Dominique Matthe – Clinical Psychologist (M.A.) & Heilpraktikerin für Psychotherapie

I. Name and Contact Details of the Data Controller

The person responsible for processing personal data within the meaning of the General Data Protection Regulation (GDPR/DSGVO) is:

Dominique Matthe
Clinical Psychologist (M.A.)
Heilpraktikerin für Psychotherapie
Schönhauser Allee 126
10437 Berlin
Germany

Email: dominiquematthepsych@gmail.com
Website: https://www.dominiquematthe-psychology.com

For questions about data protection or requests concerning your personal information, please contact me using the email address above.

II. General Information About Data Processing

1. Scope of processing

I process personal data only where necessary to operate my website, respond to enquiries, organise appointments, provide psychological counselling and psychotherapy services, maintain relevant records, and manage invoicing and payments.

Depending on the purpose, this may include:

• Names, contact details and billing addresses

• Appointment information and communication history

• Information provided through intake and consent forms

• Information relevant to psychological treatment

• Clinical and therapeutic records

• Invoices and payment information

• Parent or guardian details where services concern children or adolescents

• Technical information collected when visiting my website or using online booking

Information relating to psychological or mental health may constitute special-category personal data under Article 9 GDPR and requires additional protection.

2. Purpose and legal basis

This processing is necessary to provide a functional website, maintain its security and prevent misuse.

The legal basis for processing technically necessary information is generally Article 6(1)(f) GDPR.

3. Storage and external processing

Technical information may be processed by Squarespace and its relevant service providers in accordance with their applicable data-protection arrangements.

Further information is available from Squarespace:

https://www.squarespace.com/privacy

IV. Cookies, Website Analytics and Fonts

1. Cookies

My website uses cookies and similar technologies.

Technically necessary cookies support the operation and security of the website.

Other cookies may be used for analytics and performance measurement, depending on the website settings.

Where legally required, optional cookies and similar technologies are used only after the visitor has provided consent through the website's cookie controls.

Consent can be withdrawn or changed through the available cookie settings.

2. Website analytics

My website uses Squarespace's website analytics functionality to understand website traffic and improve its content.

Depending on the configuration and consent settings, this may involve information about pages visited, clicks, device information and other website interactions.

Where consent is required, the relevant legal basis is Article 6(1)(a) GDPR. Processing necessary for the technical operation of the website may be based on Article 6(1)(f) GDPR.

3. Fonts and external resources

My website uses fonts supplied through Google Fonts and Adobe Fonts.

Depending on the technical configuration, loading these resources may involve transmitting information such as an IP address or device information to the relevant provider.

V. Contacting My Practice

1. Description and scope

If you contact my practice by email or through my website, I process the information you provide.

This may include your name, contact information, message and any attachments.

Please avoid including unnecessary sensitive health information in an initial email enquiry.

2. Purpose and legal basis

Information is processed to respond to your enquiry, provide information about services or arrange an initial consultation.

Depending on the circumstances, the legal basis is Article 6(1)(b) or Article 6(1)(f) GDPR.

Where health-related information is included, an additional Article 9 condition is required.

3. Email provider

My practice uses Google Gmail for email communication.

Personal information contained in emails may be processed by Google in connection with providing the email service, subject to the applicable contractual and data-protection arrangements.

Ordinary email communication may involve confidentiality and security risks.

4. Storage duration

Enquiries are retained for as long as necessary to handle the communication and any resulting professional or legal obligations.

Information forming part of an ongoing client relationship may be retained with the relevant client records.

VI. Online Appointment Booking and Practice Administration – Echo

1. Description and scope

My practice uses Echo, provided by 3CHO AGENT INC LTD, 205 Regent Street, London, W1B 4HB, United Kingdom, for online appointment scheduling, client administration and invoicing.

When appointments are booked or managed, the following information may be processed:

• First and last name

• Email address and telephone number

• Billing address, where required

• Appointment date, time and duration

• Type of appointment or service

• Appointment changes, attendance and cancellations

• Administrative booking information

• Invoice amounts and payment status

• Parent or guardian information where applicable

• Technical information associated with booking and account access

Depending on the booking process, additional information submitted through administrative forms may also be processed.

2. Purpose of processing

This information is used to arrange and administer appointments, communicate necessary booking information, maintain client contact records and issue invoices.

3. Legal basis

Processing necessary for arranging appointments and providing agreed services is generally based on Article 6(1)(b) GDPR.

Where appointment information reveals that an individual is receiving psychological or therapeutic services, it may also constitute health-related data under Article 9 GDPR. Such processing requires an applicable Article 9 condition.

Optional appointment reminders are sent only where the relevant consent has been provided. Consent can be withdrawn for future reminders.

4. Data processing agreement and confidentiality

Echo processes client information on behalf of my practice under a Data Processing Agreement pursuant to Article 28 GDPR.

My practice uses Echo's confidentiality mode, which restricts the sharing of client information with AI and analytics providers.

Clinical therapy notes and therapeutic records are maintained separately from Echo and are not entered into the platform.

Echo's Data Processing Agreement includes confidentiality obligations for authorised personnel and relevant subcontractors.

5. Storage and international processing

According to Echo's Data Processing Agreement, primary client data is stored in Ireland, within the European Union.

Echo describes the use of applicable international-transfer safeguards, including adequacy decisions, the EU–US Data Privacy Framework for eligible recipients and Standard Contractual Clauses.

6. Appointment notifications

Booking confirmations, appointment changes, invoices and payment-related messages may be sent electronically.

Where an email address is available, Echo's confidentiality mode prioritises email communication. Where no email address is available, certain notifications may be sent through WhatsApp in a restricted format.

Optional appointment reminders are sent only with the relevant consent.

