Privacy policy

Controller: Jesica Benitez Cabrera (hereinafter, "Psicomaterna").

Spanish tax ID (NIF): 47970773H.

Address: Carrer d'Enric Prat de la Riba, 25, 08401 Granollers, Barcelona.

Contact email: jesica@psicomaterna.es.

Activity: online perinatal psychology services provided by a Licensed Health Psychologist (Psicóloga General Sanitaria) registered with Col·legi Oficial de Psicologia de Catalunya (COPC), collegiate number 36636.

No Data Protection Officer has been appointed, as it is not mandatory for this activity under Article 37 GDPR and Article 34 of the Spanish LOPDGDD. For any privacy-related matter, you can write directly to jesica@psicomaterna.es.

Identification and contact data: first name, surname, email, phone, and, where relevant, Instagram or WhatsApp handle.

Enquiry data: reason for the consultation, availability and any information you voluntarily share when reaching out.

Special-category data (health data, Art. 9 GDPR): clinical and psychological information you share during the assessment call or the therapy sessions, as well as the clinical notes generated as a result of the professional relationship. These data are processed with reinforced protection and under professional secrecy.

Billing data: once the therapeutic relationship begins, the data required to issue invoices in line with Spanish tax legislation.

Data about minors is not requested. Where the enquiry concerns a minor (e.g. in a perinatal context), the data is provided by the holder of parental authority or guardianship, who acts on behalf of the minor.

(a) Responding to enquiries received by email, WhatsApp, Instagram or phone and managing the free assessment call. Legal basis: pre-contractual measures at the request of the data subject (Art. 6(1)(b) GDPR).

(b) Providing the online perinatal psychology service (therapy sessions, clinical follow-up). Legal basis for identification and contact data: performance of the services contract (Art. 6(1)(b) GDPR). Legal basis for health data: Article 9(2)(h) GDPR — processing necessary for the provision of healthcare by a professional bound by an obligation of professional secrecy — in connection with Spanish Law 41/2002 on patient autonomy and the Code of Ethics of the General Council of Psychology of Spain.

(c) Complying with legal obligations (billing, retention of clinical records, tax and professional requirements). Legal basis: compliance with legal obligations (Art. 6(1)(c) GDPR).

(d) Where applicable, establishing or defending legal claims. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Enquiries that do not turn into a therapeutic relationship: up to 1 year from the last contact, unless deletion is requested earlier.

Clinical records and professional notes: a minimum of 5 years from the date of discharge of each clinical process, under Article 17.1 of Spanish Law 41/2002. If you reside in Catalonia, Catalan Law 21/2000 may require retention for up to 20 years after death or, failing that, the longest applicable regional period.

Billing data: for the periods required by Spanish tax and commercial legislation (6 years, Art. 30 Spanish Commercial Code; 4 years, General Tax Law).

After these periods, data is deleted or blocked in line with Article 32 of the LOPDGDD.

Your data will not be shared with third parties unless required by law. The following processors are engaged to deliver the service (current sub-processor register), each under a written processing agreement (Art. 28 GDPR):

· Cloudflare, Inc., provider of web hosting, content delivery (CDN) and site security for psicomaterna.es, and of the cookieless audience-measurement tool Cloudflare Web Analytics. The processing is governed by Cloudflare's Data Processing Addendum (DPA), which incorporates the European Commission's Standard Contractual Clauses (SCCs) for transfers outside the EEA. Domain registration is handled through the relevant registrar, under its own processing addendum.

· Google Ireland Limited (Google Workspace), used for: (i) the professional email account jesica@psicomaterna.es (Gmail), (ii) the video calls for therapy sessions (Google Meet), and (iii) the storage of clinical documents (Google Drive). The processing includes special-category data (health data, Art. 9 GDPR) and is governed by the Google Workspace Data Processing Amendment, available at workspace.google.com/terms/dpa_terms.html, which incorporates the European Commission's Standard Contractual Clauses for international transfers. EU data residency is selected wherever the service allows.

· Meta Platforms Ireland Ltd. (WhatsApp and Instagram), only when you choose to initiate contact through these channels. Meta acts as a controller or joint controller for the data you share on its platforms, under its own terms, over which Psicomaterna has no control. These channels are not suitable for sensitive clinical information: please use them only for the initial enquiry or logistics, and use email for any health-related information.

· Clinical-management or billing tools where used, all under written Art. 28 GDPR processing agreements.

This list is the sub-processor register in force on the date of last update of this policy. Any addition or replacement of sub-processors will be reflected on this same page. If you wish to receive prior notice of changes or to request a copy of the processing agreements and applicable safeguards, you can write to jesica@psicomaterna.es.

Some providers (e.g. Google Ireland Limited, Meta Platforms Ireland Ltd., or Cloudflare, Inc.) may involve transfers of data outside the European Economic Area, in particular to the United States.

Those transfers are covered, depending on the case, by (i) the European Commission's adequacy decision for the EU-US Data Privacy Framework (DPF) where the recipient is certified under that framework, or (ii) the Standard Contractual Clauses (SCCs) approved by Commission Implementing Decision (EU) 2021/914, supplemented, where necessary, by the additional measures recommended by the European Data Protection Board following the Court of Justice's Schrems II judgment (C-311/18).

Because special-category data (health data, Art. 9 GDPR) may be processed, the risk of each transfer has been assessed and reinforced safeguards apply: by default, clinical data is not shared via WhatsApp or Instagram; for any health-related information, please use email or the video sessions.

You can request a copy of the Standard Contractual Clauses, of each provider's DPF certification, and of any other applicable safeguards by writing to jesica@psicomaterna.es.

You have the right to request access, rectification, deletion, opposition, restriction and portability of your data, and to withdraw at any time any consent you have given, without this affecting the lawfulness of processing carried out before withdrawal.

How to exercise your rights: send an email to jesica@psicomaterna.es indicating (i) the right you wish to exercise, (ii) a brief description of your request, and (iii) a way to verify your identity (e.g. a copy of an ID document, or a reply from the email address through which we have already had previous contact). No specific form is required.

Response SLA: a response will be provided within a maximum of one month from receipt of the request, extendable by up to a further two months where the complexity or number of requests justifies it, in which case you will be informed within the first month (Art. 12.3 GDPR). Exercising these rights is free of charge, except for manifestly unfounded or excessive requests.

If you consider that your data is being processed in a way that does not comply with the regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. If you reside in Catalonia, you can also turn to the Catalan Data Protection Authority (APDCAT), www.apdcat.cat.

Technical and organisational measures appropriate to the risk and to the category of data processed are applied (Art. 32 GDPR), including encryption of communications, backups and access control.

All information shared in the context of the therapeutic relationship is protected by professional secrecy, in line with the Code of Ethics of the Psychologist. It can only be lifted in the cases provided for by law (serious risk to one's own or others' life or integrity, judicial requirement).

No automated decision-making or profiling with legal effects on the data subject is carried out.

This policy may be updated to reflect regulatory changes or changes to the service. The date of the most recent update is shown at the beginning of the document.