Privacy policy

Last updated: October 2026

At Metanoia Psychology, I treat your personal data with the same care as what you share in session. This policy explains what data I collect, why I use it, how long I keep it and what your rights are, in line with the General Data Protection Regulation (GDPR/AVG) and the Dutch Medical Treatment Contracts Act (WGBO).

Data controller

Kandela Echeverría Sanz, psychologist, Metanoia Psychology. Amsterdam, the Netherlands. KvK: 42179562. Contact: kandela@metanoia-psychology.com.

What data I collect and why

Contact form. Your name, email address and message, to reply to your enquiry. Please do not include information about your health in the form; we will talk about it during the introductory call.

Bookings through Calendly. Your name, email address, phone number (for the introductory call) and the session format you choose, to manage your appointments and send confirmations and reminders.

If you start therapy. Your contact details, the information you share in sessions and my clinical notes, which form your client record. This is health data, and I protect it with additional safeguards.

Invoicing. Your name, contact details and the payment details needed to issue invoices.

Legal basis

I process your data to respond to your request and to provide the service you engage me for (Art. 6(1)(b) GDPR); to meet my legal obligations, such as keeping a client record and retaining invoices (Art. 6(1)(c) GDPR); and, for health data, because it is necessary to provide psychological care under professional secrecy (Art. 9(2)(h) GDPR).

How long I keep it

Contact form messages: until your enquiry is resolved, and no longer than 3 months.

Booking data if you do not start therapy: no longer than 3 months after the introductory call.

Client record: 20 years from the last change, as required by the WGBO.

Invoices: 7 years, as required by Dutch tax law.

Tools I use

To run the practice, I use the following services, which process data on my behalf under a data processing agreement:

Framer: hosting this website and the contact form.

Calendly: appointment booking, confirmations and reminders.

Google Workspace: professional email and calendar.

Google Meet: online video sessions.

Some of these providers may process data outside the European Economic Area. Where this happens, transfers rely on the safeguards provided by the GDPR, such as the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

Cookies

This website uses the cookies needed for it to work. The Calendly booking calendar may set its own cookies when it loads; you can manage them through the cookie notice and the “Cookie settings” link in the calendar itself.

Confidentiality and security

Everything you share in therapy is confidential and protected by professional secrecy. I will only share it with third parties with your written consent, unless the law requires it or there is a serious risk to your life or someone else’s. I do not sell or share your data with third parties for commercial purposes.

Your rights

You can ask me at any time to:

Access your data and receive a copy.

Correct inaccurate data.

Delete your data, within the limits the WGBO sets for client records.

Restrict or object to its processing.

Receive your data in a portable format.

Email me at kandela@metanoia-psychology.com. I will reply within one month. If you are not satisfied with my response, you can file a complaint with the Autoriteit Persoonsgegevens, the Dutch data protection authority.

Changes to this policy

I may update this policy when my services or the law change. The date of the last update appears at the top.