Privacy Policy

DexaFit Bucharest

Last Modified: August 30, 2026

1. Introduction

This Privacy Policy explains the practices of DexaFit Bucharest SRL ("DexaFit Bucharest," "we," "us," or "our") regarding the collection, use, protection, and disclosure of personal data in connection with the general wellness services we provide at our location and the websites, scheduling tools, intake forms, and other interactive features we make available that link to this Privacy Policy (collectively, our "Services").

Who we are (please read). DexaFit Bucharest SRL is an independently owned and operated business. We license the DexaFit® trademark and use the DexaFit software platform under license from DexaFit, Inc. and its subsidiaries and affiliates (collectively, "DexaFit, Inc." or "DexaFit Corporate"). DexaFit Bucharest SRL is not owned, operated, managed, controlled, staffed, or supervised by DexaFit, Inc., and DexaFit, Inc. is not responsible for the services, equipment, premises, personnel, or conduct at our location. We are what DexaFit, Inc.'s materials refer to as a "Licensed Operator." Section 2 explains this relationship and what it means for your data.

What we do at our location. We provide in-person general wellness assessments, which may include DEXA body composition scans, Resting Metabolic Rate (RMR) assessments, Red Light Therapy, and VO2 Max (cardiorespiratory) testing. We refer to the set of these assessments as our Tests. To deliver your results, we capture your assessment data and transmit it to the DexaFit software platform (including the DexaFit Operator and DexaFit ai applications) operated by DexaFit, Inc., which generates your reports. We then deliver your results to you, including by email. Sections 8 and 10 describe this data flow and the international transfer it involves in detail.

Physician oversight (please read). Certain of our wellness assessments are made available under the general oversight of a licensed physician who serves as our medical director, whose role is limited to reviewing and authorizing the appropriateness of assessments (including those that involve low-dose imaging) as required by applicable law. This oversight is administrative and authorizing in nature. It does not constitute the practice of medicine, the provision of medical care, diagnosis, or treatment, and it does not create a physician-patient or treatment relationship. Our assessments, reports, scores, and insights are general wellness information and are not medical records. See Section 20.

General Wellness Disclaimer. Our Services are general wellness offerings intended to support your overall health and wellness. They are not designed or intended to diagnose, treat, cure, mitigate, or prevent any disease or medical condition. Our assessments, reports, scores, and insights are educational and are not medical advice and not a substitute for care from a qualified healthcare provider. Always consult your physician before making decisions about your health, fitness, nutrition, or exercise.

EMERGENCY NOTICE: IF YOU ARE EXPERIENCING A MEDICAL EMERGENCY, DIAL "112" IMMEDIATELY. Our Services are not for medical emergencies or urgent situations.

Geographic scope. Our Services are offered in Romania and are directed to individuals in Romania and the European Union. The DexaFit software platform that processes your data is operated from the United States, so providing your results necessarily involves an international transfer of your data outside the European Economic Area (EEA). Section 10 explains this transfer and the safeguards that apply to it.

This Privacy Policy describes how we process your personal data and the rights you have under the General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR") and Romanian Law no. 190/2018 implementing the GDPR. The binding terms that govern your assessments, including any consent, assumption of risk, and authorization to collect, process, and transmit your data, are set out in the intake and consent forms you sign and in our Terms and Conditions.

We encourage you to read this Privacy Policy carefully to understand our practices and your rights.

2. Our Relationship with DexaFit, Inc. and How Responsibility Is Allocated

This section is important to how your data is handled and who is responsible for what, in the terms the GDPR uses (controller and processor).

What DexaFit Bucharest does. We operate our physical location and perform your in-person assessments. We determine why and how the personal data we collect from you on-site is used to deliver your Services. For that data, we act as the data controller within the meaning of Article 4 GDPR (the party responsible for the data).

What DexaFit, Inc. does. DexaFit, Inc. (a) licenses the DexaFit brand to us and (b) provides the software platform, applications, analytics, and reporting that process assessment data and present your results and reports. When DexaFit, Inc. processes the data we transmit in order to generate your reports and power the apps, it acts as our processor for that purpose, under a data processing agreement that includes the safeguards required by Article 28 GDPR. Separately, DexaFit, Inc. may act as an independent controller for its own purposes, for example, to operate, secure, and improve its platform, and to create and use De-Identified Information as described in its own privacy policy. DexaFit, Inc. is solely responsible for those independent uses; we are not. Where we and DexaFit, Inc. jointly determine the purposes and means of certain processing, we act as joint controllers to that extent and allocate our respective responsibilities as required by Article 26 GDPR.

