Privacy policy

This policy explains what personal data is processed when you visit www.normachica.com, write to the Professional or use the booking platform app.normachica.com, what it is used for, who it is shared with and what rights you have. Regulation (EU) 2016/679 (GDPR) applies and, where relevant, national data protection law (in Spain, Organic Law 3/2018, LOPDGDD).

1. Data controller

• Controller: Norma Nicole Chica Chiriboga, trade name "Normachica" (hereinafter, "the Professional")
• Establishment: Austria
• Profession: psychologist registered with the Col·legi Oficial de Psicologia de la Comunitat Valenciana (COPCV), no. CV20627
• Contact for any privacy matter: info@normachica.com · +34 666 219 394

2. What data is processed

• If you browse the website: technical data (IP address, browser, pages visited) and, only if you accept it in the cookie notice, usage data for statistics.
• If you write via the form, by email or on WhatsApp: name, email, phone number and the content of your message, which may include information about your health if you choose to share it.
• If you use the Platform: your account data (name, email, phone number, date of birth and billing details), answers to the initial questionnaire (for example your goals and whether you have had therapy before), appointments, payments, messages, signed consents and invoices. Your card details are processed directly by the payment processor; the Professional neither sees nor stores them.
• Session records: the notes the Professional takes during sessions.

The initial questionnaire, messages about your situation, sessions and notes contain health data, which the GDPR treats as a special category (Article 9) and which is processed with enhanced safeguards.

No data of anyone under 18 is processed: the services are for adults only.

3. Purposes and legal basis

• Replying to your enquiries (form, email, WhatsApp). Basis: your consent (Art. 6(1)(a) GDPR) and, for any health data you include, your explicit consent (Art. 9(2)(a)).
• Managing your account, bookings, payments and appointment reminders. Basis: performance of the contract (Art. 6(1)(b)).
• Providing the sessions and keeping session records. Basis: your explicit consent, given in the informed consent (Art. 9(2)(a)), and care provided by a professional bound by professional secrecy (Arts. 9(2)(h) and 9(3)).
• Issuing invoices and meeting tax and accounting obligations. Basis: legal obligation (Art. 6(1)(c)).
• Sending you reminders if you leave registration unfinished, or other marketing communications. Basis: your consent, which you can withdraw at any time (Art. 6(1)(a)).
• Website usage statistics (Google Analytics). Basis: your consent in the cookie notice (Art. 6(1)(a)).
• Security, abuse prevention and technical logs. Basis: legitimate interest in protecting the website and the Platform (Art. 6(1)(f)).
• Handling or defending possible claims. Basis: legitimate interest (Art. 6(1)(f)) and, for health data, Art. 9(2)(f).

No decisions are made based solely on automated processing and no profiles with legal effects on you are created. Your data is not sold.

4. Who it is shared with

Data is shared only with the providers the Professional needs to deliver the service, who process it on her behalf as data processors, under contracts compliant with Art. 28 GDPR:

• Supabase: Platform database (servers in Ireland, EU).
• Vercel Inc.: Platform hosting.
• Stripe: payment processing.
• Whereby AS (Norway, EEA): session video calls.
• Brevo (Sendinblue SAS, France): sending service emails.
• Google: Google Calendar, to manage the appointment schedule, and Google Analytics, for website statistics only if you accept it.
• Cloudflare: security and delivery of the website and the Platform.
• iubenda S.r.l. (Italy): cookie consent management.
• WhatsApp (Meta): only if you choose to write on WhatsApp.
• Hosting provider of the website www.normachica.com.

Data may also be disclosed to public authorities, judges and courts where there is a legal obligation. Outside these cases, information from sessions is not disclosed to anyone without your consent, except for the legal exceptions to professional secrecy.

5. Transfers outside the European Economic Area

Some providers (for example Vercel, Stripe, Google, Cloudflare or Meta) may process data from the United States. In those cases the transfer is based on the EU-US Data Privacy Framework (Art. 45 GDPR) or on standard contractual clauses approved by the European Commission (Art. 46 GDPR). You can ask for more information at info@normachica.com.

6. How long it is kept

• Enquiries that do not lead to a purchase: 12 months from the last contact.
• Unfinished registration and marketing communications: until you withdraw your consent or, at most, 12 months.
• Account data: while the account is active and up to 2 years after closing it.
• Session records and informed consent: at least 5 years from the last session.
• Platform messages: 36 months from sending.
• Invoices and accounting data: 7 years, for tax obligations.
• Technical security logs: 12 months.
• Google Analytics statistics: 14 months.

After these periods, data is deleted or anonymised.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw your consent without affecting prior processing. Write to info@normachica.com stating which right you wish to exercise; if there are reasonable doubts about your identity, you may be asked to prove it. You will receive a reply within one month. Erasure does not cover data that must be kept by law (for example invoices or session records) for the periods stated.

If you believe your data is not being processed correctly, you can lodge a complaint with the data protection authority in your country of residence (in Spain, the Agencia Española de Protección de Datos, aepd.es) or with the Austrian authority (Datenschutzbehörde, dsb.gv.at).

8. Mandatory data

Data marked as mandatory in the forms and on the Platform is necessary to reply to you or provide the service; if you do not provide it, this will not be possible. Other data is optional.

9. Security

Technical and organisational measures appropriate to the risk are applied: encrypted connections, access control, logging of access to sensitive data and encryption of session notes, which only the Professional can access.

10. Cookies

The website uses technical cookies and, only with your consent, statistics cookies. Full information is available in the Cookie policy and you can change your choice at any time from Cookie preferences or from the privacy button in the bottom corner of the screen.

11. Changes to this policy

This policy may be updated because of legal changes or changes to the services. The date of the last update is shown at the top. If the changes are significant, you will be notified by email or on the Platform and, where necessary, asked for your consent again.