Personal data information (GDPR)

English is a courtesy translation; the Polish version is binding.

This notice explains how your personal data is processed in connection with using consultations and psychotherapy (as a Client). The processing of data collected by the website itself is described in a separate Privacy policy.

Data controller

The controller of your personal data is Emilia Superson – Psychotherapy Practice, Kobierzyńska 164A/7, 30-382 Kraków, Poland, Tax ID (NIP): 6762665592, REGON: 528161065.

Contact about your data

No Data Protection Officer has been appointed. Any matters concerning the processing of personal data can be raised at: emilia.j.superson@gmail.com.

What data is processed

• identification and contact data: name, email address, optionally a phone number,
• data needed to book and hold a session (e.g. the chosen time),
• health data and other information you share voluntarily during sessions, to the extent necessary to provide therapy,
• billing data related to payment for the service.

Purposes and legal bases

• concluding and performing the service contract (booking, consultation, psychotherapy) – Art. 6(1)(b) GDPR,
• processing health data in order to provide therapy – based on your explicit consent, Art. 9(2)(a) GDPR,
• fulfilling legal obligations, in particular tax and accounting obligations – Art. 6(1)(c) GDPR,
• establishing, pursuing or defending claims, which is the controller's legitimate interest – Art. 6(1)(f) GDPR.

Health data

By its nature, psychotherapy involves sharing information about your health and wellbeing. Such data (special category data within the meaning of Art. 9 GDPR) is processed only to the extent that you disclose it, on the basis of your consent and under professional confidentiality. You may withdraw consent at any time, which does not affect the lawfulness of processing carried out before withdrawal.

Data recipients

Your data may be entrusted to providers whose tools are necessary to deliver the service: the booking system provider (cal.com), the payment operator (Stripe), the email and video-meeting provider (Google – Gmail, Google Meet) and, for settlements, an accounting office. Therapeutic work may be discussed in supervision, but without revealing any data that could identify you.

Transfers outside the EEA

Some tool providers (including Google and Stripe) may process data outside the European Economic Area. In such cases the transfer takes place on the basis of mechanisms provided for in the GDPR, e.g. a European Commission adequacy decision (including the EU–US Data Privacy Framework) or standard contractual clauses.

Retention period

• billing data – for the period required by tax and accounting law,
• data related to the contract and any claims – until the limitation periods for claims expire,
• data processed on the basis of consent – until consent is withdrawn.

Your rights

You have the right to: access your data and obtain a copy, rectification, erasure, restriction of processing, data portability, to object to processing based on legitimate interest, and to withdraw consent at any time. You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).

Is providing data voluntary?

Providing data is voluntary but necessary to book and hold a session. Without contact data the contract cannot be concluded or performed, and without consent to process health data, psychotherapy cannot be provided.

Automated decisions and profiling

Your data is not used for automated decision-making or profiling.