1. The controller
Cabinet Individual de Psihologie Voicu Dragoș
Voicu Dragoș - Clinical Psychologist and Psychotherapist
CPR personal code: 20822 · CPR practice authorisation: 10B11301
52 San Marco Street, Tunari, Ilfov County
Phone: +40 721 845 660 · E-mail: dragosv17@gmail.com
Website: psiholog-voicu.ro
2. Who this policy applies to and where the data comes from
This policy applies to people making enquiries, adult and minor beneficiaries, parents or legal representatives, couples-therapy participants, people with or without an account, clients registered for administrative purposes, testimonial authors, visitors and people who choose optional communications.
Data may come from the website form, telephone, SMS, e-mail, WhatsApp, direct communication, physical forms, a legal representative, the optional account or an entry made by the administrator at the person's request.
3. Data, purposes and legal bases
- name and contact details, enquiries, availability and appointments — to respond, take pre-contractual steps and organise services;
- account and authentication data — only when the person chooses to have an account;
- legal representatives, legal documents and informed consent — to meet legal and professional obligations;
- preferences, administrative communications and reminders — to perform the relationship, take pre-contractual steps or pursue a legitimate interest, as applicable;
- marketing choices and withdrawals — solely on the basis of separate consent for each channel;
- tax, technical, security and audit data — to meet legal obligations, maintain security and defend rights;
- testimonials — with the privacy information kept separate from the optional agreement to publication;
- professional data and, where necessary, special categories of data — separately from the administrative form, in accordance with the law and professional confidentiality.
Consent is not used as a universal legal basis. The appointment form has two mandatory and independent checkboxes: one confirms that the privacy information has been read, and the other accepts the terms. Neither constitutes professional informed consent for psychological services.
4. Phone, WhatsApp and marketing
A valid number may be used for administrative confirmations, rescheduling, cancellations or reminders. A single channel is ordinarily used, and messages do not include clinical information. Operational WhatsApp messages can be disabled or moved to another channel on request.
Marketing is optional and separate for e-mail, WhatsApp and telephone calls. Changing an address or number does not automatically transfer a preference. Withdrawal is recorded, and minimum suppression evidence prevents unwanted communications from resuming. The application does not currently have a campaign engine or a configured WhatsApp Business provider.
5. Recipients and transfers
Data may be accessed or processed, strictly to the extent necessary, by providers of technical services such as hosting, databases, authentication, e-mail, cookie-preference management and other services required to operate the website and administer appointments.
Where processing involves a transfer of data outside the European Economic Area, it takes place only under the conditions and safeguards laid down in Chapter V of the GDPR. Further information about the applicable recipients and transfer mechanisms may be requested from the practice.
6. Client account
The account is optional. A public request may create only an administrative profile, not a user account. An invitation may be sent later, and linking the account requires verification. Declining an account does not prevent the service; records are not merged automatically on the basis of name or phone number alone.
7. Retention
- enquiry where the service does not begin: no more than 6 months from the last communication;
- active/archived administrative relationship: for the duration of the relationship and, ordinarily, for up to 3 years from the last session or relevant communication;
- professional records and consents: at least 10 years from the end of the professional relationship; longer only where required by law or professional rules;
- tax documents: for the period required by applicable tax and accounting legislation;
- technical logs: only for as long as necessary for security, diagnostics and the defence of rights;
- marketing: until consent is withdrawn or, without reconfirmation or interaction, for no more than 3 years; suppression: the minimum evidence required is retained after withdrawal to prevent unwanted communications from resuming;
- data subject requests: while the request is being handled and afterwards for as long as necessary to demonstrate compliance and defend rights;
- legal hold: the applicable periods are suspended for data strictly necessary for a legal obligation, legal proceedings or the defence of rights.
Archiving is logical and is not equivalent to deletion. The first version of the workflow does not perform automatic deletions; cases reaching their deadline enter a manual review.
8. Your rights
You may request access, rectification, deletion within the limits of legal and professional obligations, restriction, objection, portability where applicable, and withdrawal of optional consents. Write to the controller using the details above. You have the right to lodge a complaint with the ANSPDCP, the Romanian data protection authority.
9. Professional confidentiality
Professional information is confidential. Disclosure is limited to the minimum necessary in cases provided by law: imminent risk, suspected abuse or neglect, legal obligations, the defence of rights or emergencies. Supervision and professional consultation use anonymised or pseudonymised information, or rely on consent where it is required.
10. References and updates
Official references: Regulation (EU) 2016/679, Law no. 190/2018, Law no. 506/2004 and the Romanian College of Psychologists.
Material changes will receive a new version and effective date.