Privacy policy

This policy explains what we do with the data of anyone who visits livemanagement.io. It covers two situations: simply visiting the site and writing to us through the form. If you are a patient of a clinic that uses our service, the clinic decides about your data: contact the clinic. If you write to us instead, do not include health data: we will pass your request on to the clinic, without forwarding your email to it, within two working days at most.

Version 1.1 · 8 October 2026

Who processes your data

LM Live Management, SLU
Tax number (NRT): L-722469-H · Commercial Register: 27372
Registered office: Xalet Torsa, Carretera de Beixalís, s/n, AD200 Encamp, Principat d'Andorra
Email: lluis.torres@livemanagement.io · Phone: +376 346744
Website: https://livemanagement.io

When you only visit the site

The site is served from our own server, and that server logs every visit, even if you fill nothing in. It records:

• Your full IP address, the date and the time.
• The page you request, the method, the response code and the bytes sent.
• The referring page and your browser and system (user-agent).

The log rotates daily and is deleted after 15 days at most. The legal basis is our legitimate interest in the security and proper operation of the service.

In addition, when you scroll down to the contact form — even if you never send it — your browser loads Cloudflare Turnstile, the anti-bot check, which receives your IP address and signals from your browser.

When you write to us through the form

Of what you fill in we keep your name, email address, company (optional) and message, together with the language, the date and time you accepted this policy and the date of your enquiry.

And, to stop bots using the form, we also process some signals you do not type: how long you take to fill it in, whether you filled a hidden field only a bot can see, and one record per attempt that reaches our checks — sent, duplicate, invalid, blocked, rate-limited or with a failed anti-bot check — with its time and a digest of your IP. That record is kept even if the submission never completes.

We use all of it to reply to you and, if the conversation goes further, to manage the possible business relationship. We do not build a profile of you and we do not use this data for advertising.

There is one automated decision, and you should know about it: the system decides on its own, without a person involved, whether your submission goes through or is blocked as a bot. If it blocks you by mistake, write to lluis.torres@livemanagement.io and we will handle it by hand.

The message is free text and reaches our system exactly as you write it. Please do not include health data, personal data about other people, or anything not needed to answer your enquiry.

On what legal basis

These are two distinct processing activities, each with its own basis:

• Answering your enquiry and the possible business relationship: the pre-contractual steps you ask for by writing to us. The box you tick is not the basis for the processing: it is the record that we informed you before you wrote. If you later want to receive commercial communications from us, that will run on your consent and you will be able to withdraw it at any time.
• The security of the site and the form — the server log, the anti-bot check, the submission limit and the record of attempts —: our legitimate interest in keeping the service working and not letting bots take it down. You may object, and we will consider your case.

What we do with your IP

In our database we do not store your IP as such: we store a digest computed with a secret key. We want to be exact about what that means: it is pseudonymised, not anonymous data, because whoever held that key could recompute it and link it to a particular address. We therefore treat it as personal data.

In our database, that digest is kept for at most 7 days: a scheduled task deletes it automatically every day. Backups keep it for longer: Supabase's automatic backups, 7 days from each backup; our own, encrypted, up to 60 days for the daily backups and up to 12 months and 10 days for the monthly archive. Backups are only used to restore the system.

Your full IP does appear in the server log described above (up to 15 days) and in the technical logs of Supabase, our database provider. It also reaches Cloudflare: during the anti-bot check, when you submit the form and when our system validates the result of that check.

Who else sees it

• Hetzner Online GmbH, where our server is hosted, in Falkenstein (Germany). It receives the data of every visit, not only of those who write: it is the server that serves the pages. In its backup storage, also in the EU, we keep the backups of our database, encrypted.
• Cloudflare, for the anti-bot check, from the moment you scroll to the form, and for routing our email.
• Supabase, where our database lives, in its eu-west-1 region (Ireland). When you submit the form, your browser sends the data to Supabase through Cloudflare's network, which Supabase uses as a provider.
• Apple (iCloud), where email sent to our contact address is received: whatever you write to that address passes through Cloudflare before reaching our iCloud mailbox.
• Telegram, where we receive an internal alert that a new enquiry has arrived. The alert carries no data about you, not even an identifier.