Which policy applies. This Privacy Policy governs the personal data we collect from you at our location and through our Services. Once your data is transmitted to and processed on the DexaFit platform, DexaFit, Inc.'s Privacy Policy also applies and governs DexaFit, Inc.'s handling of that data, including its independent and De-Identified uses. The DexaFit, Inc. Privacy Policy is available at dexafit.com/privacy and is incorporated here by reference for those purposes. Each document controls for the data and activities it covers; in the event of a conflict regarding data we collect and control at our location, this Privacy Policy governs.

Allocation of responsibility. Our use of the DexaFit brand and platform does not make DexaFit, Inc. responsible for the acts, omissions, services, equipment, premises, or conduct at our location. Any issue, claim, or dispute relating to services performed, equipment used, or conduct occurring at our location must be addressed directly with DexaFit Bucharest SRL. Conversely, we are not responsible for DexaFit, Inc.'s operation of its platform or its independent uses of data described in its own privacy policy.

3. Data Controller and Contact Details

The data controller responsible for the personal data described in this Privacy Policy is:

DexaFit Bucharest SRL [registered company name, registration number, and registered office to be confirmed]. Address: Sector 1, Bucharest, Romania.

Email: bucharest@dexafit.com

Phone: +40 774 22 14 24

Data Protection Officer. If and where we are required to appoint, or choose to appoint, a Data Protection Officer (DPO) under Article 37 GDPR, you may contact that person at bucharest@dexafit.com [DPO name and dedicated contact to be confirmed]. If no DPO is appointed, you may use the contact details above for any privacy request or question.

For matters concerning the DexaFit Platform operated by DexaFit, Inc., see the DexaFit Privacy Policy at dexafit.com/privacy or contact privacy@dexafit.com.

4. Key Definitions

"Personal Data" means any information relating to an identified or identifiable natural person, such as your name, email address, phone number, and wellness-related information, as defined in Article 4 GDPR.

"De-Identified Information" means information that has been processed so that it can no longer reasonably be linked back to you, and which is maintained and used only as anonymized or de-identified information.

"Special Category Personal Data (Health Data)" means personal data concerning health, as defined in Article 4 and processed under Article 9 GDPR, that reveals your past, present, or future physical or mental health status. For us this includes body composition, bone density, metabolic, and fitness assessment data.

"DexaFit Platform" or "platform" means the DexaFit software, applications (including the DexaFit Operator and DexaFit ai apps), analytics, and reporting operated by DexaFit, Inc.

"Services" means the in-person general wellness assessments (our Tests) and related websites, scheduling, intake, and interactive features we provide.

5. Information We Collect

We collect the following categories of data to provide and improve our Services. The categories collected depend on how you interact with us. We may also provide additional or "just-in-time" privacy information at the point we collect certain data; that information supplements this Privacy Policy.

Personal Identifiers. Name, email address, postal address, phone number, and account or scheduling credentials, for booking, account creation, communication, and providing the Services you request.

Wellness Information (Health Data). Body composition data, bone density evaluations, cardiorespiratory and VO2 Max results, RMR and metabolic assessments, wellness histories, and related information collected at our location or entered by you. This is special category personal data (health data) under Article 9 GDPR, and we process it only on the basis of your explicit consent or another Article 9 basis where one applies. We use this data to generate your reports and provide personalized insights. It is not, and is not intended to be, a medical record.

Demographic and Lifestyle Information. Age, sex, ethnicity, lifestyle choices, and similar information used to perform and personalize your assessments. Some of this information may also constitute special category data and is processed under Article 9 GDPR on the basis of your explicit consent.

Payment Information. When you pay for Services, payment is processed by a third-party payment processor. We do not collect or store your full payment card number or other sensitive payment credentials; you provide that information directly to the payment processor, whose use of it is governed by its own privacy policy. We may retain limited transaction records (such as billing name, amount, date, and a confirmation reference) for accounting and tax purposes.

Premises and Security Information. Because we operate a physical location, we may collect check-in records and, where in use, video security footage of our premises, for the safety and security of our clients, staff, and property. Notice of any recording is provided at our premises, and any such monitoring is carried out in accordance with the GDPR and applicable Romanian rules on workplace and premises monitoring.

