Privacy policy

Data controller

In accordance with current data protection legislation, users are informed that their data will be processed by ALFABETA PSICOLOGIA, SL (THE CONTROLLER).

Contact details: ALFABETA PSICOLOGIA, SL · Tax ID (CIF) B55402341 · Via Augusta, 42, mezzanine floor, door 3 (entresuelo 3), 08006 Barcelona · info@alfabetapsicologia.com · +34 638 676 824.

Data protection officer

Data protection officer: ALFABETA PSICOLOGIA, SL.

What data we process

We process the data you give us when you contact us or ask for an appointment: your name, phone number, email address and whatever you tell us in your message.

If you start psychological or neuropsychological care, we will also process health data, which the law treats as a special category of data and which we protect with reinforced measures.

While you browse the website, and only if you accept it, usage data is collected through cookies. We explain this in the Cookie policy.

Please do not send detailed clinical information in your first contact by WhatsApp or email: what is needed to advise you and arrange an appointment is enough.

Purpose of processing

Contact form / Appointments

The purpose of processing is to respond to your request and to manage the relationship and contact with you.

• Responding to your enquiry and managing appointments by WhatsApp, phone or email.
• Providing the psychological or neuropsychological care you request and keeping your clinical record, as health regulations require.
• Invoicing and meeting our legal, accounting and tax obligations.
• Measuring website use statistically, only if you accept analytics cookies.

We do not make automated decisions or build profiles with your data.

Legal basis for processing

We process your data because the law allows us to in each of these cases:

• Enquiries and appointments: your consent when you contact us and, at your request, the application of pre-contractual measures (Art. 6.1.a and 6.1.b GDPR).
• Psychological care: providing the service you request and healthcare (Art. 6.1.b and 9.2.h GDPR), as well as the obligations of Spanish Law 41/2002 on patient autonomy.
• Invoicing: compliance with legal obligations (Art. 6.1.c GDPR).
• Analytics cookies and Google map: your consent (Art. 6.1.a GDPR and Art. 22.2 of the Spanish LSSI).

You can withdraw your consent at any time. Doing so does not affect the lawfulness of processing carried out before withdrawal.

Minors

We see children and adolescents. For children under 14, the data are provided, and consent is given, by their parents or legal guardians.

From the age of 14, minors can consent to the processing of their own data (Art. 7 of Spanish Organic Law 3/2018), without prejudice to what health regulations establish for clinical care and for informing their legal representatives.

If you are under 14, please do not send us your data: ask your father, mother or guardian to contact us.

Disclosure of data

We do not sell your data. We only disclose it to third parties when there is a legal obligation —for example, to the tax authorities or to courts when required— or when, with your knowledge and on the terms agreed, we coordinate care with a school or other professionals.

To operate, we rely on providers that process data on our behalf or that receive data when you use their services:

• WhatsApp (Meta Platforms Ireland Ltd.), if you write to us through that channel. It is a third-party service with its own terms; if you prefer not to use it, you can call or email us.
• Gmail (Google), as our email service provider.
• DocFav: we use DocFav as a cloud platform to store and manage clinical data and centrally manage appointments, clinical records, video consultations, billing and data protection documentation.
• Google Ireland Ltd. (Google Analytics and Google Maps), only if you accept the corresponding cookies.
• Cloudflare, Inc., which hosts and serves this website.

International transfers

Some of the providers listed may process data outside the European Economic Area. In that case, processing must have the safeguards the GDPR requires for international transfers.

Accuracy of data

Users are solely responsible for the accuracy and correctness of the data they provide, and THE CONTROLLER accepts no liability in this respect.

Security measures

THE CONTROLLER has adopted all the technical and organisational measures necessary to guarantee the security and integrity of the personal data it processes, and to prevent their loss, alteration and/or access by unauthorised third parties.

Access to health data is limited to authorised people according to their role in your care, to the coordination agreed with you and to the providers that process data on behalf of the practice, with the reinforced measures their nature requires.

This website may contain links to other websites that could store information about users. THE CONTROLLER is not responsible for the handling of user information or for the data protection and confidentiality terms of other websites.

Changes to this privacy policy

THE CONTROLLER reserves the right to amend its Privacy Policy at its own discretion or as a result of a legislative, case-law or doctrinal change of the Spanish Data Protection Agency. Any amendment will be published at least ten days before it takes effect.

Last updated: 25 September 2026.

Data retention

Data will be kept for as long as necessary to fulfil the purpose for which they were collected and to determine any liability that may arise from that purpose and from the processing.

Data will be kept while the relationship continues or for the years needed to meet legal obligations. Specifically:

• Clinical records: under Article 12 of Catalan Law 21/2000, documentation identifying the person, reports and essential data are kept for at least fifteen years from discharge from each care process; the rest may be destroyed after five years, with the exceptions provided for in the law.
• Invoicing: the periods set by tax and commercial rules (generally six years).

Your rights

You can exercise your rights of access, rectification, erasure, objection, portability and restriction of processing by writing to info@alfabetapsicologia.com. If it is necessary to verify your identity, we will ask for the minimum information needed, in a proportionate way.

You also have the right to lodge a complaint with a competent data protection supervisory authority if you are not satisfied with how your rights have been handled.

In Spain, that authority is the Spanish Data Protection Agency (aepd.es).