Privacy policy

The data controller is [full legal name], tax ID [tax ID], registered at [registered address] ("Psicofit", "we"). You can write to us about any privacy matter at info@psicofit.net.

Data Protection Officer: [Pending: DPO name or entity and contact email]. Because we process health data, you can contact the DPO directly about anything related to your data.

Each psychologist who treats you is also responsible for your clinical record and for the information they collect during therapy, under their professional obligations and code of ethics.

We only ask for what is needed for you to book and attend your sessions:

• Account data: first name, last name and email. If you sign in with Google, also your profile photo. Your password is handled, encrypted, by our authentication provider; we never see it.
• Appointment data: chosen professional, session type, date, time and status of the appointment.
• Payment data: amount, currency, payment status and transaction identifiers. Your card details are processed directly by Stripe; Psicofit does not store them.
• Health data: the fact that you receive psychological care and the information you share with your professional. These are special category data and we protect them as such.
• Security data: sign-in and account access records, with the approximate region you connect from (European Union, Costa Rica or other). We do not store your IP address in these records.
• Consents: which documents you accepted, which version and when.
• Messages you send us: the details you enter in our contact forms (first name, last name, profession, phone, email and message).
• If you are a professional: your identification and licensing details, your public profile (name, photo, bio, specialties), your availability and, if you connect your calendar or video tool, the access credentials, which we store encrypted.

Sessions are not recorded. They take place by video call through the tool your professional uses (Google Meet, Zoom or Microsoft Teams), set up with a waiting room and without automatic recording.

Psicofit does not access the content of your sessions. If your professional takes clinical notes, they do so as the party responsible for your clinical record and under professional secrecy. Psicofit's administrative staff have no access to them.

Every use of your data has a specific purpose and a legal basis that allows it:

• Creating and managing your account: because it is necessary to provide the service you signed up for (Art. 6(1)(b) GDPR).
• Booking, confirming and cancelling your appointments and connecting you with your professional: under the contract (Art. 6(1)(b) GDPR) and, for health data, your explicit consent and the provision of healthcare (Art. 9(2)(a) and 9(2)(h) GDPR).
• Charging for your sessions, issuing invoices and handling refunds: under the contract and to meet our tax and accounting obligations (Art. 6(1)(c) GDPR).
• Sending you service emails, such as account verification, confirmations and appointment changes: under the contract (Art. 6(1)(b) GDPR).
• Protecting the platform, preventing fraud and unauthorised access, and keeping audit logs: our legitimate interest and our duty to keep your data secure (Arts. 6(1)(f) and 32 GDPR).
• Answering the messages you send us: your consent when you write to us (Art. 6(1)(a) GDPR).
• Sending you community news: only if you expressly agree (Art. 6(1)(a) GDPR and Art. 21 LSSI-CE). You can unsubscribe at any time from the email itself or your profile.

We process your data with your free, express, unequivocal and informed consent, as required by Article 5 of Law 8968. Before asking for it, we tell you what this policy sets out: that a database exists, what it is used for, who receives the data, which data are mandatory and what happens if you do not provide them, and how to exercise your rights.

Your health data are sensitive data under Article 9 of Law 8968. No one is obliged to provide them: we only process them with your express consent and solely to provide the care you request.

Unless a special law requires a different period, we do not keep your data for more than ten years after the purpose for which we collected it ends (Art. 6, Law 8968).

Our database will be registered with PRODHAB when the law requires it. [Pending: confirm registration and registration number.]

• We do not sell or rent your data.
• We do not show personalised advertising or share your data with advertisers.
• We do not make automated decisions or build profiles that produce effects on you (Art. 22 GDPR).
• We do not send clinical notes or data that identifies you to artificial intelligence services.

We only share your data when it is needed to provide the service or when the law requires it:

• Your professional: your name, your email and the details of your appointments with them.
• Stripe: processes your payments.
• Google Firebase: handles sign-in and account verification.
• MongoDB Atlas: hosts our database in the European Union.
• Vercel: hosts the website and the app.
• Cloudflare: stores files such as professionals' profile photos.
• Resend: sends our emails.
• Google, Microsoft or Zoom: only if your professional uses them for their calendar or video calls. They receive the date and time of the appointment and the session link.
• Public authorities, courts and tribunals: only when a law obliges us.