Third-Party Wellness Integrations. If you choose to connect services such as Apple Health or Google Fit through the DexaFit apps, the data you authorize is handled as described in the DexaFit, Inc. Privacy Policy, including the limits that connected-health data is never used for advertising, never sold, and never included in any De-Identified dataset licensed to third parties.

Visitor and Communication Data. Limited information from non-registered visitors who interact with our Services, and records of your communications with us, including scheduling, support requests, feedback, and marketing interaction history.

Usage and Technical Data. Collected through cookies and similar technologies (see Section 11), including device and browser information, IP address and approximate location, and general interaction data. Non-essential technologies operate only with your consent. We do not use session-replay or keystroke-logging tools.

Investor Information. Where applicable, we collect limited information from members and investors of DexaFit Bucharest SRL, such as name, contact details, and ownership interest, used to manage investor relations and our internal records. See Section 19.

Inferences. Limited inferences we may draw from the information above to personalize your experience. The wellness scores and predictive insights in your reports are generated on the DexaFit Platform, as described in Section 15.

Other Information. Any other information you choose to provide, or that we collect with notice, which we will use as described in this Privacy Policy or as disclosed at the time of collection.

6. Legal Bases for Processing

Under Article 6 GDPR, we rely on the following legal bases to process your personal data:

Performance of a contract (Article 6(1)(b)). To perform your assessments, manage your bookings and account, deliver your results, and provide support, so we can fulfil the service you have requested.

Consent (Article 6(1)(a)). For processing that depends on your consent, such as sending you marketing communications, and for setting non-essential cookies and similar technologies. You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Legal obligation (Article 6(1)(c)). To meet our legal and regulatory obligations, for example accounting and tax record-keeping and responding to lawful requests from authorities.

Legitimate interests (Article 6(1)(f)). To secure our Services and premises, prevent and detect fraud, maintain and improve our Services, manage our business, and establish, exercise, or defend legal claims, where those interests are not overridden by your interests or fundamental rights. You may object to processing based on legitimate interests as described in Section 13.

Health data and other special category data (Article 9 GDPR). Your wellness and assessment data is special category personal data (health data). We process it on the basis of your explicit consent under Article 9(2)(a) GDPR, which you provide before we perform your assessment. Where another Article 9 basis applies (for example, the establishment, exercise, or defense of legal claims under Article 9(2)(f)), we may also rely on it. You may withdraw your explicit consent at any time, in which case we will stop the related processing, although we may be unable to continue providing the associated Services.

7. How We Use Your Information

Service Provision and Scheduling. Perform your assessments; manage your bookings and account; process transactions and billing; provide support; verify your identity; and coordinate the delivery of your results.

Generating and Delivering Your Results. Transmit your assessment data to the DexaFit Platform so your reports can be generated, and deliver those results to you, including by email (see Sections 8 and 10).

Physician Oversight. Make limited information available to our medical director for the sole purpose of reviewing and authorizing the appropriateness of assessments, consistent with applicable law.

Communications. Send service updates, appointment confirmations and reminders, results notifications, and policy changes; respond to inquiries; and, where you have provided your contact details and any required consent, send marketing communications and surveys by email or text. You may opt out of marketing communications at any time using the unsubscribe link in any marketing email or by replying STOP to a marketing text. Service and transaction-related communications are not promotional and cannot be opted out of while you use the Services.

Text Messaging (SMS/MMS). With your consent, we may send you (i) service and transactional texts (such as appointment confirmations, reminders, and results notifications) and (ii) marketing texts about our Services. Message frequency varies. Message and data rates may apply. Reply STOP to any message to opt out of further marketing texts, and HELP for help. Your consent to receive marketing texts is not a condition of purchasing any Services. We do not share your mobile opt-in information or messaging consent with third parties for their own marketing.

Personalization and Improvement. Personalize your experience and analyze usage to improve our Services.

Security, Compliance, and Legal. Maintain the security of our Services and premises, prevent fraud, comply with legal and regulatory obligations, enforce our terms, establish and defend legal claims, and protect the rights and safety of our clients, staff, and business.

De-Identified Information. We may create and use De-Identified, aggregated, or anonymized information that cannot reasonably be used to identify you for internal analytics and business insights. Where De-Identified Information is created and used at the platform level, that activity is conducted by DexaFit, Inc. as an independent controller under its own privacy policy. We do not attempt to re-identify De-Identified Information.

