Privacy policy

Radu S. Ana Maria – Cabinet Individual de Psihologie (Radu Ana Maria), tax code (CUI) 55422878, registered office: Sat Mohu nr. 222, com. Șelimbăr, jud. Sibiu, Romania. I am the data controller for the personal data described here.

Contact for anything about your data: contact@anaradu.ro, +40 740 123 456, or by post to the address above.

A data protection officer is not required for a practice of this size (Art. 37 GDPR), so you deal with me directly.

MISSING: Colegiul Psihologilor din România registration number and the type of practice certificate (atestat). Add before the site goes live.

Contact and identification data: name, phone, email. For a child: the child's name and age, and the parent's or guardian's details.

Source of the data: you or, for a child, the parent or guardian. I do not obtain personal data from anyone else.

Booking data: service, date, time, in person or online, and anything you choose to write in the booking form.

Security data: a record of sign-ins to the booking system and of who opened which client record, and, when you sign a form online, the time and a protected (hashed) form of your IP address as proof of signing. To block abuse of the booking and contact forms, a hashed form of your IP address is also kept for at most 24 hours.

Health data: information about psychological state, development, speech and language, assessment results and session notes. This is a special category of data under Art. 9 GDPR and gets the highest level of protection.

Invoicing data: name, address and payment details needed for receipts and accounting.

Website data: only if you allow analytics cookies, anonymous statistics about the pages you visit.

I do not ask for your personal numeric code (CNP) online. If an official report requires it, I ask for it in person, under the conditions of Law 190/2018.

Booking, reminders and holding sessions: the contract between us, or steps you ask for before it (Art. 6(1)(b) GDPR).

Assessment, counselling and therapy, which require health data: provision of health care by a professional bound by secrecy (Art. 9(2)(h) GDPR and Law 213/2004 on the psychologist profession), together with your explicit, informed consent, which you give in the booking form and in writing at the first session (Art. 9(2)(a) GDPR and the Code of Ethics of the psychologist profession).

Keeping professional records, invoicing and accounting: legal obligations (Art. 6(1)(c) GDPR), under Law 213/2004 and its methodological norms, Law 82/1991 on accounting and the Fiscal Code.

Replying to messages sent through the contact form: steps before a possible contract (Art. 6(1)(b) GDPR).

Website analytics: your consent (Art. 6(1)(a) GDPR and Art. 4(5) of Law 506/2004).

Defending legal claims: legitimate interest (Art. 6(1)(f) GDPR).

No decisions are made about you by automated means, and no profiling takes place (Art. 22 GDPR).

For clients under 18, the booking and the consent to process their data are given by a parent or legal guardian, whatever the child's age, because the Code of Ethics of the psychologist profession requires it: for an evaluation the consent of at least one parent or legal representative, and for counselling or psychotherapy the consent of both parents when they exercise parental authority jointly (Code of Ethics, point 27). When a child is booked for counselling or therapy, I therefore ask who holds parental authority.

Children are told, in words suited to their age, what happens in sessions and what is kept confidential, and their views are taken into account.

Data about a child is shared with parents only as needed for the child's wellbeing and as the law allows.

TO CONFIRM WITH A LAWYER: that this section matches the current Code of Ethics (point 27 as amended in 2023: both parents for counselling or psychotherapy when authority is joint, at least one for an evaluation; exceptions in points 23 and 154–161) and the Civil Code and Law 272/2004 rules on parental authority, and how the second parent's consent is recorded.

Data is never sold or used for advertising. These providers process data on my behalf, under data processing agreements (Art. 28 GDPR):

Google Ireland Ltd. (Google Workspace: email, document storage, Google Meet); Zoom Communications Inc. (online sessions); the company that hosts the servers of this website and its booking system (EU); the company that sends booking emails (EU); Google Analytics, only with your consent.

My accountant receives only invoicing data.

Public authorities, courts or the Colegiul Psihologilor receive data only when the law requires it.

Other professionals (a doctor, a school, another therapist) receive information only with your written consent.

MISSING: names of the accountant, the hosting provider and the email provider, each with a signed data processing agreement (Art. 28 GDPR). Add before the site goes live.

Google and Zoom may process data in the United States. The hosting and email providers are chosen inside the EU. These transfers rely on the EU–US Data Privacy Framework adequacy decision of 10 July 2023 for certified providers, and otherwise on the European Commission's Standard Contractual Clauses (Decision 2021/914).

Session notes and assessment results are not entered into the booking system. You can ask for a copy of the safeguards used.

Psychological records (tests, results, notes, recordings): at least 10 years after our professional relationship ends, as the Code of Ethics of the psychologist profession requires, then destroyed.

Invoices and accounting documents: 5 years, counted from 1 July of the year after the financial year in which they were drawn up (Law 82/1991 on accounting, Art. 25), or longer where the law requires.

Bookings that did not lead to a session: deleted after 12 months.

Contact form messages: deleted 12 months after the last reply.

Records of your consent: for as long as the processing lasts, plus the 3-year general limitation period.

Analytics data: 14 months.

Sign-in and access records: 12 months.

Devices are encrypted and protected with two-step sign-in. Only I have access to clinical records. In the booking system, phone numbers, email addresses, notes, messages and scanned forms are stored encrypted, the admin area needs a password and a code from an authenticator app, and the emails I receive about bookings and messages never contain names or message text. Paper files are kept in a locked cabinet. Online sessions are never recorded.

If a data breach happens, I notify the supervisory authority (ANSPDCP) within 72 hours (Art. 33 GDPR), and you directly if it puts your rights at high risk (Art. 34 GDPR).

You have the right to access your data, have it corrected or deleted, restrict how it is used, receive it in a portable format and object to its use (Art. 15–21 GDPR).

You can withdraw consent at any time, as easily as you gave it. Processing done before that remains lawful.

Some records cannot be deleted on request while the law requires me to keep them; in that case I tell you which, and for how long.

Write to contact@anaradu.ro. I reply within one month, free of charge. For complex requests this can be extended by two months, and I will tell you why.

Where I process your data because of a legitimate interest (for example to defend legal claims or to keep the booking system secure), you can object at any time, for reasons relating to your situation (Art. 21 GDPR). I then stop, unless I have compelling legitimate grounds or need the data for legal claims. I do not send newsletters or advertising, so there is no direct marketing to object to.

You can complain to the Romanian supervisory authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 București, anspdcp@dataprotection.ro, www.dataprotection.ro. You can also go to court.

Contact details are needed to book. Without information about the reason for the visit, I cannot provide the service. Analytics cookies are entirely optional.

The date at the top shows the latest version. If something important changes, clients with an ongoing relationship are told by email.