Privacy Policy
The essentials
| Controller | Fátima Arantxa Pisón Da Silva (Arantxa Pisón), registered health psychologist no. G-2337 |
|---|---|
| What for | To answer your enquiry, manage your appointment and its payment, and keep your clinical record if you become a patient |
| Legal basis | Healthcare and the contract for the session; your consent for the contact form, the initial evaluation and analytics |
| Who else processes it | The providers that make the website work, always on Arantxa's behalf and never for their own purposes |
| Where it is stored | In the European Union (Germany and Ireland), with US providers under safeguards |
| Your rights | Access, rectification, erasure, objection, restriction and portability, and the right to complain to the AEPD (Spanish Data Protection Agency) |
Who the controller is
| Controller | Fátima Arantxa Pisón Da Silva (Arantxa Pisón) |
|---|---|
| Tax ID (NIF) | 304165271 (Portugal) |
| Address | Avenida das Camelias, 4, 4.º C, 36202 Vigo, Pontevedra, Spain |
| hola@arantxapison.com |
What data is processed and what for
This website does not ask you to register and does not build profiles about you. Only the data you provide is processed.
If you write through the contact form
Your name, your email, your phone number if you give it, the format you prefer and your message, in order to reply to you. The legal basis is your consent, which you give by ticking the box and sending it.
If you write by email
What you write to hola@arantxapison.com (your name, your address and your message) and Arantxa's replies are stored encrypted in her diary, only to answer you and, if you become a patient, for your care. The legal basis is your consent when you write and, if you are a patient, healthcare.
If you take the initial evaluation
Your answers to the ten questions, your name and your email, in order to send you the guidance and reply to you if you ask. Some answers may reveal something about your health, which is why they are processed with your explicit consent, which you give in the form's checkbox and can withdraw at any time.
If you book an appointment
Your name, your email and your phone number, the service, the format, the day and time and, if you pay, the payment. Booking an appointment with a psychologist already says something about your health, so this data is handled with the care given to health data. The legal basis is healthcare (Article 9(2)(h) GDPR, Article 9(2) of Spanish Organic Law 3/2018 and Spanish Law 41/2002) and the steps needed to provide the service you request (Article 6(1)(b) GDPR). You are not asked for separate consent to book.
The field «Anything you would like to tell me before the session?» is optional. What you write there is used only to prepare your appointment, is covered by Arantxa's professional secrecy and is stored encrypted.
If you become a patient
Your clinical record (the session notes) is kept, as required by Spanish Law 41/2002. It is encrypted and only Arantxa reads it.
Appointment emails
You will receive automatic emails when you book, when your appointment is confirmed, changed or cancelled, and a reminder the day before. They contain nothing of what you have shared.
Payments
They are handled by Stripe on its own pages. Your card never reaches this website. The receipt shows «Servicio profesional» (professional service), without saying what for.
Analytics
Only if you accept it in the cookie notice, Google Analytics measures visits to the website (pages viewed and where you come from), without any data from the forms. You can change your choice at any time from «Cookie settings», at the bottom of every page. The details are in the cookie policy.
Who else processes your data
Your data is not sold or passed on for commercial purposes. These providers work on Arantxa's behalf, under contract, and cannot use it for anything else.
| Who | What for | Where |
|---|---|---|
| Nacho Monge (nachomonge.com) | Maintains the website and its panel. Receives the contact and evaluation messages in his own tool to help Arantxa answer them, and stores the emails that reach hola@arantxapison.com encrypted in his portal. He only accesses the clinical notes if Arantxa asks him to, to solve a specific issue | Ireland |
| Neon | Stores the diary, appointments, payments and clinical records | Germany |
| Vercel | Servers for the website and the panel | Ireland |
| Resend | Sends the appointment emails | USA |
| GitHub | Keeps the daily backup of the database, encrypted, for 30 days | USA |
| Stripe | Collects payment for the sessions. It processes payment data as a controller in its own right | According to its policy |
| Analytics, only if you accept it, and Maps, only if you load the map | According to its policy | |
| Webcloud | Hosts the hola@arantxapison.com mailbox | Spain |
| WhatsApp (Meta) | Only if you choose to write via WhatsApp | According to its policy |
Neon, Vercel, Resend, GitHub, Stripe and Google are US companies. Even though the data is in Europe, the European Commission's standard contractual clauses are in place and, where the company has signed up to it, the EU-US Data Privacy Framework.
How long it is kept
| What | How long |
|---|---|
| A booking that is never paid | 24 hours |
| Contact and evaluation messages from people who do not become patients | One year from the last contact |
| Your clinical record and your appointments | At least five years from your last appointment, as required by Spanish Law 41/2002 |
| Payments | Six years, under commercial and tax law |
| Backups | 30 days. If one ever has to be restored, any erasures requested after its date are applied again |
If you ask for your data to be erased, it stops being used at that moment and is kept blocked only for the periods required by law. After that it is erased.
Your rights
You can ask to access your data, correct it, have it erased, object, restrict its use, take it elsewhere and withdraw your consent. Write to hola@arantxapison.com saying what you would like. You will only be asked for anything else if there is reasonable doubt about who you are. From your clinical record, Arantxa may withhold her personal annotations, as Spanish Law 41/2002 allows.
If you believe your rights have not been respected, you can file a complaint with the Spanish Data Protection Agency (AEPD) (calle Jorge Juan, 6, 28001 Madrid, Spain; aepd.es or sedeagpd.gob.es).
Automated decisions
No automated decisions are made and no profiles are built with your data.
Changes to this policy
This policy is updated when what it describes changes. Last reviewed in October 2026.