Legal

Privacy Policy

Last updated: 25 October 2026

Last updated: 31 October 2026

1. Who is responsible

PBG POOLHEALTH LTD (reg. no. HE 497335), Georgiou Karaiskaki 7, 8560 Pegeia, Paphos, Cyprus, email info@pool-health.com, runs PoolHealth (“the Service”). This policy explains what personal data is processed, why, and for how long. Who decides depends on the data:

We are the controller for: your own account (name, e-mail, sign-in), subscriptions and payments, security and abuse prevention, support, the activity date used for the inactivity rule, service e-mails, and withdrawal statements.
A specialist or business is the controller for the data they enter about their clients, pools and visits (names, contacts, addresses, readings, visit reports, photos, messages, invoices) and for enquiries received through their public page. We process that data on their behalf and on their instructions, under our Data Processing Agreement with them.
An Owner who records their own pool is the controller for anything they enter about other people (for example household members, guests, staff or contractors), and we process that data on the Owner's behalf under the same Data Processing Agreement. If the Owner acts purely for personal or household purposes, data protection law may not apply to the Owner for that data, but we still handle it only as the Data Processing Agreement says. For the Owner's own account data we are the controller.

If you are a client of a specialist, please contact them first about your data. If you write to us, we pass your request on and help them answer it.

2. What data is processed

Account: name, e-mail, phone (if given), role, language, a password protected by our sign-in provider (we never see it in clear text); if you turn on two-step sign-in, the secret key of your authenticator app, also kept by our sign-in provider. If you sign in with Google: the name, e-mail address and Google account ID that Google sends us.
Clients and pools: names, contact details, pool addresses or location links, pool and equipment details, water readings, visit reports, photos, notes, tasks, messages, quotes, contracts and invoices.
Billing: Stripe customer and subscription identifiers, plan, status and payment history. Card details are handled by Stripe and never stored by us.
Activity: when the app was last opened (only for the 12-month inactivity rule); if you withdraw from a contract, your withdrawal statement and its date and time.
Public page: the page content and enquiries (name, e-mail and/or phone, location and message the visitor chooses to send).
Support: messages you send us and our replies.
Reports about public pages: the reporter's name and e-mail, the page, the reason and explanation, and our decision.
Technical: IP address, browser and device type, sign-in and server logs needed to run and secure the Service; a push-notification address if you switch notifications on.

3. Why, and on what legal basis

The legal bases listed below apply to processing for which PBG POOLHEALTH LTD acts as controller. Where we process personal data on behalf of an Owner, Specialist or Business (for example the records of their clients), that customer is responsible for determining and documenting the legal basis, and we process the data only on their documented instructions and under the Data Processing Agreement.

To provide the Service, run your account and subscription and send service e-mails (confirmation, password reset, payment, withdrawal confirmation, inactivity warnings) — performance of a contract (GDPR Art. 6(1)(b)).
To keep invoices and payment records, and to handle reports about public pages and tell the people concerned about our decision under the EU Digital Services Act — legal obligations (Art. 6(1)(c)). Keeping the report file after the decision, to deal with complaints and legal claims, is based on our legitimate interests (Art. 6(1)(f)).
To keep the Service secure, prevent abuse, keep logs, answer support requests and defend legal claims — our legitimate interests (Art. 6(1)(f)).
To register your device for push notifications and send them (new visits, messages, tasks) — performance of a contract (Art. 6(1)(b)): notifications are a feature of the Service that you switch on yourself; the browser's permission prompt only controls access to your device, it is not a consent we rely on under the GDPR. You can switch them off at any time; we do not send marketing through them.

We do not sell personal data, do not use the data you or your clients enter for our own statistics, analysis or product research, do not use it for advertising and do not send marketing e-mails without your consent.

