Privacy Policy
Last updated: 22/09/2026
This Privacy Policy explains how the personal data you provide when using the contact form on claudiacalms.com is processed. It is drafted in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD).
1. Data controller
Controller: Claudia Aguas.
Spanish tax ID (NIF): 48689892L.
Activity: General Health Psychologist, COPCV, professional-register (colegiada) no. CV19521.
Address: Quart de Poblet, 46930 (Valencia).
General contact email: claudia.calms.psicologia@gmail.com.
No Data Protection Officer (DPO) has been appointed, because the processing described in this policy does not fall within the cases that require one under Article 37 GDPR and Article 34 LOPDGDD. For any data-protection question, write to claudia.calms.psicologia@gmail.com.
2. What data we process
Through the contact form we collect:
Identification and contact data: the name you provide and your email address.
The area of enquiry you select (and, where applicable, the text you type in the «other» field).
The content of your free-text message: the information you choose to write to explain your request.
Minimal technical data associated with the form submission and email delivery (for example, timestamps and delivery logs generated by the email provider).
All data comes directly from you, through the contact form: it is not collected through tracking or profiling, nor obtained from third parties or publicly accessible sources. We only process what you give us.
2.1. Health data and other special categories
The form does not ask for health data. However, the message field is free-form and you could end up including information about your health or other sensitive information.
We ask you not to include health data or other sensitive information in your message, and to limit it to what is strictly necessary for us to guide you and respond to your request.
If you nevertheless choose to voluntarily include health data in your message, then by ticking the acceptance box and submitting the form you give your explicit consent for that data to be processed for the sole purpose of handling and assessing your contact request (Article 9(2)(a) GDPR). Where that request leads to actual healthcare, the processing will additionally rely on Article 9(2)(h) GDPR (healthcare purposes carried out by a professional bound by professional secrecy).
3. Why we use your data (purposes)
1. To handle and respond to the enquiry or request you send through the form.
2. To assess whether we can help you and, where appropriate, to arrange the start of a therapeutic process (schedule a first session, send you the clinical informed consent and the corresponding health information).
3. To keep a minimal record of the communication for the periods indicated in section 5.
We do not use your data to send you marketing communications, newsletters or advertising of any kind, and we do not share it for marketing purposes.
4. Legal basis for processing
Your consent (Article 6(1)(a) GDPR), which you give by ticking the box accepting this policy and submitting the form.
Steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR), to the extent that your message is a preliminary step towards a possible service relationship.
For any health data you voluntarily include: your explicit consent (Article 9(2)(a) GDPR) and, where applicable, healthcare provision (Article 9(2)(h) GDPR), as explained in section 2.1.
You may withdraw your consent at any time by writing to claudia.calms.psicologia@gmail.com. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
5. How long we keep your data
We distinguish two situations:
If your contact does not lead to a therapeutic relationship: we keep your message and contact data for as long as necessary to handle your request and, at most, 1 year from the last contact, so that we can deal with any later enquiries and demonstrate that the communication was handled properly. After that period the data is deleted or blocked.
If a therapeutic process begins: the data becomes part of the clinical record and is kept in accordance with Spanish Law 41/2002 of 14 November (Article 17): at least 5 years from the discharge date of each course of care, and for any longer periods required by the applicable regional legislation or advisable on prudent clinical grounds. That processing is governed by its own information notice and by the clinical informed consent, which will be provided to you before the first session.
At the email provider (see section 6), the message content remains available while the account is active; the provider retains it for 30 days. After the account is closed it is deleted within 90 days, and backups are kept for a maximum of 7 days.
6. Recipients of the data
Your data is not disclosed to third parties, except where legally required.
For the technical operation of the form, a data processor is used to send and deliver the emails:
Resend (Resend, Inc.), a transactional email delivery provider, acting as a data processor under Article 28 GDPR pursuant to a Data Processing Agreement.
Resend in turn relies on sub-processors, mainly Amazon Web Services (hosting and sending) and Cloudflare (network security). The up-to-date list of sub-processors is published by Resend at https://resend.com/legal/subprocessors
The site does not store your data in any database of its own: messages are received directly by email and handled in the practitioner's mailbox.
7. International data transfers
The email provider (Resend) and its main sub-processor (Amazon Web Services) process and store the information in the United States. This international transfer is subject to the following safeguards:
The European Commission's adequacy decision on the EU-US Data Privacy Framework, with its UK extension, the provider being certified under that framework; and
Standard Contractual Clauses approved by the European Commission (controller-to-processor module), incorporated into the Data Processing Agreement, as an additional safeguard.
You can request further information about these safeguards and a copy of the applicable mechanisms by writing to claudia.calms.psicologia@gmail.com.
8. Your rights
You may exercise the following rights at any time:
Access to your personal data.
Rectification of inaccurate data.
Erasure («right to be forgotten») of your data.
Objection to processing.
Restriction of processing.
Portability of the data you have provided to us, in a structured, commonly used format.
Withdrawal of consent given, without retroactive effect.
To exercise them, write to claudia.calms.psicologia@gmail.com stating the right you wish to exercise. We may ask you to prove your identity. We will respond within one month, extendable under Article 12 GDPR.
No automated decision-making or profiling is carried out with your data, so the right not to be subject to automated individual decisions does not apply.
9. Supervisory authority and users outside Spain
This policy and the processing described are governed by Spanish law and the GDPR, and the lead supervisory authority is the Spanish Data Protection Agency (AEPD).
If you believe that the processing of your data does not comply with the regulations, or you are not satisfied with the response to your request, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6, 28001 Madrid, Spain; https://www.aepd.es; electronic office: https://sedeagpd.gob.es. This is without prejudice to any other administrative or judicial remedy.
If you reside in another European Economic Area country, you may also contact the supervisory authority of your country of residence.
If you reside in the United Kingdom, the practitioner does not intentionally direct her services at the United Kingdom and is therefore not considered subject to the UK GDPR; nonetheless, for transparency, you are informed that you could address your concerns to the UK authority, the Information Commissioner's Office (ICO), https://ico.org.uk. The transfer of data to the United States described in section 7 is covered, as regards the United Kingdom, by the UK extension of the Data Privacy Framework and by the Standard Contractual Clauses.
10. Minors
The services and the form on this site are intended for adults. We do not knowingly collect data from minors through the site. If you are the parent or guardian of a minor and believe they have provided us with data, write to claudia.calms.psicologia@gmail.com so that we can delete it.
11. Cookies and local storage
This site uses only strictly necessary technical cookies and local storage, for example to remember the language you choose. These cookies are exempt from the consent requirement under the AEPD's cookie guidance. No analytics, advertising or third-party cookies are used, so no cookie banner is shown and there is no separate cookie policy.
12. Data security
Reasonable technical and organisational measures are applied to protect your data, including: encryption of communications in transit (HTTPS), restricted access to the mailbox where messages are received, use of providers offering sufficient guarantees under Article 28 GDPR, and application of the data-minimisation principle (we ask only for the data we need).
13. Changes to this policy
This policy may be updated to reflect regulatory or service changes. The version in force is always the one published on this page, with its «last updated» date at the top. If a change substantially affects the processing based on your consent, you will be informed by an appropriate means.