PRIVACY POLICY

Last revision: October 9, 2026.

1. DATA CONTROLLER AND SCOPE

The data controller is Beatriz Cabrillo Cachafeiro, entrepreneur individuel (EI), who carries out a liberal profession activity under the name Beatriz Cabrillo Psicología, with SIRET 92352955600048 and 92352955600030.

• Main address -professional and tax-: 5 Avenue Albert 1er de Belgique, 38000 Grenoble, France.
• Contact for privacy matters: beatrizcabrillo@cop.es.

This policy explains how website data, information requests, and appointment scheduling are handled. Psychological care, medical records, and billing are explained on the Patient Data Protection page and in the specific information provided before the service begins; this policy does not replace that information.

2. CONFIDENTIALITY AND PROFESSIONAL SECRECY

The information received is treated confidentially and in accordance with professional secrecy obligations and the exceptions provided by law. Access must be limited to those individuals who need it for their role and to the information necessary for that role.

This service is exclusively for adults. For initial contact, briefly explain what help you are seeking and avoid including medical documents, unnecessary details, or information from third parties. The website and contact channels are not emergency services. Submitting a request does not guarantee an appointment or, on its own, initiate a therapeutic relationship.

3. PURPOSES AND DATA COLLECTED

• Information requests and appointments: Name, email address, phone number, and message content, so we can respond to your request and schedule an appointment if you ask for one. The message may contain health information, such as symptoms or details about your emotional state.
• Website functionality and security: Technical data of the connection and shipments, necessary to serve the page, protect the form and detect incidents.

The fields marked as required must be completed to submit the form. If you do not provide this information, you will not be able to use this method. Do not attach a copy of your ID card or passport for a simple inquiry.

4. LEGAL BASIS AND HEALTH DATA

• Article 6.1.b of the GDPR: Pre-contractual measures requested by you to respond to a service-related request and to manage an appointment. This basis is limited here to the initial request; the bases for care are explained separately.
• Article 6.1.f of the GDPR: legitimate interest in keeping the website secure and available, limited to the data necessary for that purpose.

To process health data voluntarily included in the initial form message, in addition to the basis in Article 6, your explicit consent is required pursuant to Article 9.2.a of the GDPR. This consent is requested by means of a specific checkbox next to the message, separate from reading this policy and without being pre-ticked. If you do not provide this consent, do not include health data in the message.

You can withdraw that consent at any time by writing to beatrizcabrillo@cop.es, This does not affect the lawfulness of the processing carried out before its withdrawal. Reading this policy, browsing, or using an external service does not constitute general consent to the processing of health data.

This rule regarding the initial message does not automatically extend to the entire therapeutic process. The bases and conditions applicable to clinical data are explained in the specific care information.

5. DATA RETENTION

Contact requests are kept for as long as necessary to respond to and manage the request. If no service relationship is initiated, they are deleted no later than 6 months after the last contact.

If you begin treatment, consult Patient Data Protection and the service-specific information. Clinical, administrative, and tax documentation has its own retention periods, depending on its purpose and applicable legal obligations; the 6-month period does not apply to medical records or invoices.

Technical records are kept for as long as necessary for the operation and safety of the service. Any subsequent retention for the purpose of fulfilling obligations or addressing claims is limited to the information required and to authorized access.

6. STORAGE, RECIPIENTS AND SUPPLIERS

The website uses WordPress and Elementor. The form is processed using Fluent Forms, and entries are stored in the Raiola hosting database. Backups may contain this information.

The form notification is sent via SMTP from contacto@beatrizcabrillopsicologia.com to beatrizcabrillo@cop.es; A confirmation is also sent to the email address provided by the person making the inquiry. Messages may remain in inboxes. Deleting a post in WordPress does not automatically delete associated emails or backups.

The person in charge handles the requests. The mailbox beatrizcabrillo@cop.es It is a service of the Official College of Psychology of Madrid for its members and is only read by the person in charge.

Hosting, email, and support providers may be involved according to their role and the necessary permissions: Raiola Networks, SL for hosting, backups, and SMTP transport, and the Official College of Psychology of Madrid as the provider of the cop.es mailbox. Technical access does not authorize the use of clinical information for other purposes.

The communications required by law are limited to authorized recipients and the necessary data. The use of service providers should not be confused with the sale of data or with the absence of access by third parties.

7. EXTERNAL SERVICES AND INTERNATIONAL TRANSFERS

WhatsApp and SumUp are accessed via external links. Their respective terms and privacy policies also apply when using them. WhatsApp belongs to the Meta group; do not use this channel to send medical reports, identity documents, or other people's information. SumUp collects the data necessary for the booking or payment services you use.

Google Maps connects to Google when you load the optional map and may transmit technical data, such as your IP address, and use identifiers. You can view the address without loading the map. The Cookie Policy provides further information.

Information regarding video consultations, clinical data, and billing corresponds to Patient Data Protection and specific information prior to the service.

The providers Raiola and the Official College of Psychology of Madrid are Spanish entities. This does not mean that all the services used process data exclusively within the European Economic Area.

Google, WhatsApp, and SumUp contemplate processing or transferring data outside the European Economic Area, including, depending on the service, the United States. Their policies explain the destinations and applicable safeguards, such as adequacy decisions or contractual clauses where relevant. These safeguards do not, on their own, constitute certification of the suitability of each tool for health data.

You can find supplier information at https://policies.google.com/privacy, https://policies.google.com/privacy/frameworks?hl=en, https://www.whatsapp.com/legal/privacy-policy-eea y https://www.sumup.com/es-es/aviso-de-privacidad/. You can request information about the guarantees applicable to your data from beatrizcabrillo@cop.es.

8. YOUR RIGHTS

You can request access, rectification, erasure, and restriction of processing. You can also exercise your right to object to processing and data portability where applicable. If processing is based on your consent, you can withdraw it without affecting the lawfulness of processing based on consent before its withdrawal. Some rights may be subject to legal limitations, for example, when information must be retained to comply with a legal obligation.

To exercise these rights, write to beatrizcabrillo@cop.es Please indicate the right you wish to exercise and the information necessary to locate your data. Do not attach an identity document by default. Additional information will only be requested to verify your identity if there are reasonable doubts about it.

We will respond without undue delay and, in general, within one month of receipt. If the complexity or number of requests allows for a legal extension, you will be informed within that first month and the reason will be explained.

9. CONTROL AUTHORITY AND UPDATES

You can file a complaint with the CNIL., https://www.cnil.fr/, or to the competent authority in your place of habitual residence, work, or where the alleged infringement occurred. In Spain, you can contact the Spanish Data Protection Agency., https://www.aepd.es/.

This policy is implemented in accordance with the GDPR and relevant national legislation, including the French Data Protection Act (Loi Informatique et Libertés) and Spanish legislation where applicable. If the purposes or tools change, the information will be reviewed before any new processing takes place.