4. Who we share it with

We use the providers listed below to operate the Service. Their roles differ: some process personal data on our behalf under data processing agreements, while others may receive data directly from your browser or act as independent controllers, as explained below:

Supabase Pte. Ltd. (Singapore) — database, sign-in, file and photo storage and server functions. Our project and its backups are hosted in Germany (EU); Supabase and its sub-processors may access data from outside the EU, for example for support and operations. Safeguard: the EU standard contractual clauses (Commission Decision 2021/914) in Supabase's data processing addendum.
Netlify, Inc. (USA) — hosting of the website and app. Safeguard: Netlify, Inc. is certified under the EU–US Data Privacy Framework; its data processing agreement adds the EU standard contractual clauses if that framework stops applying.
Stripe (Stripe Payments Europe, Limited, Ireland, and its affiliates) — payments and subscriptions. Stripe also acts as an independent controller for its own purposes, such as fraud prevention and legal compliance, under its own privacy policy.
Plus Five Five, Inc., trading as Resend (USA) — sending e-mails. Safeguard: the EU–US Data Privacy Framework, under which the company is certified, and the EU standard contractual clauses in its data processing addendum.
Push services of your browser or phone, only if you switch notifications on: Google (Chrome and Android), Apple (Safari, iPhone and iPad), Microsoft (Edge on Windows) or Mozilla (Firefox), depending on the browser you use. Your browser chooses the service and gives us an address there; we send each notification to that address with its content encrypted end to end (the Web Push standard, RFC 8291), so the push service cannot read the text. Not encrypted, and visible to the push service: the address it issued for your device, the time and size of the message, how long it may wait for delivery and its urgency, our server's network address, and our public application key with our contact e-mail address. The push service is chosen by your browser and run by its maker for you under their own terms, possibly outside the EU; we cannot choose it or agree terms with it, so we do not treat it as our sub-processor, and we list it here so that you know about it. The app works fully with notifications off.
OpenStreetMap Foundation (United Kingdom) — map tiles. When a map is shown, your browser requests the tiles from OpenStreetMap directly, so your IP address and the map area you look at reach it; we send it no other data, and it does not act on our instructions, so we do not treat it as our sub-processor (it keeps its own server logs under its own policy). Safeguard: the EU adequacy decision for the United Kingdom (renewed in 2025).
Google Ireland Limited (Ireland) — only if you choose “Continue with Google”: Google confirms your identity to us and sends us your name, e-mail address and Google account ID; Google learns that you sign in to PoolHealth. Google acts as a separate controller under its own privacy policy, not as our processor. You can always sign in with e-mail and password instead.

Fonts and the map library are served from our own site. Within the Service, data is visible only to the people who need it: a client sees their own pools, a specialist their own clients, a business its team. We may also disclose data to professional advisers under confidentiality, or to authorities when the law requires it. The current list of providers is available at info@pool-health.com, and professional users are told about changes in advance as set out in the Data Processing Agreement.

5. Transfers outside the EU/EEA

Where a provider above handles data outside the EU/EEA, the transfer relies on the safeguard named next to it: an adequacy decision (including the EU–US Data Privacy Framework for certified US companies) or the European Commission's standard contractual clauses. You can ask us for a copy of the relevant safeguards at info@pool-health.com.

6. How long we keep it

Account data: while the account exists. When you close the account it is deleted 14 days later (or within 24 hours if you choose to delete at once; database backups are cleared within 30 days; photos and files are not in backups); after 12 months of inactivity (with e-mails 30 and 7 days before) if the account is not paid up.
Client, pool and visit data, photos and messages: for as long as the specialist, business or owner who holds them keeps them in their account; they are deleted when that specialist, business or owner account is deleted, or earlier if they delete them. Deleting a client's own login does not delete these records.
Deleted visits: kept in the pool's trash for 14 days with their readings and photos, so that a visit deleted by mistake can be restored, and then erased (photos included); a visit deleted together with its pool, client or account is erased at once.
Public page enquiries: until the receiving specialist or business deletes them or their account.
Invoices and other records we must keep for tax, VAT and accounting purposes: for the period Cyprus law requires for each type of record. Other payment data (for example Stripe identifiers and payment history): while the account exists and afterwards only as long as needed for refunds, disputes and legal claims.
Reports about public pages: while we handle them, and afterwards up to three years after our decision (our legitimate interest in dealing with complaints and legal claims; this period is our choice, not a legal requirement).
Withdrawal statements: for six years after the withdrawal, as evidence in case of a dispute.
Server and sign-in logs: up to 90 days. Database backups: deleted records disappear from them within 30 days; photos and files are not part of backups.
Push-notification addresses: until you switch notifications off or the address stops working.

