Privacy notice

Your details, handled with care.

This notice explains what Vitality One collects when you book or contact us, why we use it, who helps us process it and the choices you have.

Effective 2 September 2026

Who is responsible

Vitality One is responsible for the personal information described here. The operational contact is Kim Thi Ly Chalakova at The George – Urban Boutique Hotel, Lobby -1, Triq Paceville, St Julian’s, STJ 3103, Malta.

Email vitalityspainmalta@gmail.com or call +356 7988 0210 with a privacy question or request.

Information we use

Bookings: your name, email address, phone number, chosen treatment, appointment time, assigned team member and any optional note.
Treatment safety: for a treatment that requires intake, you may provide allergies or skin conditions and pregnancy information. This is health information and is stored separately from the ordinary booking record.
Security: a one-way hash derived from the requesting network address is used to limit repeated booking and sign-in attempts. We do not use it to advertise to you.
Staff services: authorised staff accounts, session records and an optional browser push subscription are used to operate the private admin area.

Why we use it

To offer times, create and manage the appointment you request.
To send confirmation, management and cancellation messages.
To contact you about a change, delay or operational issue affecting your visit.
To keep the booking service and private staff area secure and reliable.
To maintain necessary business records and respond to a dispute or legal duty.

Booking administration is necessary to take steps at your request and provide the appointment. Service security and proportionate operational records are used for Vitality One's legitimate interests. Where health information is requested, it is processed only after your explicit consent for safe treatment planning.

How long we keep it

Health intake answers carry a deletion date of 24 months and are removed by a scheduled retention process.
A booking-management link expires 90 days after the appointment ends. The link token is stored only as a one-way hash.
Booking and contact records are kept only while needed to administer appointment history, resolve queries or disputes and meet applicable record-keeping duties.
Staff sessions expire after 12 hours and can be revoked immediately by signing out or deactivating the account.

Cookies and staff push notifications

The public booking site does not use advertising or analytics cookies. We therefore do not show a cookie-consent banner.

When an authorised staff member signs in, the site sets one strictly necessary cookie named vo_staff_session. It keeps the private admin area signed in, is unavailable to page scripts, is sent only over HTTPS in production and expires with the 12-hour staff session. It is removed from the browser on sign-out and the server-side session is revoked.

Staff Web Push is optional. The browser asks for notification permission only after a staff member chooses to enable it. A booking alert contains the treatment, Malta time, assigned team member and booking reference, but no guest name, contact details, notes or health information. Staff can disable notifications in the admin area or in their device settings.

Your rights

Depending on the circumstances, you may ask to access, correct, erase, restrict or receive your information, or object to processing based on legitimate interests. You may withdraw health-data consent at any time. Withdrawal does not affect earlier lawful use, but it may mean a treatment cannot safely proceed.

Changes to this notice

We will update the effective date and this page before materially changing how the website uses personal information, cookies or tracking technology.

Return to Vitality One Choose a time