Providers that process data on Psicofit's behalf do so under a data processing agreement (Art. 28 GDPR): they may only use your data following our instructions, must protect it and may not use it for their own purposes. [Pending: confirm the data processing agreement signed with each provider.]

Before bringing on a new provider we check that it complies with the GDPR, where it stores data and whether it transfers data outside the European Union.

We keep your data on servers located in the European Union. Some of our providers are US companies and could access it from there. In that case the transfer is protected by the EU-US Data Privacy Framework or by standard contractual clauses approved by the European Commission (Art. 46 GDPR).

Psicofit connects patients and professionals in Spain and Costa Rica. If you book with a professional in another country, we share the data they need to treat you. Costa Rica does not have an adequacy decision from the European Commission: this disclosure is based on it being necessary to provide the service you request (Art. 49(1)(b) GDPR) and we protect it with standard contractual clauses. Under Article 14 of Law 8968 it also requires your express consent.

• Your account: while it is active. If you ask us to delete it, you have 30 days to change your mind; after that, we delete it permanently.
• Appointments, payments and invoices: as long as tax and commercial law require. In Spain, up to six years (Art. 30, Commercial Code). In Costa Rica, the period set by Costa Rican tax law.
• Clinical record: kept by your professional for the legal period. In Spain, at least five years from discharge (Art. 17, Law 41/2002).
• Security logs: [Pending: define retention period].
• Contact messages: until we have answered and resolved your query. [Pending: define maximum period.]
• When a period ends, we block the data the law requires us to keep: it is no longer available and can only be accessed by judges, courts or competent authorities (Art. 32 LOPDGDD). Then we delete it.

You can exercise these rights at any time, free of charge:

• Access: find out what data of yours we process and get a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data when it is no longer needed.
• Objection: object to us using your data for a specific purpose.
• Restriction: ask us to temporarily stop using your data while a complaint is resolved.
• Portability: receive your data in a structured, commonly used format to take it to another service.
• Withdrawing your consent: without affecting what we did before you withdrew it.

From your account settings you can download a copy of your data and request deletion of your account. For any other right, write to info@psicofit.net with the subject "Data protection".

To protect your information, we may ask you to confirm your identity before answering. We will reply within the deadline set by the law of your country: one month in Spain and the European Union (extendable by two months if complex) and five business days in Costa Rica.

If you disagree with our answer, you can complain to the Spanish Data Protection Agency (www.aepd.es), to the data protection authority of your EU country or, if you live in Costa Rica, to PRODHAB (www.prodhab.go.cr).

All information travels encrypted (HTTPS/TLS) and is stored encrypted. Professionals' calendar and video call credentials have an additional layer of encryption.

Access is limited to those who need it: each professional only sees their own patients' data, and we log relevant access and changes.

If we ever suffered a security breach affecting your data, we would notify the competent authority (in Spain, within 72 hours at most) and inform you without delay when it could pose a high risk to you, as required by Articles 33 and 34 GDPR and Costa Rican law.

Psicofit is intended for people aged 18 or over. If we find out that a minor has created an account, we will delete it along with their data. If you are a parent or guardian and believe this has happened, write to us.

We only use technical cookies and local storage, essential for the platform to work: keeping you signed in and processing payments securely (Stripe uses its own cookies to prevent fraud on the payment page).

We do not use analytics or advertising cookies. Since technical cookies do not require consent (Art. 22(2) LSSI-CE), we do not show you a cookie banner. If we ever add other types of cookies, we will ask for your permission before enabling them.

This policy applies equally to the Psicofit app for iOS and Android. The app only asks for device permissions when it needs them for a specific feature, and you can revoke them at any time from your phone's settings. [Pending: list the permissions the app uses, such as notifications, camera or microphone, once it is published.]

We may update this policy to reflect changes in the service or the law. If the change is significant, we will email you before it takes effect and, where the law requires it, ask for your consent again. The date of the last update always appears at the top of this page.

If you have any questions about this policy or how we process your data, write to us at info@psicofit.net.