Privacy

Privacy Policy

Last updated: May 28, 2026

Basic information about data protection

At Hablemos Terapia, we respect your privacy and are committed to protecting your personal data in accordance with Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 (LOPDGDD) and any other applicable data protection legislation. This policy informs you in a clear, transparent and unambiguous way about how we collect, use, store and protect your information.

Identity of the data controllers

This website and the services provided through it are managed by a collective of self-employed psychologists who practice independently:

Paloma Franco

License No. C-35079

Self-employed

Sol Vassia

License No. M-47738

Self-employed

Rocío Cerra

License No. C-33203

Self-employed

For data protection matters, you can contact us at privacidad@hablemos-terapia.com

Each psychologist is an independent controller of the data of her own patients, acting as a joint controller only in relation to the website and the initial acquisition of clients.

Categories of data we process

The personal data we process is the following:

Identification and contact data

  • Full name
  • Email address
  • Phone number
  • Postal address (if you provide it)

To respond to your inquiries, schedule appointments and keep you informed about our services.

Explicit consent (Art. 6.1(a) GDPR) and performance of a contract (Art. 6.1(b) GDPR).

Booking and appointment data

  • Preferred date and time
  • Selected psychologist
  • Type of therapy
  • Time availability
  • Notes about the reason for consultation

To manage, organise and provide the requested therapeutic services.

Performance of a service contract (Art. 6.1(b) GDPR).

Clinical and health data

  • Therapeutic history
  • Diagnoses
  • Session notes
  • Psychological assessments

To provide therapeutic care with the deontological and healthcare guarantees required.

Article 9.2(h) GDPR (healthcare provision) and the duty of professional secrecy (Code of Ethics of the General Council of Psychology of Spain).

SPECIAL CATEGORY OF DATA (Art. 9 GDPR) - Health data protected with reinforced security measures.

Browsing data (with your consent)

  • IP address
  • Browser type and version
  • Pages visited
  • Visit duration
  • Cookies and tracking data

For website usage analysis, improvement of the user experience and security.

Explicit consent (Art. 6.1(a) GDPR).

Marketing and advertising data (with your consent)

  • Ad interactions
  • Conversions
  • Custom audiences
  • Communication preferences

For advertising campaign measurement and sending commercial communications.

Explicit consent (Art. 6.1(a) GDPR).

Purposes of processing

Your personal data will be processed for the following purposes:

  • Management, organisation and provision of therapeutic services (individual, couples, assessments).
  • Handling inquiries, requests and information requests.
  • Scheduling, confirmation and reminders of appointments.
  • Invoicing and financial and accounting management of the services provided.
  • Compliance with healthcare, tax and anti-money-laundering legal obligations.
  • Retention of the therapeutic history in accordance with healthcare regulations (Law 41/2002).
  • Sending commercial communications, newsletters and informational material (only with consent).
  • Analysis and improvement of the quality of the services provided.
  • Website management and support for its users.

Legal basis for processing

In accordance with Article 6 of the GDPR, the processing of your data is based on:

Explicit and unambiguous consent (Art. 6.1(a) GDPR)

For sending commercial communications, using non-essential cookies and marketing.

Performance of a contract (Art. 6.1(b) GDPR)

To manage the therapy appointments you request and provide the contracted services.

Compliance with legal obligations (Art. 6.1(c) GDPR)

To comply with tax and healthcare obligations (clinical records) and anti-money-laundering obligations.

Legitimate interest (Art. 6.1(f) GDPR)

To improve our services, website security and customer care, provided that your fundamental rights do not prevail.

Protection of vital interests (Art. 6.1(d) GDPR)

Exceptionally, in situations of risk to your health or physical integrity.

For health data (special category, Art. 9 GDPR), the legal basis is the provision of healthcare (Art. 9.2(h) GDPR) and the duty of professional secrecy.

Data retention periods

We retain your data for as long as necessary to fulfil the purposes described and in accordance with the legal time limits:

Clinical and therapeutic records

Minimum 5 years from the last intervention (Art. 15.2 Law 41/2002). Up to 20 years recommended for professional liability reasons.

Invoicing and accounting data

6 years from the last invoice (Art. 30 Commercial Code) and 4 years for tax obligations (Art. 66 Law 58/2003).

Contact and booking data (without reaching a contract)

While you maintain a relationship with us and up to 3 years afterwards for potential claims.

Browsing data (cookies)

According to each cookie's duration (see Cookie Policy). Generally between 24 hours and 2 years.

Marketing and newsletter data

Until you withdraw your consent or 2 years from the last interaction.

Video call recordings (if any)

Only with explicit consent and for the strictly necessary period.

Once the time limits have expired, data will be securely deleted or blocked for the legal limitation period of liabilities.

Recipients and data disclosures

Your personal data will NOT be disclosed or communicated to third parties, except:

Technology service providers

Hosting, website maintenance, corporate email

European Union or countries with adequacy decisions

Data processing agreement (Art. 28 GDPR)

Google Ireland Limited

Analytics and advertising (only with consent)

Ireland (EU) - Adequacy decisions

European Standard Contractual Clauses

Meta Platforms Ireland Limited

Advertising and measurement (only with consent)

Ireland (EU) - Standard clauses

Privacy Shield Framework invalidated - contractual clauses

Video call platforms

Provision of online therapy (Zoom, Google Meet, etc.)