8. How We Share Your Information

We do not sell your personal data (see Section 9). We share information only as described below, and only with appropriate safeguards in place.

DexaFit, Inc. (Platform Provider). This is core to how your results are produced. We transmit the personal data and health data from your assessments to the DexaFit Platform operated by DexaFit, Inc., which processes that data to generate your reports and deliver your app experience. DexaFit, Inc. acts as our processor for this purpose under a data processing agreement, and, for its own independent and De-Identified uses, as an independent controller under its own privacy policy. Because the platform is operated from the United States, this involves an international transfer of your data, described in Section 10. DexaFit, Inc.'s handling of that data is described in the DexaFit Privacy Policy, available at dexafit.com/privacy.

Medical Director / Supervising Physician. We may make limited personal data available to the licensed physician who serves as our medical director, solely so that physician can review and authorize the appropriateness of your assessments as required by applicable law. This information is handled confidentially and used only for that authorization and oversight purpose. This does not create a physician-patient or treatment relationship and does not render the information a medical record.

Service Providers (Processors). We use trusted vendors (for example, scheduling, payment processing, hosting, communications, and support) who process data on our behalf, are bound by data processing agreements under Article 28 GDPR, and may use it only for the purposes we specify.

Legal and Regulatory Compliance. We may disclose information to comply with legal obligations, court orders, or requests from competent authorities; to establish, exercise, or defend legal claims; to enforce our agreements and protect our rights and property; to detect or prevent fraud; and to protect the safety of any person.

Business Transactions. In connection with a merger, acquisition, financing, restructuring, or sale of company assets, and in the unlikely event of insolvency or bankruptcy, your information may be transferred or assigned as part of that transaction, subject to applicable law and your rights.

Vital Interests. We may share information where necessary to protect the vital interests of you or another person, for example to address an urgent safety concern.

With Your Consent or Direction. With your consent or at your direction, we may share information, for example, to deliver results to a wellness or fitness professional you designate, or to publish a testimonial you provide. If you choose to make content public (such as a testimonial or review), it may be seen, copied, cached, or stored by others, and we are not responsible for any such use of information you have chosen to make public.

9. We Do Not Sell Your Data

We do not sell your personal data, and we do not process it in exchange for monetary or other valuable consideration. We do not use your Wellness Information or health data for advertising, and we do not provide your assessment results to advertising partners or ad networks. Any processing for marketing, and any non-essential cookies or tracking technologies, are based on your consent, which you may withdraw at any time. Where interest-based advertising technologies operate on our website, they do so only after you accept advertising cookies through our consent banner (see Section 11), and never using your assessment results or other health data.

10. International Data Transfers

Providing your results requires transferring your personal data, including your health data, to DexaFit, Inc. in the United States, which operates the DexaFit Platform that generates your reports. This is a key transfer that is necessary to deliver the Services you request.

The United States is outside the European Economic Area (EEA). Where we transfer your personal data outside the EEA, we do so in accordance with Chapter V of the GDPR (Articles 44 to 49) and rely on one or more appropriate safeguards, which may include: an adequacy decision of the European Commission covering the recipient where one applies; the European Commission's Standard Contractual Clauses (SCCs) entered into with DexaFit, Inc.; and, where relevant, supplementary technical and organizational measures. Where none of those mechanisms is available for a specific transfer, we rely on a derogation under Article 49 GDPR, such as your explicit consent to the transfer after being informed of the possible risks, or the transfer being necessary for the performance of your contract.

You may request more information about the safeguards that apply to transfers of your data, and a copy of the relevant mechanism where applicable, by contacting us using the details in Section 3. Data held on the DexaFit Platform is also subject to the safeguards described in the DexaFit, Inc. Privacy Policy.

11. Cookies and Tracking Technologies

We use cookies and similar technologies to operate and improve our Services, including essential cookies (functionality, security), performance cookies (usage analytics), functional cookies (preferences), and, where applicable, marketing cookies. We may also use pixel tags in our marketing emails to understand whether messages were opened or links were clicked.

Consent before non-essential tracking. In line with the ePrivacy rules and Article 6 GDPR as implemented in Romania, essential cookies (needed for security, login, and core functionality) operate by default because they are strictly necessary to provide the Services you request. All non-essential cookies and tracking technologies, including analytics and advertising or marketing technologies such as the Meta (Facebook) Pixel and Google advertising tags, do not load until you accept them through our cookie consent banner. You may withdraw or change your choices at any time through that banner, and withdrawing consent is as easy as giving it.

