Privacy policy

Introduction

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, GDPR), and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter, LOPDGDD), Umera Espai de Psicologia S.L.P. (hereinafter, the “Centre”) informs users about the processing of their personal data, in particular special categories of data, such as health data and data relating to minors, in the course of its professional activity.

Data controller

Identity: Umera Espai de Psicologia S.L.P.
Tax ID (NIF): B19998897
Address: C/ Escorial 139, entresol 3a, 08024 Barcelona
Telephone / WhatsApp: 626 620 763
Email: info@umerapsicologia.com

What data we process

Identification and contact data: first name, surnames, address, DNI (Spanish national identity document) or equivalent document, email address and telephone number.
Health data: information included in the clinical record (reason for consultation, assessments, diagnoses, progress and interventions, among others).
Data relating to minors: data of the minors receiving care and of the persons who hold parental authority or guardianship over them.
Financial data: the data necessary for invoicing and collecting payment for services.
Browsing data: only the data collected through cookies, under the terms of the Cookie policy.

Data submitted through the Website’s forms are stored in the Website’s database and sent to the Centre by email. We ask you not to include detailed information about your health in these forms; where appropriate, we will deal with it in the context of your care.

Purposes and legal bases

Responding to requests for information and appointments received via form, email, telephone or WhatsApp. Legal basis: your consent (Art. 6.1.a GDPR) and the application, at your request, of pre-contractual measures (Art. 6.1.b GDPR).
Providing psychological care, managing appointments, and preparing and keeping the clinical record. Legal basis: performance of the service contract (Art. 6.1.b GDPR); for health data, the provision of healthcare by professionals subject to a duty of professional secrecy (Art. 9.2.h and 9.3 GDPR), together with compliance with legal obligations relating to the clinical record (Art. 6.1.c GDPR).
Invoicing and tax and accounting obligations. Legal basis: compliance with legal obligations (Art. 6.1.c GDPR).
Responding to requests from competent authorities. Legal basis: compliance with legal obligations (Art. 6.1.c GDPR).
Website usage statistics (analytics cookies). Legal basis: your consent (Art. 6.1.a GDPR), which you may withdraw at any time.

No automated decisions are made and no profiles are created using your data.

Data retention

Clinical record: the data it contains are kept for at least fifteen years from the date of discharge of each care episode, in accordance with Article 12 of Law 21/2000, of 29 December, of the Parliament of Catalonia, and Law 41/2002, of 14 November, the basic law regulating patient autonomy.
Contact details of people who do not become patients: only for as long as necessary to respond to the request and, at most, one year.
Invoicing data: for the periods required by tax and commercial legislation (generally four and six years, respectively).
Data processed on the basis of consent: until you withdraw it, without prejudice to the above periods.

Once these periods have elapsed, the data are erased or, where required by law, kept blocked.

Recipients and data processors

Data are not sold or disclosed to third parties, except where required by law. In order to provide the service, the following providers may have access to them, as data processors and under the corresponding contract:

IONOS (web hosting and email).
Docfav (clinical record management software).
Google: Google Analytics, only if you have accepted statistics cookies, and Google Maps (map on the contact page), only if you have accepted it.

International data transfers to Google are covered by the EU-US Data Privacy Framework and, where applicable, by standard contractual clauses approved by the European Commission.

WhatsApp is an optional contact channel, operated by Meta. We recommend that you do not send detailed information about your health through it; if you prefer, you can contact us by email or through the Website’s form.

Minors

In the case of minors under the age of fourteen, consent must be given by the person holding parental authority or guardianship (Art. 7 LOPDGDD). Psychological care for minors will be provided in accordance with the applicable regulations and, where appropriate, with the consent of both parents when required by law. The Centre may request the documentation necessary to verify legal representation.

Security measures

The Centre applies technical and organisational measures to ensure the confidentiality, integrity and availability of data, including:

Physical protection: paper documentation kept in locked cabinets.
Digital protection: storage of clinical records in systems that comply with security regulations, encryption where appropriate and access control to information systems.
Periodic reviews: to detect and reduce potential risks.
Security breaches: a protocol for detection, analysis and notification within the time limits established by law.

Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, as well as withdraw any consent you have given, without affecting the lawfulness of prior processing. The right to erasure does not apply to data that must be kept by law, such as clinical record data during the legal retention period.

To exercise these rights, you can write to info@umerapsicologia.com or by post to Umera Espai de Psicologia S.L.P., C/ Escorial 139, entresol 3a, 08024 Barcelona, enclosing a copy of your DNI or an equivalent identity document.

If you consider that your rights have not been properly addressed, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

Policy updates

This policy may be updated in response to legislative changes, case-law criteria or changes in the Centre’s services. We recommend reviewing it periodically.

Last updated: September 2026.