Privacy Policy
Last updated: 12 October 2026
1. Who we are
The Motion Protocol is a physiotherapist-led online exercise brand. Our programs are created and presented by Aida, a physiotherapist with over 10 years of clinical experience, and sold through themotionprotocol.com.
The Motion Protocol is operated by the data controller responsible for your personal data:
Ajda Mlakar s.p. (sole trader)
Šentiljska cesta 37c, 2000 Maribor, Slovenia
Tax number: 46726080
Email: [email protected]
In this policy, "we", "us" and "our" mean Ajda Mlakar s.p. trading as The Motion Protocol. This policy explains what personal data we collect when you visit our website, sign up for a free routine, message us on Instagram or Facebook, buy a product, or read our emails, and what we do with it.
2. Information we collect
|
Where it comes from |
What we collect |
|---|---|
|
Free routine sign-up (website form, Facebook or Instagram lead form) |
First name, email address and country |
|
Instagram and Facebook messages (including automated replies when you comment a keyword on our posts) |
Your username, profile name, profile picture, the message or comment you send, and when it was sent |
|
Purchases |
Name, email, billing address, country, what you bought and when. Card and PayPal details go straight to Stripe or PayPal; we never see or store your full card number |
|
Program use |
Login details, which lessons you open or complete, and your progress inside the course platform |
|
Emails we send |
Whether you opened an email or clicked a link, and your subscription status |
|
Contact and support |
Whatever you choose to write when you email or message us |
|
Website visits |
IP address, device and browser type, pages visited, referring site, and cookie identifiers (see section 7) |
We do not ask about your symptoms, medical conditions or medical history, and we ask you not to send us medical records, scans or diagnoses.
3. Health-related information
We do not ask you about your health. However, because our products focus on lower-back pain, the fact that you signed up for, viewed or bought one of our back programs may suggest something about your health. Under EU and UK law this can be "special category data", and in some US states (including Washington, Nevada and Connecticut) it can be "consumer health data".
We handle it as follows:
- We use it only to deliver the content you asked for, run your account, and measure our advertising as described in section 7.
- Our advertising and analytics tools only run after you accept them in the cookie banner. That consent covers the advertising data described in section 7, and you can withdraw it at any time.
- We never sell this information.
- If you choose to tell us about your health in an email or message, we use it only to reply to you and then delete it (section 8).
- You can ask us to delete any of it at any time (section 9).
4. How we use your information and our legal basis
|
Purpose |
Legal basis (EU/UK GDPR) |
|---|---|
|
Sending the free routine you requested and the follow-up emails promised at sign-up |
Consent |
|
Selling and delivering guides and programs, giving you course access, handling refunds under our 14-day guarantee |
Performance of a contract |
|
Answering your emails and messages |
Legitimate interests (responding to you) |
|
Sending marketing emails about our other products |
Consent (unsubscribe in any email) |
|
Website analytics (Google Analytics 4) and advertising measurement (Meta pixel) |
Consent, given through the cookie banner |
|
Keeping invoices and accounting records |
Legal obligation |
|
Preventing fraud and protecting our legal rights |
Legitimate interests |
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our automated Instagram and Facebook replies only send you the content you asked for.
5. Who we share it with
We do not sell your personal data. We share it only with service providers who help us run the business, under contracts that limit their use of it:
|
Provider |
What they do for us |
Location |
|---|---|---|
|
Kajabi |
Website hosting, course delivery, checkout, email marketing |
United States |
|
Stripe |
Card payment processing |
Ireland / United States |
|
PayPal |
PayPal payment processing |
Luxembourg / United States |
|
ManyChat |
Automated Instagram and Facebook message replies |
United States |
|
Meta Platforms (Instagram, Facebook) |
Social media, lead forms, Meta pixel advertising measurement |
Ireland / United States |
|
Google (Google Analytics 4) |
Website analytics |
Ireland / United States |
|
Our accountant |
Bookkeeping and tax filing |
Slovenia |
Stripe and PayPal act as independent controllers for payment and fraud-prevention data under their own privacy policies. When you message us on Instagram or Facebook, or submit a Facebook lead form, Meta also processes that data under its own privacy policy, and Meta and we are joint controllers for certain page insights and pixel data.
We may also disclose information if the law requires it, or to a buyer if the business is sold, in which case this policy continues to apply.
