Privacy statement

What I collect, why, how long I keep it, and what you can ask me to do with it. Written to be read, not to be survived.

Draft. This statement is a scaffold and still contains placeholders. Complete and review it before publishing.

Last updated: [DATE] · Version [1.0]

Who is responsible for your data

VF Psychology, run by Valeria Verhaar Flores, is the data controller for the personal data described here.

  • Practice: VF Psychology
  • Address: [STREET, POSTCODE, CITY]
  • Chamber of Commerce (KvK): 77411528
  • Email: privacy@vf-psychology.nl
  • Data Protection Officer: [NAME, or “not appointed — not required for a practice of this size”]

What I collect, and why

When you use the contact form

Your name, email address, preferred language and whatever you write in the message field. I use it only to answer you. The legal basis is your consent, which you give with the tick box, and you can withdraw it at any time. The form is delivered to my mailbox by FormSubmit (formsubmit.co), a form-forwarding service that passes the message on by e-mail and does not keep a copy of it.

When you become a client

A client file, which contains your contact details, date of birth, [BSN if you are a BIG-registered provider billing insurers], the reason you came, session notes, any correspondence, and invoices.

Much of this is health data, which the GDPR treats as a special category. I process it under Article 9(2)(h) — the provision of health care — together with the record-keeping duties in the Dutch Medical Treatment Agreement Act (WGBO) and, where applicable, the Healthcare Quality, Complaints and Disputes Act (Wkkgz).

When you book a call

The scheduling tool Calendly receives your name, email address and chosen time slot in order to make the appointment.

When you visit this website

[DESCRIBE ACTUAL ANALYTICS. If you use GA4, name it, say whether IP anonymisation and cookieless measurement are on, and state that you ask for consent first. If you use nothing, say: “This site sets no tracking cookies and uses no analytics.”] The site loads no third-party fonts, scripts or images from external servers.

Who else sees your data

I keep the circle as small as the work allows. Where a supplier processes data on my behalf, there is a data processing agreement in place, as the GDPR requires.

  • [VIDEO PLATFORM] — encrypted video sessions. Sessions are not recorded.
  • [PRACTICE MANAGEMENT / EHR SYSTEM] — client records and invoicing.
  • [EMAIL PROVIDER] — correspondence.
  • FormSubmit (formsubmit.co) — forwards contact-form messages to my e-mail address.
  • Google Analytics 4 (Google Ireland Ltd) — website statistics. Runs in consent mode with storage denied (cookieless) until consent is given.
  • Calendly — appointment scheduling (free intake bookings).
  • [ACCOUNTANT] — invoices only, for statutory tax purposes.

Your data is not sold, rented or used for advertising, and it is not shared with your employer, your GP, your school or your family without your written permission. [STATE WHETHER ANY PROCESSOR STORES DATA OUTSIDE THE EEA, and on what transfer mechanism.]

The limits of confidentiality

I have a professional duty of confidentiality. There are two situations where it can be broken: where there is an acute and serious risk to your safety or someone else’s, and where a court legally compels disclosure. Wherever it is possible, I will discuss it with you before anything is shared.

How long I keep it

  • Client files: 20 years from the end of treatment, as required by the WGBO. For clients who were minors, the clock generally runs from their 18th birthday.
  • Invoices and financial records: 7 years, as required by Dutch tax law.
  • Contact form messages that don’t become a client file: [PERIOD, e.g. 12 months], then deleted.

How it’s protected

  • Encrypted connections (TLS) for the website, email and video sessions
  • Access limited to me alone; devices are encrypted and password-protected
  • Multi-factor authentication on every system that holds client data
  • Records held in [SYSTEM], which stores data within the EEA
  • [BACKUP AND RETENTION ARRANGEMENT]

Your rights

Under the GDPR you can ask me to:

  • show you what data I hold about you (access)
  • correct anything that is wrong (rectification)
  • delete data, where no legal retention duty applies (erasure)
  • limit what I do with it while a dispute is resolved (restriction)
  • send you a copy in a portable format (portability)
  • stop processing based on legitimate interest (objection)
  • withdraw consent you gave earlier, without it affecting what was lawful before

Write to privacy@vf-psychology.nl. I’ll respond within one month, and I may ask you to confirm your identity first so that I’m not handing your file to someone else.

Complaints

If you think I’ve handled your data badly, please tell me first — most of it is fixable in a conversation. You also have the right to complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl.

For complaints about the care itself rather than your data, see [COMPLAINTS PROCEDURE / DISPUTES BODY under the Wkkgz].

Cookies

[If the site sets no cookies: “This website sets no cookies.” If a booking embed or analytics does: list each cookie, its purpose and its lifespan, and describe how consent is obtained and withdrawn.]

Changes to this statement

If this statement changes, the version number and date at the top change with it. Material changes affecting current clients are communicated by email.