We do not sell your data and we do not pass it to anyone for commercial purposes.

International transfers

Andorra is not part of the European Union (EU) or of the European Economic Area, so sending data to these providers is an international transfer.

• Hetzner Online GmbH (the server, in Falkenstein, Germany; the backups, in Helsinki, Finland) stores the data in the EU. Supabase Pte. Ltd. (Singapore) keeps our database in its Ireland region (EU); transfers to its Singapore entity are covered by the standard contractual clauses in its data processing agreement; where it stores its technical logs is still to be checked, and the function that receives the form runs in the Supabase region closest to the sender, which may be outside the EU. The EU is a destination with an adequate level of protection (article 43.2 of Andorran Law 29/2021).
• Cloudflare, Inc. (United States) participates in the EU-U.S. Data Privacy Framework. The APDA lists that framework among the adequate destinations and warns that its redress mechanisms do not extend to Andorran citizens. The framework covers data leaving the EU: applying it to data leaving Andorra is our own reading. Cloudflare receives your IP and data about your browser and your connection during the anti-bot check (to improve that service, it processes them as a controller in its own right); what you send through the form, because Supabase uses its network; and any email you write to us, which passes in full through its forwarding service; of that email, our dashboard shows the sender, the recipient and the subject for 31 days.
• We receive email in iCloud, an Apple service, under its terms for individual users and without a data processing agreement. Apple Distribution International Ltd. is in Ireland (EU), a destination with an adequate level of protection, although Apple states that it stores the data mainly in the United States, and the encryption keys in its US data centres. Apple receives every email you write to us and our replies.
• Telegram receives no data about you: the alert for a new enquiry carries none.

This analysis is our own, dated 1 October 2026, and is pending legal review. You can check Cloudflare's entry in the Data Privacy Framework and the iCloud terms.

How long we keep it

• Server log: at most 15 days.
• Digest of the IP from the form: at most 7 days in our database; in backups, the periods below.
• Your enquiry and your contact details: 1 year from your enquiry. If we sign a contract, its periods apply. Once deleted, they may remain in backups until those expire (periods below).
• Database backups: 7 days for Supabase's automatic backups; up to 60 days for our daily backups, encrypted; up to 12 months and 10 days for the monthly archive, encrypted. They are only used to restore the system.
• Supabase technical logs: we can consult them for 7 days; how long Supabase keeps them is set by its service.
• Email data in the Cloudflare dashboard (sender, recipient and subject): 31 days.
• Email you write to us: we keep it in our mailbox for as long as we need it to deal with your enquiry; we do not yet have automatic deletion.

Cookies

This site sets no cookies of its own and uses no analytics or advertising tools. The only third-party component loaded in your browser is Cloudflare Turnstile, the form's anti-bot check, which may set a technical cookie needed to verify that you are not a bot.

Your rights

You may ask us for access to your data, its rectification, its erasure, the restriction of its processing, to object to it, and for the portability of what you gave us. You may also ask not to be subject to automated decisions and withdraw your consent, which does not affect what we did with it before.

Write to lluis.torres@livemanagement.io and tell us which right you want to exercise. If we have reasonable doubts about your identity, we will ask you for what is needed to confirm it. While our domain cannot send email, the reply will come from lluis.torres@icloud.com, our iCloud account: that way you will know it is us.

We will reply within one month, counted from the day after we receive your request. If it is complex, we may extend that period by two further months; we will tell you so, with the reason, within the first month. If we cannot grant your request, we will still reply and tell you why, and what you can do next. Whatever we erase remains in the backups until they expire.

If you believe we have not handled it properly, you may complain to the Andorran Data Protection Authority (APDA): www.apda.ad.

Changes

If we change this policy we will publish the new version here with its date, and this page will always show the one in force. This is version 1.1, of 8 October 2026.