Patient privacy notice

The Controller of your data is your psychologist or your practice. They decide what is written down, what for and for how long, and they are the ones to contact about anything to do with it.

VinculAI is only the software your practice has taken out in order to run itself. We store and process your data on their behalf and following their instructions, nothing more. In the language of the law: your practice is the ‘Controller’ and we are the ‘Processor’.

Your practice’s contact details are on its website, in the emails it sends you and on the booking screen itself.

• Keeping your patient record and your appointments, and letting you know about them by email or notification.
• Keeping what your professional writes about your sessions. It is encrypted and only the person treating you can see it.
• Letting the two of you write to each other in the chat, and letting you share or receive documents.
• Providing the video consultation room when the appointment is online.
• Issuing your invoices and receipts, and processing payment if you pay through the platform.
• Giving you access to the portal so that you can see your appointments, your receipts and your documents.

If you register on the portal, the account —your email address and your password— is also part of the service your practice has taken out. The password is stored encrypted and nobody, ourselves included, can read it.

• We do not sell your data and we do not pass it to anyone for commercial purposes.
• We do not use what you say in therapy to train artificial intelligence. Our contracts with our providers prohibit it.
• Video consultations are not recorded. Ever. There is no record button and nowhere to keep a recording.
• We do not use your data for our own purposes: no statistics, no advertising, no product improvement.
• Nothing in your clinical record appears in technical logs.

Your professional may use an artificial intelligence aid to tidy up or format what they themselves have written. Three things you ought to know:

• Only the specific text they decide to send is sent, not your whole clinical record.
• What comes out is a draft. Your professional reads it, corrects it and signs it: the note is still theirs.
• No decision about you is taken automatically. There are no scores or profiles that shape your appointments or your treatment.

You have the right to access your data, have it corrected, ask for its erasure, object to its processing, restrict it and take it with you to another professional.

Contact your psychologist or your practice. They are the ones who can deal with it. If you write to us, we will pass it on to them and let you know, but we cannot decide on their behalf or give you information of our own accord.

Bear in mind that access to the clinical record has rules of its own, in article 18 of Spanish Act 41/2002 on patient autonomy: your professional may withhold their personal annotations and must protect the third-party data appearing in it. That is their decision, not ours.

You can also lodge a complaint with the Spanish Data Protection Agency (AEPD).

Your practice decides. The law obliges it to keep clinical documentation for at least five years from the end of each episode of care, and its autonomous region may require longer. So even if you ask for everything to be erased, there is part of your clinical record that your professional is obliged to keep.

If you ask them to erase your data (section 5) and your practice carries it out, this is exactly what happens. We would rather tell you beforehand than surprise you afterwards:

• Your file is genuinely erased. Session notes, clinical record, messages, documents and files disappear from the application. They are not left ‘hidden’ or ‘deactivated’.
• Before it is erased, an encrypted and blocked copy is kept. Nobody at your practice can open it —neither your professional nor us—: there is no screen and no button to read it. It is only made available to a judge, to the public prosecutor (Ministerio Fiscal) or to the Spanish Data Protection Agency (AEPD) if any of them asks for it, and it is destroyed once the legal time limit has passed. It is what the law calls ‘blocking’ (article 32 of Spanish Organic Act 3/2018, the LOPDGDD).

And there are two things that cannot be erased, however much you ask for it and however much your practice would like to:

• The clinical documentation the law obliges them to keep for five years (article 17.1 of Spanish Act 41/2002), the same one we were telling you about above.
• The invoices and receipts already issued to you. They carry your name and your tax identification number, and tax and commercial law oblige them to be kept for years. The GDPR says so itself: the right to erasure does not reach what has to be kept to comply with a legal obligation (article 17.3.b).

So if you were never invoiced, your patient record disappears in full and no trace of you remains. If you were, the patient record is emptied —your name and everything clinical are taken out of it— and it stays only as the anchor for those invoices, which still carry your name and your tax identification number because the law does not allow them to be erased.

To make the service work we rely on providers that process data on our behalf: the database is in France, the servers in Germany and the email in France. Payments go through Stripe or PayPal, and the video consultation through 8x8. You have the full list, with what each one receives and where it is, in our privacy policy.

When payment goes through a gateway, the description is always generic —‘Session’—: the name of the service you have booked never leaves the platform. And if your professional synchronises their appointments with their calendar, only your initials and the time are written there.

Your session notes, your messages and the names of your files are encrypted before they are stored. Each practice’s data is isolated from every other practice’s in the database itself, not just in the application. The audio and video of online sessions travel encrypted and are not recorded.

If a security breach affecting you ever occurred, we would notify your practice in under twenty-four hours, and it is your practice that would inform you if that were appropriate.

For your data, your practice. For questions about how the platform itself works, you can write to us at privacidad@vinculai.com.