updates;
• exercise questions;
• technical support;
• orders;
• appointments;
• refund or cancellation requests; and
• other customer-service matters.

Website and Device Information

When you use the Site, certain information may be collected automatically, including:

• IP address;
• browser type;
• device type;
• operating system;
• referring URLs;
• pages viewed;
• interactions with the Site;
• approximate geographic information derived from technical data;
• cookie identifiers; and
• analytics or advertising identifiers where permitted.

4. HEALTH AND SPECIAL-CATEGORY PERSONAL DATA

Some information submitted to SpineX may constitute data concerning health or other special-category personal data under applicable data-protection law.

This may include information contained in:

• X-rays;
• radiology reports;
• posture photographs;
• assessment videos;
• medical-history information;
• information concerning scoliosis, kyphosis, spinal surgery, pain, or symptoms;
• physical-function information; and
• other information capable of revealing information about physical health.

Where required by applicable law, SpineX will obtain explicit consent or rely on another lawful basis permitted by applicable law before processing such information.

Where processing is based on explicit consent, consent will be requested separately through an appropriate affirmative action, statement, checkbox, form, electronic confirmation, or other legally appropriate mechanism.

Providing health-related information may be necessary in order for SpineX to perform certain personalized assessments or training Services.

If information reasonably necessary for personalization is not provided, SpineX may be unable to provide some or all of the requested personalized Service.

5. WHY WE USE YOUR PERSONAL INFORMATION

Providing Purchased Services

We may use personal information to:

• process orders;
• confirm purchases;
• schedule assessments or consultations;
• provide digital products;
• perform online assessments;
• review submitted photographs and videos;
• review X-rays or other information supplied by the Client;
• prepare personalized exercise-based programs;
• provide individualized training instructions;
• review exercise technique;
• provide program updates;
• communicate with Clients and parents;
• provide customer support; and
• otherwise perform the Services purchased from SpineX.

Progress Monitoring and Program Personalization

Personalized SpineX programs may involve repeated progress assessments.

We may process assessment photographs, videos, measurements, questionnaire responses, exercise footage, and other progress information in order to:

• compare progress between assessment periods;
• understand how the participant has responded to the previous training period;
• review posture, movement, and exercise execution;
• identify information relevant to future program adjustments;
• prepare subsequent phases of a personalized program; and
• maintain continuity between assessment periods.

For multi-month programs, updated assessment materials may be requested periodically, including approximately every four weeks where applicable to the purchased program.

Information submitted for these assessments is processed for the delivery and personalization of the Service and is not automatically authorized for public or promotional use.

Business Administration and Records

We may process personal information where necessary to:

• maintain transaction and customer records;
• manage contracts;
• maintain evidence of consent;
• manage accounting and tax records;
• respond to legal claims;
• protect our legal rights;
• prevent misuse or fraud;
• enforce applicable contractual terms; and
• comply with legal obligations.

Site Operation and Improvement

We may use website and technical information to:

• operate the Site;
• maintain security;
• detect technical problems;
• understand how visitors use the Site;
• measure website performance;
• improve navigation and functionality; and
• develop and improve our Services.

6. LEGAL BASES FOR PROCESSING

Depending on the circumstances, SpineX may process personal information on one or more lawful bases available under applicable law.

These may include:

• Performance of a contract: where processing is necessary to provide a Service you purchased or requested.
• Legal obligations: where processing is necessary for accounting, tax, regulatory, consumer-protection, or other legal obligations.
• Legitimate interests: where permitted by law, including protecting our Services, maintaining appropriate business records, preventing fraud, and improving our operations.
• Consent: where you have voluntarily agreed to particular processing and consent is an appropriate legal basis.
• Explicit consent: where required for processing health data or other special-category personal information.

7. MARKETING COMMUNICATIONS

Where permitted by applicable law, SpineX may send marketing or promotional communications concerning SpineX products, Services, educational materials, offers, or updates.

Where consent is required, marketing communications will be sent only after the appropriate consent has been obtained.

You may unsubscribe from marketing communications using the unsubscribe mechanism provided in the communication or by contacting SpineX.

Unsubscribing from marketing communications does not prevent SpineX from sending transactional or service-related communications necessary to provide Services you have purchased.

8. PHOTOS, VIDEOS, TESTIMONIALS AND BEFORE-AND-AFTER MATERIAL

Photographs, videos, X-rays, progress comparisons, testimonials, measurements, or other materials supplied for assessment or program delivery are not automatically authorized for public marketing use.

Where SpineX wishes to use identifiable Client materials for advertising, social media, case studies, educational publications, testimonials, before-and-after comparisons, or other promotional purposes, SpineX may request separate authorization or consent where required by applicable law.

Marketing consent is separate from consent or authorization necessary to provide the purchased Service.

Refusing optional marketing consent does not prevent a person from purchasing or participating in a SpineX Service.

Where marketing consent is withdrawn, SpineX will stop new processing based on that consent to the extent required by applicable law. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

9. CHILDREN AND MINORS

SpineX Services may involve adolescents or other minors, including minors participating in scoliosis-related assessments or personalized programs.

Where Services concern a minor, personal information should be submitted by, or with the involvement and appropriate authorization of, the minor's parent or legal guardian.

A parent or legal guardian providing information concerning a minor confirms that they have appropriate authority to provide that information and to authorize processing where required by applicable law.

