Your personal data: two consents, an export and a deletion
What the portal keeps about you, who else sees it, how to take it all away in one file and how to delete it. With buttons in the account, not a letter to the hotel.
The hotel's privacy policy will not do for the portal: it has no health data in it, no account and no wearable devices. So the portal has its own — twelve sections at `#/privacy`, in every interface language.
The controller is named, with its registration details and address; there is a separate mailbox for data questions; and the server stands in Germany, that is, in the EU.
The portal's policy: twelve sections, open without signing in×
There are two consents, and that is not a formality
The first is general, at sign-up. The second is explicit, for the processing of health data, and it is asked for before the questionnaire.
They had to be separated because health data is a special category: for it, «agreeing to the terms» at sign-up is not legally enough.
Both consents are recorded with the policy's version number. When the policy changes in substance — as it did when the scales in the room and body composition were added — the version goes up and the portal asks everybody again. That is the «one thing before we carry on» window that stands over any screen.
«My data»: four buttons
The «Account» page has a «My data» block, and the rights the regulation grants are implemented as buttons, not as an e-mail address.
Export — everything there is about you, in one file.
HL7 FHIR export — the same thing in the language of medical systems: a patient and observations with LOINC codes. A hospital system can read that file, not only a person.
Withdraw consent — together with the deletion of health data.
Delete the account — all of it.
«My data»: export, withdrawal of consent, deletion×
What is erased and what stays
Erasure has two depths, and the difference is said out loud. Health data — nights, walks, prescriptions, weigh-ins, staff notes about you, doctor's messages addressed to you personally. The account — all of that plus the way in.
What stays are the records the house made about itself: the journal of kit handovers, the log of staff opening a guest's account, house-wide announcements. That is not your personal data but the hotel's memory of its own actions.
Separately: «Erase all records» at the desk is not the same thing. It clears the kit and its Garmin account so the next guest does not meet somebody else's nights, and it does not touch your account (more).
Who else sees your screens
The staff can open «the guest's account» — the same pages through your eyes. For a doctor this is read-only: any attempt to write in such a session is refused by the server, not merely hidden in the interface.
Every such entry is written to a log: who, and when. The log is the hotel's record about itself, so it survives the erasure of health data and goes with the account.
Staff notes about a guest are the opposite: they are written about you, and they are erased with the health data.
How this works for a person
You are leaving and want to take everything with you — «Export», and the file is on your phone. You want to give it to your doctor at home — «HL7 FHIR export», and their system will read it. You want the hotel to forget you — «Delete the account», and there is nobody to ask.
What reception does
The desk does not delete a guest's data or export it: those are your buttons. It does something else — it wipes the kit when it is handed to the next guest, always and automatically (why).
