Privacy policy

1. Controller

• Controller / legal name: Jaume Domenech
• Service brand: Meridiania
• Canonical URL: https://meridiania.net
• Public brand association: Jaimia (https://jaimia.es)

To exercise rights or ask privacy questions, use the contact form at /contact.

2. Scope

This policy covers processing from browsing and using meridiania.net, account registration, community and directories, the LMS campus (if used), contact messages, and cookies/similar technologies.

Meridiania is an educational TCM/shiatsu/acupuncture platform. It is not a healthcare service or clinical record. Practice/patient notes stored by a user are private to their account; they are not indexed or published.

3. Categories of data

• Identity and account: name or alias, email, credentials (hash), language, optional photo/avatar.
• Optional public profile (teachers/therapists): bio, city, contact channels only if enabled (opt-in).
• Service use: preferences, study progress, content you publish.
• Practice notes / patient labels: user-entered text, private to the account.
• LMS campus: enrolment, submissions, calendar and classroom messaging as configured by the school.
• Contact form: name, email, subject and message.
• Technical: IP, user-agent, security logs, cookies and local identifiers per consent.
• School/association/event directory: professional data provided and verified by the submitter.

We do not request special-category (health) data as a purpose of the service. If a user writes health data in private notes, they do so under their own responsibility; we treat it only as private account content with reasonable security.

4. Purposes and legal bases

• Providing the educational service and account — contract / pre-contractual steps (Art. 6(1)(b) GDPR).
• Security, abuse prevention and technical maintenance — legitimate interests (Art. 6(1)(f)).
• Legal obligations — Art. 6(1)(c).
• Responding to contact form queries — legitimate interests / pre-contractual steps.
• Necessary cookies — legitimate interests / technical necessity.
• Personalisation and analytics cookies (if enabled) — consent (Art. 6(1)(a)), withdrawable at any time.
• Public directories or profiles — consent / performance of the relationship with the profile holder, with per-channel opt-in.
• LMS campus — performance of the relationship with the school and enrolled users.

5. Recipients and processors

We do not sell personal data. We may disclose data to:

• Technical providers (hosting, transactional email, CDN, authentication) acting as processors under Art. 28 contracts.
• Analytics tools (e.g. Matomo / Google Analytics) only if you consented to analytics.
• Public authorities when legally required.
• Other users, only information you make public.
• Campus schools: data needed for the private classroom; the campus is not publicly indexed.

6. International transfers

If a provider processes data outside the EEA, appropriate safeguards will apply (adequacy decision, EU Standard Contractual Clauses or equivalent). Processor details can be requested via the legal contact email.

7. Retention

• Account and related content: while the account is active and, after deletion request, the time needed to complete deletion.
• Security and technical logs: the minimum needed, except for incident investigation.
• Contact messages: enquiry handling time and applicable legal periods.
• Cookies: according to type and your choice.
• Legal obligations / claims: applicable limitation periods.

8. Your rights

You may exercise access, rectification, erasure, objection, restriction and portability rights where applicable, and withdraw consent without affecting prior lawful processing.

• From your profile (if you have an account): data export and account deletion request.
• Cookie preferences: banner / consent manager at any time.
• Via the contact form at /contact, proving identity when needed.

You may also lodge a complaint with the Spanish Data Protection Agency (AEPD): https://www.aepd.es

9. Cookies and similar technologies

• Necessary: store your consent choice and basic service operation (session, security).
• Personalisation (optional): language, theme and last section, if allowed.
• Analytics (optional): aggregated/anonymous or pseudonymised usage metrics to improve the Site, without third-party advertising.

You may accept necessary only, customise, or revoke consent at any time via the cookie banner.

10. Children

The service is not directed at children under 14 (Spanish digital-consent threshold, unless a stricter rule applies). Accounts below that age without an adequate basis will be blocked or deleted.

11. Security

We apply reasonable technical and organisational measures (HTTPS, access control, private-area segregation, minimisation). No system is fully invulnerable; security breaches posing a risk will be notified under Arts. 33–34 GDPR where required.

12. Directories and public contacts

Schools, associations and events may show professional contact after verification and an authorisation statement. Person profiles show email, phone, WhatsApp or address only if the holder enables each channel (opt-in). You can hide them or request deletion from the profile. Leaving for WhatsApp/Meta or other networks means those services’ policies apply.

13. Changes

We may update this policy to reflect legal or service changes. The current version is the one published on the Site with its date. Material changes will be signalled reasonably where practicable.