Where additional consent from the minor is legally required or appropriate, SpineX may request that consent separately.

10. HOW WE SHARE PERSONAL INFORMATION

SpineX may disclose personal information to service providers and other recipients where reasonably necessary to operate the Site, process transactions, communicate with Clients, provide Services, maintain records, protect our rights, or comply with applicable law.

Recipients may include:

• e-commerce and website infrastructure providers;
• payment processors;
• email and communication providers;
• cloud-storage or hosting providers;
• analytics providers;
• advertising providers where permitted;
• professional advisers such as accountants or legal advisers;
• technology and security providers;
• government authorities where legally required; and
• other processors necessary for delivery of the Services.

Service providers may process personal information only to the extent necessary for the relevant purpose and subject to applicable contractual and legal obligations.

11. SHOPIFY AND PAYMENT SERVICES

Our online store is operated using Shopify infrastructure.

Shopify and associated providers may process certain information relating to Site use, orders, transactions, security, and account activity in accordance with their own applicable privacy terms and responsibilities.

Payment transactions may also be processed by independent third-party payment providers. Those providers may process payment information directly and may act as independent controllers for certain processing activities.

12. COOKIES AND SIMILAR TECHNOLOGIES

SpineX and its service providers may use cookies, pixels, local storage, analytics technologies, and similar technologies to operate and secure the Site, remember preferences, understand Site usage, measure performance, and, where permitted, support advertising or marketing activities.

Where applicable law requires consent for non-essential cookies, those technologies will be used in accordance with the consent choices presented to the user.

Cookie preferences may be managed through the cookie-consent tools available on the Site where applicable.

13. AUTOMATED DECISION-MAKING

SpineX does not intend to make decisions producing legal or similarly significant effects concerning Clients solely through automated processing of health-related assessment data.

Personalized training decisions are based on information supplied to SpineX and reviewed as part of the service-delivery process.

14. DATA RETENTION

SpineX retains personal information only for as long as reasonably necessary for the purposes for which it was collected, including providing Services, maintaining appropriate business records, handling disputes, protecting legal rights, and satisfying tax, accounting, regulatory, or other legal obligations.

Different categories of information may be retained for different periods.

Factors considered when determining retention periods may include:

• the duration of the Client relationship;
• the nature of the Service purchased;
• whether the information is required for ongoing personalization;
• legal limitation periods;
• accounting and tax obligations;
• the sensitivity of the information;
• security considerations; and
• whether consent has been withdrawn.

When information is no longer reasonably required, it may be deleted, anonymized, or otherwise handled in accordance with applicable law.

15. SECURITY

SpineX uses reasonable administrative, technical, and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, loss, misuse, or destruction.

However, no electronic transmission or storage system can be guaranteed to be completely secure.

Clients should use appropriate care when transmitting sensitive information electronically and should notify SpineX if they believe their information has been compromised.

16. INTERNATIONAL DATA TRANSFERS

Some service providers used by SpineX may process personal information in countries outside Poland or the European Economic Area.

Where international transfers of personal information require safeguards under applicable data-protection law, SpineX or the relevant service provider may rely on mechanisms such as adequacy decisions, approved contractual safeguards, or other legally recognized transfer mechanisms.

17. YOUR DATA-PROTECTION RIGHTS

Depending on applicable law and the circumstances of the processing, you may have rights concerning your personal information, including the right to:

• request access to personal information concerning you;
• request correction of inaccurate or incomplete information;
• request deletion of personal information in applicable circumstances;
• request restriction of processing;
• object to certain processing;
• request data portability where applicable;
• withdraw consent where processing is based on consent;
• withdraw explicit consent where applicable;
• object to direct marketing; and
• lodge a complaint with the competent data-protection authority.

These rights are subject to applicable legal conditions and exceptions.

For example, a deletion request may not require SpineX to erase information that must lawfully be retained for accounting, legal claims, regulatory obligations, or another lawful purpose.

18. WITHDRAWAL OF CONSENT

Where processing is based on consent, you may withdraw that consent at any time by contacting SpineX.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Where information is necessary to provide an ongoing personalized Service, withdrawal of consent relating to that information may mean that SpineX is no longer able to continue some or all of the relevant Service.

Any contractual consequences of being unable to continue a Service are governed separately by the applicable Terms and Conditions and mandatory law.

19. ACCURACY OF INFORMATION

Clients are encouraged to ensure that personal information supplied to SpineX is accurate and current.

Where information relevant to an ongoing personalized program materially changes, Clients should provide updated information where necessary for the delivery of the Service.

Requests to correct inaccurate personal information may be submitted using the contact information below.

20. THIRD-PARTY WEBSITES AND SERVICES

The Site may contain links to websites or services operated by third parties.

SpineX is not responsible for the privacy practices of independent third-party websites or services. Users should review the privacy information provided by those third parties before providing personal information to them.

21. DATA-PROTECTION COMPLAINTS

If you have questions or concerns regarding the processing of your personal information, you may contact SpineX first so that we can review the matter.

You may also have the right to lodge a complaint with the competent supervisory authority under applicable data-protection law.

22. CONTACT INFORMATION

For privacy questions, requests, or exercise of applicable data-protection rights, contact:

SpineX
Marcina Kasprzaka 31
01-234 Warsaw
Poland
Email: contact@spinex.digital