7. Retention and deletion

Appointment and administrative information is retained for as long as necessary for the relevant purposes, subject to applicable legal retention requirements.

Echo provides functionality for exporting and deleting certain records. Its Data Processing Agreement also describes deletion arrangements following account closure, subject to legally required retention.

8. Further information

Echo Privacy Policy:
https://echo-agent.com/legal/privacy

Echo Data Processing Agreement:
https://echo-agent.com/legal/dpa

Echo Subprocessors:
https://echo-agent.com/legal/subprocessors

VII. Psychological Services and Therapeutic Records

1. Description and scope

In the course of providing psychological counselling and psychotherapy services, I may process personal and health-related information necessary for the therapeutic relationship.

Depending on the circumstances, this may include:

• Personal and contact details

• Relevant medical and psychological history

• Information discussed during sessions

• Treatment goals and therapeutic documentation

• Clinical observations and session notes

• Relevant correspondence and professional reports

• Information necessary for referrals or coordination of care

2. Purpose and legal basis

The purpose is to provide appropriate psychological services, maintain necessary documentation and fulfil applicable professional and legal obligations.

Processing of ordinary personal data may be based on Article 6(1)(b) and/or Article 6(1)(c) GDPR, as applicable.

Health-related information is processed only where an appropriate Article 9 GDPR condition and any applicable national-law requirements are satisfied.

3. Confidentiality

Information shared in the therapeutic relationship is treated confidentially in accordance with applicable professional, contractual and legal obligations.

Information is disclosed to third parties only where there is an appropriate legal basis, valid authorisation or a relevant legal obligation.

Where information is shared with other professionals, schools or institutions, the applicable confidentiality and consent requirements are considered.

4. Storage

Clinical notes and therapeutic records are maintained separately from Echo.

Access is restricted and appropriate technical and organisational measures are used to protect this information.

VIII. Children, Adolescents and Parents

My practice provides psychological services to children and adolescents.

Where appointments are arranged by parents or legal guardians, relevant contact, appointment and billing information may be processed.

Information concerning children and adolescents is handled with particular care.

The disclosure of therapeutic information to parents or guardians depends on the circumstances, the young person's capacity and rights, applicable confidentiality requirements and any necessary consent or authorisation.

A parent or guardian arranging an appointment does not automatically mean they are entitled to receive all confidential information discussed during treatment.

IX. Invoicing and Payments

1. Description and scope

My practice uses Echo to manage invoices and related administrative information.

Depending on the payment method used, personal information may include:

• Name and billing address

• Service and appointment information

• Invoice number, date and amount

• Payment status and transaction information

2. Purpose and legal basis

Information is processed to issue invoices, receive payments, maintain accounting records and comply with applicable tax obligations.

The relevant legal bases generally include Article 6(1)(b) and Article 6(1)(c) GDPR.

3. Payment providers

Payments may be made by bank transfer or through an electronic payment service, where offered.

Where card payments are used through Echo, payment details are collected directly by the relevant payment processor rather than being stored by Echo.

Information may also be processed by banks, payment processors, tax advisers and relevant authorities where necessary and legally permitted.

4. Retention

Invoice and accounting information is retained for the periods required by applicable tax and accounting laws.

X. External Service Providers and International Data Transfers

My practice uses external service providers where necessary for website hosting, email communication, appointment administration, invoicing and payment processing.

Depending on the service, these may include Squarespace, Google, Echo and relevant payment providers.

Where a service provider processes personal information on my behalf, an appropriate data processing agreement is used where required by Article 28 GDPR.

Some providers or their personnel may process or access information outside the European Economic Area.

Where such processing occurs, applicable GDPR transfer requirements must be met. Depending on the destination and recipient, safeguards may include adequacy decisions or Standard Contractual Clauses with any necessary supplementary measures.

Further information about relevant providers and safeguards may be requested using the contact details in Section I.

XI. Data Retention and Security

1. Retention

Personal information is retained only for as long as necessary for the relevant purpose or where a legal obligation requires continued retention.

Enquiry information that does not result in an ongoing professional relationship is deleted when it is no longer needed, subject to applicable legal requirements.

Therapeutic records are retained according to the professional and legal requirements applicable to my practice.

Accounting and invoice records are retained for the applicable statutory periods.

2. Security

Appropriate technical and organisational measures are used to protect personal information against unauthorised access, accidental loss, alteration and disclosure.

These measures may include access restrictions, authentication controls, secure storage, confidentiality obligations and appropriate arrangements with service providers.

No electronic system can guarantee absolute security.

XII. Rights of Data Subjects

Under the GDPR, and subject to applicable legal requirements, individuals have the right to:

• Request access to their personal information (Article 15).

• Request correction of inaccurate information (Article 16).

• Request deletion where the relevant conditions are met (Article 17).

• Request restriction of processing (Article 18).

• Request data portability where applicable (Article 20).

• Object to certain processing activities (Article 21).

• Withdraw consent where processing is based on consent, without affecting earlier lawful processing.

• Lodge a complaint with a competent supervisory authority.

Requests can be directed to:

dominiquematthepsych@gmail.com

Some rights may be limited by applicable legal obligations, including requirements to retain therapeutic or accounting records.

The data protection supervisory authority in Berlin is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit

https://www.datenschutz-berlin.de

XIII. Automated Decision-Making

I do not use solely automated decision-making or profiling to make decisions about clients that produce legal or similarly significant effects within the meaning of Article 22 GDPR.

XIV. Changes to This Privacy Policy

This Privacy Policy may be updated when legal requirements, service providers or practice procedures change.

The current version is available at:

https://www.dominiquematthe-psychology.com/privacy-policy

Where required, clients will be informed of material changes affecting the processing of their personal information.