Privacy policy

In compliance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), we inform you about the processing of personal data you provide through this website.

1. Data controller

• Owner: Cristina López — Health Psychologist, license AO11331.
• Tax ID: 44594586R
• Address: Málaga, Spain (specific address available upon request by email)
• Email: cristinalopezpsicologia@gmail.com
• Phone: +34 611 77 63 07

2. Purposes of processing

• Respond to enquiries and information requests sent via the contact form, WhatsApp or email.
• Manage the booking and delivery of online psychology sessions.
• Comply with applicable legal, accounting and tax obligations.

3. Legal basis

• Consent of the data subject when sending the form or initiating contact.
• Performance of a contract for the provision of health services.
• Compliance with legal obligations (Law 41/2002 on patient autonomy, tax regulations).

4. Categories of data

Identification and contact data, as well as, in the therapeutic context, health data processed under strict confidentiality and professional secrecy.

5. Retention

Data is kept for the duration of the professional relationship and afterwards for the periods legally required (minimum 5 years for the clinical record, under Law 41/2002).

6. Recipients and processors

Data will not be shared with third parties unless legally required. The following service providers may access the data as processors:

• Google LLC / Google Ireland Ltd. — professional email (Gmail), Google Calendar and associated Google Workspace services.
• WhatsApp Ireland Ltd. (Meta) — messaging for contact and appointment coordination.
• Calendly LLC — online appointment management and booking (when active).
• Stripe Payments Europe Ltd. — online payment processing (when active).
• Hosting provider for this website and the video consultation platform for online sessions.

Some of these providers may carry out international data transfers outside the EEA. In such cases, the appropriate safeguards provided in the GDPR (standard contractual clauses approved by the European Commission) apply.

7. Rights of the data subject

You may exercise at any time your rights of access, rectification, erasure, objection, restriction of processing and portability by emailing cristinalopezpsicologia@gmail.com. You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Security measures

Appropriate technical and organisational measures are applied to ensure the confidentiality, integrity and availability of the personal data processed.

9. Notice on the use of WhatsApp

WhatsApp is a messaging platform owned by Meta Platforms Ireland Ltd. Although its messages are end-to-end encrypted, it is not a secure healthcare channel and metadata (phone numbers, times, frequency) is processed by Meta. Therefore:

• WhatsApp use is limited to a first point of contact and to coordinating appointments.
• It is recommended not to share detailed clinical information or sensitive health data through this channel.
• For any exchange involving clinical data, email will be used or, preferably, the secure video consultation session itself.
• Starting a conversation via WhatsApp is understood as consent for this specific channel; you may request at any time that communication be moved to another medium.

10. Recording and retention of consent

When you give your consent (contact form, cookie banner), the date, time and version of the accepted text are stored as proof of consent under Art. 7 GDPR. Cookie consent automatically expires after 24 months, after which it will be requested again.

Last updated: 13/08/2026.

See also Cookie policy and Legal notice.