Managing cookies. You can manage cookies through our cookie banner and through your browser settings; disabling some cookies may affect functionality. Third-party analytics and advertising partners may use their own technologies subject to their own privacy policies. Where a recognized opt-out preference signal is offered by your browser, we honor it where required by applicable law.

Limits on use of health information for advertising. We do not provide your assessment results or other Wellness Information (such as your body composition, bone density, metabolic, or fitness assessment results) to advertising partners or ad networks, and we do not use that assessment data to target ads to you. We do not sell your Wellness Information or health data.

12. Special Category Personal Data (Health Data)

The wellness data we collect, including body composition, bone density, metabolic, and fitness assessment results, is special category personal data (health data) under Article 9 GDPR. We collect it to provide the Services and reports you request, and we process it on the basis of your explicit consent under Article 9(2)(a) GDPR, or another Article 9 basis where one applies.

We will not share or sell your health data in a way that identifies you without your separate explicit consent or another lawful Article 9 basis. We do not provide your assessment results or other health data to advertising partners, and we do not use that assessment data to target ads to you (see Section 11). You may withdraw your explicit consent to the processing of your health data at any time by contacting us using the details in Section 3, in which case we will stop the related processing, although we may then be unable to continue providing the associated Services.

13. Your Data Subject Rights

Under the GDPR and Romanian Law no. 190/2018, and subject to the conditions and exceptions those laws provide, you have the following rights in relation to your personal data that we control:

Right of access (Article 15): to obtain confirmation of whether we process your personal data and, if so, a copy of that data and information about how we process it.

Right to rectification (Article 16): to have inaccurate personal data corrected and incomplete data completed.

Right to erasure or the right to be forgotten (Article 17): to have your personal data deleted where one of the grounds in the GDPR applies, subject to our legal retention obligations and legitimate grounds to retain it.

Right to restriction of processing (Article 18): to have our processing of your personal data restricted in certain circumstances.

Right to data portability (Article 20): to receive personal data you provided to us, in a structured, commonly used, and machine-readable format, and to have it transmitted to another controller where technically feasible, for processing based on consent or on a contract.

Right to object (Article 21): to object, on grounds relating to your particular situation, to processing based on our legitimate interests, and to object at any time to processing for direct marketing.

Rights in relation to automated decision-making and profiling (Article 22): not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, subject to the exceptions in the GDPR. See Section 15.

Right to withdraw consent: where we rely on your consent (including your explicit consent for health data), to withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.

Right to lodge a complaint: to complain to the supervisory authority, as described in Section 14.

How to exercise your rights. Contact us using the details in Section 3 with your full name, the email associated with your bookings, and the specific request. We will respond without undue delay and in any event within one month of receiving your request, a period that may be extended by two further months where necessary taking into account the complexity and number of requests, in which case we will inform you. We may request additional information to confirm your identity. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive, in which case the GDPR permits a reasonable fee or a refusal.

Because much of your data is processed on the DexaFit Platform, certain requests may be coordinated with DexaFit, Inc. We will forward and assist with requests as appropriate so they can be honored across both our records and the platform.

Declining to provide information. Some information is necessary for us to provide the Services. If you choose not to provide information we identify as required, or you withdraw the consent on which a Service depends, we may be unable to schedule or perform your assessments or deliver your results.

14. Supervisory Authority and Complaints

If you believe that our processing of your personal data infringes the GDPR or Romanian data protection law, you have the right to lodge a complaint with the Romanian supervisory authority:

The National Supervisory Authority for Personal Data Processing (ANSPDCP), in Romanian Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal, with its seat in Bucharest, Romania. Website: dataprotection.ro.

We would, however, appreciate the opportunity to address your concerns directly before you approach the supervisory authority, so we encourage you to contact us first using the details in Section 3. You also have the right to an effective judicial remedy before the competent Romanian courts.

15. Automated Processing and Insights

The wellness scores, insights, and predictions presented in your reports are generated by DexaFit, Inc.'s machine-learning models on the platform. These outputs are educational wellness information. They are not decisions based solely on automated processing that produce legal or similarly significant effects concerning you within the meaning of Article 22 GDPR, and they do not replace professional advice. Where you have the right to information about, or to object to, profiling or automated processing, you may exercise it by contacting us or DexaFit, Inc. as described in the respective privacy policies.