6. International transfers
Several of our providers are based in the United States, so your data may be transferred outside the EU, UK and Australia. Where that happens we rely on the EU-US Data Privacy Framework (and its UK extension) where the provider is certified, or on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. You can ask us for a copy of the safeguards that apply.
7. Cookies, the Meta pixel and analytics
We use three kinds of cookies and similar technologies:
- Essential — needed for login, checkout, security and remembering your cookie choice. These are always on.
- Analytics — Google Analytics 4 tells us which pages people visit and how they find us, so we can improve the site. Only set if you accept them.
- Advertising — the Meta pixel lets us measure whether our Instagram and Facebook ads lead to sign-ups and purchases, and show our ads to people likely to be interested. Only set if you accept them.
If you accept advertising cookies, the Meta pixel runs on our website, including our program sales pages and checkout. It sends Meta the pages you visit, actions such as signing up or buying, the product and its price, and technical identifiers such as your IP address and browser details. Because our programs focus on lower-back pain, this can tell Meta you showed interest in a back-pain product. Meta may combine it with your Instagram or Facebook account. We never send Meta the content of your emails or messages.
You can accept or decline analytics and advertising cookies in the cookie banner. To change your choice later, clear this website's cookies in your browser and the banner will appear again, or email us. You can also control ad personalisation in your Instagram and Facebook ad settings, and opt out of Google Analytics with Google's browser add-on.
8. How long we keep it
|
Data |
How long we keep it |
|---|---|
|
Email list data |
Until you unsubscribe or ask us to delete it |
|
Customer and course access data |
For as long as you have access to the program (lifetime access), or until you ask us to close your account |
|
Invoices and accounting records |
10 years, as required by Slovenian tax law |
|
Instagram and Facebook messages |
For as long as we need them to keep track of our conversation with you, or until you ask us to delete them |
|
Anything you tell us about your health |
Deleted once we have replied, and no later than 12 months |
|
Google Analytics 4 data |
Up to 14 months |
|
Analytics and advertising cookies on your device |
Up to 2 years, or until you clear them |
9. Your rights
Wherever you live, you can email [email protected] to:
- see the personal data we hold about you and get a copy
- correct anything that is wrong
- have your data deleted
- withdraw any consent you gave, including for emails and cookies
- object to or restrict how we use your data
- receive your data in a portable format
We reply within one month (EU and UK) or 45 days (US states), and we may need to confirm your identity first. There is no charge.
EU and UK residents can also complain to a data protection authority. Our lead authority is the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec, Dunajska cesta 22, 1000 Ljubljana, ip-rs.si). You can also complain to the authority in your own country; in the UK that is the Information Commissioner's Office (ico.org.uk).
US residents, depending on your state, also have the right to opt out of targeted advertising, to withdraw consent for the collection or sharing of consumer health data, and to appeal if we refuse a request. To opt out of targeted advertising, decline advertising cookies in the banner or email us. To appeal a decision, reply to it with "Appeal" in the subject line. We do not sell personal data or consumer health data, and we will never treat you differently for using your rights.
Australian residents can make a complaint to us first, and if unresolved, to the Office of the Australian Information Commissioner (oaic.gov.au).
10. Emails and messages
When you sign up for a free routine, you agree to receive that routine plus emails with exercise tips and offers for our guides and programs. Every email has an unsubscribe link, and unsubscribing takes effect immediately.
When you comment a keyword on one of our posts or Reels, our automated system sends you a direct message with the content you asked for. To stop these messages, reply STOP or unsubscribe through the menu in the chat.
Customers will still receive emails needed to deliver what they bought, such as receipts and login details, even after unsubscribing from marketing.
11. Security, children and other points
Security. We use established providers with encrypted connections, and protect our accounts with strong passwords and two-factor authentication, and we limit access to your data to the people who need it. No system is perfectly secure; if a breach puts your rights at risk, we will tell you and the relevant authority as the law requires.
Children. Our products are for adults. We do not knowingly collect data from anyone under 16 (under 13 in the US). If you believe a child has given us their data, contact us and we will delete it.
Not a medical relationship. Using our free content or programs does not create a physiotherapist-patient relationship. Our content is general exercise education, not a diagnosis or treatment plan.
Changes. We will update this policy when our practices change and show the new date at the top. If a change is significant, we will email customers and subscribers before it takes effect.
Contact. For questions about this policy or your data, email [email protected] or write to Ajda Mlakar s.p., Šentiljska cesta 37c, 2000 Maribor, Slovenia.
