Privacy Policy

Controller

The controller for data processing on this website is Katharina Helms, Helms Psychology, Hauptstrasse 20, 5444 Künten, Switzerland, email: katharina@helmspsychology.com. Consultations take place exclusively online; there are no practice premises. As I work from Switzerland while the service is expressly also aimed at people in Germany and Spain, a representative in the EU has additionally been appointed under Art. 27 GDPR: [name and address of the EU representative].

Applicable law

The Swiss Federal Act on Data Protection (revFADP) applies to the processing of personal data. Because I work exclusively online and this service is deliberately also aimed at people in Germany and Spain — among other things through Google Ads campaigns in those countries — the European General Data Protection Regulation additionally applies (Art. 3(2) GDPR). Where the two regimes differ, I apply whichever rule is more favourable to you.

What data is processed

Depending on how you use this website, different data arises:

• Account and profile data: name, email address, a unique user identifier and the time of registration, if you sign in with your Google account.
• Booking data: booked sessions, appointment times and your remaining session allowance.
• Communication data: the content and time of emails you send me.
• Technical data: to deliver the page, the server necessarily processes your IP address along with browser and operating system details. No access log is kept in doing so. Only when a request fails does the proxy in front record an error entry, which can contain the IP address.
• Usage data for audience measurement: only with your consent, see the “Web analytics” section.

Health data and professional secrecy

The mere fact that you book a psychological session is health data within the meaning of Art. 9 GDPR and sensitive personal data under Art. 5(c) revFADP. I process such data only as far as it is necessary for the consultation and its administration, relying on your explicit consent (Art. 9(2)(a) GDPR). Independently of data protection law, I am bound as a psychologist by professional secrecy (Art. 321 of the Swiss Criminal Code). Session content is not stored on this website.

Purposes and legal bases

I process your data only for clearly defined purposes:

• Providing and securing the website — legitimate interest (Art. 6(1)(f) GDPR).
• Account, appointment booking and management of your session allowance — performance of our contract (Art. 6(1)(b) GDPR).
• Answering enquiries by email — pre-contractual steps or legitimate interest.
• Web analytics and advertising measurement — solely your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).
• Compliance with statutory retention obligations — legal obligation (Art. 6(1)(c) GDPR).

Hosting and recipients

Data is passed only to carefully selected service providers acting as processors on my behalf:

• Hosting: the server is located in a data centre in Germany. The provider is netcup GmbH, Karlsruhe, Germany, acting as a processor on my behalf.
• Google Firebase (sign-in and database): Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — processes sign-in, profile and booking data.
• Cal.com (appointment booking): I use the European instance cal.eu operated by Cal.com, whose servers are located in the EU; it processes name, email address and appointment data. The platform is not self-hosted by me.
• Google Analytics and Google Ads: Google Ireland Limited — only after your consent.
• Google Meet (video counseling): Google Ireland Limited — connection data and audio and video during the session.

Video counseling

Counseling takes place via video using Google Meet, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Connection data and real-time audio and video are processed; sessions are not recorded. A data processing agreement with Google is in place (Google Workspace Data Processing Addendum). Where data is transferred to the USA, this is based on the EU-US Data Privacy Framework, the Swiss-US Data Privacy Framework and standard contractual clauses.

Contact by email

If you write to me by email, I process your details to answer your enquiry (Art. 6(1)(b) or (f) GDPR). Where possible, please share confidential matters within the protected setting of the counseling itself rather than by unencrypted email.

Transfers abroad

The server is located in Germany. By decision of 15 January 2024 the European Commission confirmed that Switzerland provides an adequate level of data protection, and the Swiss Federal Council in turn recognises the EEA states as adequate — so data exchange between Switzerland and Germany or Spain requires no additional safeguards. Where Google or Cal.com transfer data to the United States, this is based on the EU-US Data Privacy Framework, the Swiss-US Data Privacy Framework and standard contractual clauses.

Retention and erasure

I keep data only as long as necessary for the relevant purpose or as required by law:

• Account and booking data: for as long as your account exists, then until statutory retention periods expire.
• Counseling-related records and business documents: in line with statutory retention periods, generally ten years; after that they are deleted.
• Log data: no access log is kept. Proxy error entries are used solely for troubleshooting and are deleted as soon as they are no longer needed for that purpose.
• Your web analytics decision: until you withdraw it; it is stored solely in your browser.

Data security

The website is served exclusively over encrypted HTTPS. Access to account and booking data is set up so that you can only view your own data; your session allowance can be changed server-side only, never from the browser.

Web analytics (Google Analytics)

This website uses Google Analytics, a service provided by Google Ireland Limited. It is used only with your explicit consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Until you consent, no analytics script is loaded and no cookies are set. You can withdraw your consent at any time, with future effect, via “Cookie settings” in the footer.

Advertising (Google Ads)

I use Google Ads for campaigns in Switzerland, Germany and Spain. If you reach this website through an ad and consent to web analytics, it can be measured that an ad click led to a visit (conversion measurement). Without your consent no advertising script is loaded, no advertising cookies are set and no remarketing takes place. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you may withdraw at any time.

Cookies and local storage

No cookies beyond those that are technically necessary are set before you consent. Signing in to the client area requires technically necessary entries in your browser storage; without them the login does not work. Your web analytics decision is stored locally in your browser under the key “kira-cookie-consent” and is not transmitted to the server.

Your rights

Under the applicable law you have, in particular, the following rights:

• Access to the data processed about you (Art. 15 GDPR, Art. 25 revFADP).
• Rectification of inaccurate data (Art. 16 GDPR, Art. 32 revFADP).
• Erasure of your data, unless a retention obligation prevents it (Art. 17 GDPR).
• Restriction of processing (Art. 18 GDPR).
• Receiving and porting your data (Art. 20 GDPR, Art. 28 revFADP).
• Objection to processing based on a legitimate interest (Art. 21 GDPR).
• Withdrawal of consent with future effect — for web analytics at any time via “Cookie settings” in the footer.

Right to lodge a complaint

If you believe that the processing of your data infringes applicable law, you may lodge a complaint with a supervisory authority:

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC), Bern.
• Spain: Agencia Española de Protección de Datos (AEPD), Madrid.
• Germany: the state data protection authority responsible for your place of residence.

Changes to this notice

I update this privacy notice when the website, the services used or the legal situation change. The version published on this page is the one that applies.