16. Data Security

We implement appropriate technical and organizational measures under Article 32 GDPR to protect personal data, including, as appropriate, encryption, access controls, secure storage, staff confidentiality obligations, and incident-response procedures. Data transmitted to and processed on the DexaFit Platform is protected by the safeguards described in the DexaFit, Inc. Privacy Policy.

No method of internet transmission or electronic storage is completely secure, and we cannot guarantee absolute security. Please use strong passwords and report suspicious activity. In the event of a personal data breach, we will notify the supervisory authority and affected individuals where and as required by Articles 33 and 34 GDPR.

17. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy and to meet our legal obligations. When determining retention periods, we consider the amount, nature, and sensitivity of the data, the purposes for which we process it, and applicable legal, accounting, and reporting requirements.

Account and Scheduling Information: for the duration of your relationship with us and for a reasonable period afterwards, to meet backup, audit, and legal requirements [specific retention period to be confirmed with your attorney].

Wellness Information (Health Data): for as long as needed to provide your reports and history and to meet applicable legal and business requirements [specific retention period to be confirmed].

Transaction Data: for the period required by Romanian tax and accounting law [specific statutory retention period to be confirmed].

Communication and Marketing Data: for as long as needed for support, dispute resolution, and legal compliance, or until you withdraw your consent or object.

Security Footage: for a limited period consistent with our security needs and applicable law, unless retained longer for an investigation or legal matter.

De-Identified Information: may be retained for research, analytics, and business purposes for as long as it remains anonymized.

When retention periods expire or you obtain erasure of your data, we securely delete or anonymize the personal data; some data may persist briefly in backups before final deletion. Data held on the DexaFit Platform is retained as described in the DexaFit, Inc. Privacy Policy.

18. Children's Privacy

Our Services are intended for adults, and you must be at least 18 years old to purchase our Services. In relation to information society services offered directly to a child, the age of valid consent under Romanian Law no. 190/2018 is 16. We do not knowingly collect personal data from anyone under 16 without the consent or authorization of the holder of parental responsibility. If we learn that we have collected personal data from a person under 16 without the required consent, we will delete it. If you believe we hold such data, please contact us using the details in Section 3.

19. Investor Information

In addition to the practices described above, we collect limited personal data from members and investors of DexaFit Bucharest SRL, such as name, contact details, ownership or membership interest, and related records, to manage investor relations, maintain our internal and corporate records, process distributions, and meet tax and legal obligations. We use and disclose this information consistent with Sections 7 and 8 and applicable law.

20. Regulatory Compliance

Non-medical general wellness. Our general wellness Services are not medical care, and the wellness data we process is not a medical record. We do not diagnose, treat, or prescribe, and we do not bill any insurer or public health program for our Services. The oversight provided by our medical director is limited to reviewing and authorizing the appropriateness of assessments as required by applicable law; it is administrative in nature and does not constitute the practice of medicine or create a physician-patient or treatment relationship.

Data protection framework. We process personal data in accordance with the GDPR, Romanian Law no. 190/2018, the ePrivacy rules on cookies and electronic communications, and other applicable Romanian and EU data protection and consumer rules. Where the DexaFit Platform processes your data, the commitments and data-subject rights described in the DexaFit, Inc. Privacy Policy also apply.

21. Third-Party Websites and Services

Our Services may include links to, or integrations with, third-party websites, applications, and services. Except where we expressly adopt or refer to this Privacy Policy, this Privacy Policy does not apply to the data practices of third parties. We are not responsible for the content or privacy practices of third parties, and we encourage you to review their privacy policies.

22. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or for legal, operational, or regulatory reasons. We will communicate significant changes through our Services or by email, and the "Last Modified" date above reflects the latest update. Please review this policy periodically.

23. Governing Law

This Privacy Policy and any matter relating to it are governed by the laws of Romania and the applicable data protection law of the European Union, without regard to conflict-of-laws principles. Any dispute relating to this Privacy Policy that is not resolved directly may be brought before the competent courts of Bucharest, Romania, without prejudice to your right to lodge a complaint with the supervisory authority or to any mandatory consumer protection rights available to you.

24. Contact Information

For questions, concerns, or requests regarding this Privacy Policy or our privacy practices, contact us:

DexaFit Bucharest SRL (Data Protection). Sector 1, Bucharest, Romania [registered office to be confirmed].