7. Your rights

You have the right to access your data, correct it, have it erased, restrict or object to its processing, receive it in a portable format, and withdraw any consent you have given. You can download your data in My profile at any time, or write to info@pool-health.com. A request to erase your data does not wait for the 14-day period of account closing (see the Terms, section 12). We answer within one month; for complex or numerous requests this can be extended by up to two further months, and we will tell you if so.

For data a specialist or business keeps about you, they decide on your request; if you write to us, we pass it on and assist them. You can also complain to the data protection authority: in Cyprus, the Office of the Commissioner for Personal Data Protection (dataprotection.gov.cy), or the authority in your country of residence.

8. Security and incidents

The Service uses encrypted connections (HTTPS), encryption of stored data by our hosting provider, database access rules (row-level security) that let each account see only the data it is allowed to see, and administrative access limited to the company's authorised personnel. No system is perfectly secure.

If a personal data breach happens, we notify the data protection authority within 72 hours of becoming aware of it where the law requires, and inform the people affected without undue delay when the breach is likely to result in a high risk to them. Where we act as processor, we inform the account holder concerned (specialist, business or Owner) without undue delay so that they can meet their own obligations.

9. Storage on your device

The Service sets no cookies and uses no advertising, analytics or other tracking. The app keeps only the following in your browser's local storage, session storage and offline storage:

Your sign-in session (in session storage instead, if you untick “Keep me signed in”) and that choice.
Settings you choose: language, screen brightness, report periods, hidden hints, and which “What's new” you have already seen.
For working without internet: a copy of the data you can see from about the last two months, changes waiting to be sent, unsent visit drafts, the app's files, fonts, map tiles and photos you opened, and the housekeeping record the app keeps of these copies.

We checked each item against the EU ePrivacy rules (Article 5(3) of Directive 2002/58/EC and the Cyprus law that implements it). Your sign-in session, the data copy, waiting changes, visit drafts, and the app's files, fonts, map tiles and photos are strictly necessary to give you the service you asked for — signing in and working, also without internet — and need no consent. Your chosen settings and the record of hints and “What's new” you dismissed only remember your own choices for your own use; they are not read for any other purpose and never leave your device. We use nothing for statistics, advertising or tracking, so the app shows no consent banner. Signing out removes the data copy, visit drafts and cached photos from the device; changes not yet sent are kept until you sign in again, so your work is not lost. If we ever add storage or technology that needs consent, we will ask for it before using it. Notifications are used only if you allow them in your browser. When you go to pay or to manage your subscription, you leave the app: those pages are run by Stripe, which may use its own cookies under its own privacy policy.

10. Children

The Service is for adults (18+), and client accounts may be created only for adults. We do not knowingly collect children's data. Specialists should not enter information about children into client records beyond what is strictly necessary to look after the pool.

11. Changes

We may update this policy. We tell you about a material change by e-mail or in the app before it applies. The date at the top shows the latest version.

12. Contact

PBG POOLHEALTH LTD, reg. no. HE 497335, Georgiou Karaiskaki 7, 8560 Pegeia, Paphos, Cyprus. Email: info@pool-health.com.

This policy is available in English only. The other language versions of the app are made with the help of machine translation and may contain errors; if you notice one, please write to info@pool-health.com.