Health data is a special category of personal data under the GDPR and may be processed only on a valid legal basis with appropriate safeguards.
1. Data controller
- Name of the data controller: Katalin Vegh Arregoces
- Professional title: Accredited Psychologist by SZTE, Hungary
- Registered business address: 08328 Alella, Spain
- Contact email: info@katavegh.org
- Website: www.katavegh.org
2. Purpose of processing
Personal data and health data are processed for the purpose of providing psychological services, including client intake, assessment, counselling or therapy, record keeping, scheduling, professional communications, invoicing, and compliance with applicable legal and professional obligations. Under Spanish data protection guidance, processing should be limited to the minimum data necessary for the purpose for which it was collected.
3. Legal basis
The legal basis for processing ordinary personal data may include consent, performance of pre-contractual steps or services, and compliance with legal obligations, depending on the activity concerned. Health data is special-category data under Article 9 GDPR and may be processed where the client gives explicit consent or where another permitted condition under Article 9(2) applies, including the provision of health or social care or treatment, subject to professional secrecy and appropriate safeguards.
4. Categories of data processed
The following categories of data may be processed:
- Identification and contact data.
- Information relevant to appointments and service administration.
- Health and psychological information disclosed by the client or generated during the professional service.
- Session notes and professional records.
- Communications relating to the service, including email and messaging where used for appointment or care-related purposes.
- Billing and payment information where applicable.
5. Confidentiality and disclosure
All personal data and health data obtained in the course of professional practice are treated as confidential. Data will not be disclosed to third parties unless disclosure is required by law, necessary to protect vital interests, necessary for the provision of care through properly engaged service providers, or expressly authorized by the client where consent is the appropriate basis.
6. Storage and security
Electronic records and communications are stored using appropriate technical and organisational measures designed to restrict unauthorized access. Paper records, if any, are kept securely and access is limited to authorised persons only. Spanish guidance states that personal data should be retained only for the time necessary for the purpose collected and to determine possible liabilities arising from that purpose and the processing of the data.
7. Recipients and processors
Personal data may be shared only with recipients strictly necessary for the management of the service or where disclosure is legally required. Where external providers are used, such as email, practice management, cloud storage, invoicing, or video consultation providers, they must operate under appropriate contractual and data protection safeguards.
8. Retention period
Personal data and health data will be retained for as long as necessary to provide the professional service and for any additional period required by applicable Spanish or EU law, professional obligations, or limitation periods. Spanish public guidance states that data should be kept for the time necessary to fulfil the purpose of collection and to determine possible liabilities.
9. Data subject rights
The client may request access to personal data, rectification of inaccurate data, erasure where applicable, restriction of processing, objection, data portability where applicable, and the right not to be subject to decisions based solely on automated processing, under the conditions established in Articles 15 to 22 GDPR. The client also has the right to lodge a complaint with the Spanish Data Protection Agency (AEPD). The Ministry of Health identifies the AEPD as the competent authority for complaints where the response to a rights request is unsatisfactory.
10. Consent statement
By signing below, the client confirms that:
- the client has received clear information about the processing of personal data and health data;
- the client understands that health data receives special protection under the GDPR; and
- where consent is relied upon, the client gives explicit consent to the processing of personal data and health data for the specified purposes connected with the provision of psychological services.
The client understands that consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before the withdrawal of consent.