EU or US with safeguards

Confidentiality agreement and data processing contract

Advisors and consultants

Tax, employment and legal advice

Spain

Professional secrecy and confidentiality agreement

Public authorities

Only by legal obligation (tax authorities, healthcare, courts)

Spain

Compliance with legal obligations

We do NOT sell, rent or disclose your personal data to third parties for commercial purposes. International transfers are covered by appropriate safeguards (European Commission adequacy decisions or standard contractual clauses).

Your data protection rights

In accordance with Articles 15 to 22 of the GDPR, you have the right to:

Right of access (Art. 15)

Request a copy of your personal data and know how we process it.

Right of rectification (Art. 16)

Correct inaccurate data or complete data that is incomplete.

Right of erasure ("right to be forgotten") (Art. 17)

Request the deletion of your data when it is no longer necessary, when you withdraw consent or when processing is unlawful.

Right to restriction of processing (Art. 18)

Request that we stop processing your data while a claim about its accuracy or lawfulness is resolved.

Right to data portability (Art. 20)

Receive your data in a structured, commonly used and machine-readable format, to transmit it to another controller.

Right to object (Art. 21)

Object to the processing of your data on grounds relating to your particular situation, especially for marketing.

Right not to be subject to automated decisions (Art. 22)

Not to be subject to decisions based solely on automated processing, including profiling, that produce legal effects.

Right to withdraw consent (Art. 7.3)

Withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise your rights, send a written request to privacidad@hablemos-terapia.com, attaching a copy of your ID, NIE or equivalent identification document. Clearly state which right you wish to exercise and the data affected.

We respond to requests within a maximum of ONE MONTH (Art. 12 GDPR), extendable to two months in complex cases.

Exercising your rights is FREE of charge, except for manifestly unfounded or excessive requests (Art. 12.5 GDPR).

Security and confidentiality measures

In accordance with Articles 32 et seq. of the GDPR, we have implemented appropriate technical and organisational measures to guarantee an adequate level of security:

  • SSL/TLS encryption (HTTPS) for all communications and data transmission.
  • Restricted access to authorised personnel through authentication and unique credentials.
  • Strong password policies and periodic renewal.
  • Regular backups and secure storage.
  • Periodic security updates to systems and applications.
  • Confidentiality agreements and data processing contracts with all providers.
  • Record of processing activities (Art. 30 GDPR).
  • Data protection impact assessment where applicable (Art. 35 GDPR).
  • Notification of security breaches to the AEPD within 72 hours where applicable (Art. 33 GDPR).

Although we use reasonable security measures, no data transmission over the Internet is 100% secure. We will inform you of any breach affecting your data in accordance with Art. 34 GDPR.

International data transfers

As a general rule, your data will not be transferred outside the European Economic Area (EEA). In the event that a provider has servers outside the EEA:

  • Only providers offering appropriate safeguards will be used.
  • The Standard Contractual Clauses approved by the European Commission will be signed.
  • It will be verified that the destination country has an adequacy decision from the European Commission.
  • For transfers to the US, the Privacy Shield framework or equivalent safeguards will be verified.

You can request detailed information about international transfers by writing to privacidad@hablemos-terapia.com

Automated decisions and profiling

We do NOT make decisions based solely on automated processing, including profiling (Art. 22 GDPR), that produce legal effects or significantly affect you.

Exceptionally, we may use automated tools for statistical analysis or audience segmentation in marketing, always with your consent and the possibility of human intervention.

Changes to the privacy policy

We may update this privacy policy periodically to adapt it to legislative or case-law changes or to our processing practices.

Any substantial change will be notified to you in advance through our website or by email. The current version will always be the one published on this page.

We recommend reviewing this policy every time you provide us with your data.

Right to lodge a complaint with the supervisory authority

If you consider that the processing of your data does not comply with current regulations, you have the right to lodge a complaint with the competent supervisory authority:

Spanish Data Protection Agency (AEPD)

C/ Jorge Juan, 6. 28001 Madrid, Spain

https://www.aepd.es

901 100 000 / 912 663 517

info@aepd.es

Filing a complaint with the AEPD is free of charge and does not require the assistance of a lawyer or attorney. However, this procedure is voluntary and not mandatory to exercise your rights.

Data protection of minors

In accordance with Article 8 of the GDPR and the additional provision 8 of the LOPDGDD:

We only collect data from individuals aged 14 and over. For minors under 14, the consent of parents or legal guardians will be required.

For therapeutic services for minors, both parents/guardians must provide written informed consent and authorise the processing of the minor's data.

We reserve the right to verify age and parental consent when necessary.

Presence on social networks

If you follow us on social networks (Instagram, Facebook, LinkedIn), data processing will be governed by each social network's privacy policy and by this policy with regard to the data we manage.

We act as joint controllers together with the relevant social network for followers' data and interactions on our pages.

We recommend reviewing the privacy settings of your profile on each social network.