Privacy policy

This policy describes which personal data is processed when you visit this website, why, and which rights you have. It applies to this website. Psychotherapeutic treatment itself is additionally covered by the statutory duty of confidentiality and by the information you receive at the practice.

Controller

Mag. Pth. Elena Pădurariu
Werdertorgasse 15/7, 1010 Wien, Austria
Phone: +43 699 1909 6826
Email: office@padurariu.at

In short

• Statistics and advertising services (Google Analytics, Google Ads, Meta pixel) run only if you agree in the cookie banner. You can change your choice at any time.
• Without your consent, only technically necessary cookies are set, and only when you log in.
• Fonts and images are served by this website itself. Without your consent your browser loads no third-party content when you visit.
• Personal data arises when you get in touch, book an appointment, log in or use the AI assistant.

Visiting the website

The website is hosted by Vercel Inc. (USA). On every request the server processes technically necessary data: IP address, date and time, the page requested, and details of your browser and device. This data is used to deliver the website and keep it secure, and is kept in logs only for a short time.

Legal basis: legitimate interest in running the website securely and reliably (Art. 6(1)(f) GDPR).

Contact form and email

When you use the contact form, your name, email address, subject and message are processed in order to answer you. The message is stored in the Wix system, and a contact entry with your name and email address is created. The practice is notified by email. The practice's email is handled through Google Workspace (Google Ireland Limited).

To protect against spam, the website checks form entries technically, uses the IP address to limit the number of messages per hour, and Wix filters suspicious messages. No third-party captcha is used.

Please do not send sensitive health information through the form or by email. A personal conversation is the right place for confidential matters.

Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

Booking, plans and payment

You choose an appointment or a plan on this website. For an appointment, you enter your name, email address and insurance number in the booking form on this website (the insurance number is required for psychotherapy and optional for coaching and supervision), and if you wish your phone number and a message. The website passes these details and the chosen appointment straight to the practice's booking system at Wix.com Ltd. and does not store them itself. A contact entry with your name and contact details is created there. To prevent misuse, the website checks the form in the same way as the contact form.

To pay online, and to use or buy a plan, you are taken to a page that Wix operates for the practice. Your payment details are processed there. Payment is processed through Wix's payment service. The practice receives the booking and the payment status, but no full card details.

Legal basis: performance of the contract for the service booked (Art. 6(1)(b) GDPR). Where health data is involved, it is processed for the provision of health care by a professional bound by confidentiality (Art. 9(2)(h) GDPR).

Client account

When you log in, you do so on a page operated by Wix. Afterwards this website shows your upcoming appointments and active plans. This data is loaded from the Wix system each time and is not stored additionally on this website.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

Online sessions

Online sessions take place on Google Meet, a service of Google Ireland Limited. Video and sound are transmitted; Google also processes technical connection data such as the IP address.

Legal basis: performance of the contract for the service booked (Art. 6(1)(b) GDPR). Where health data is involved, it is processed for the provision of health care by a professional bound by confidentiality (Art. 9(2)(h) GDPR).

AI assistant

Using the "Talk to AI" assistant is voluntary. Your messages and the selected language are sent to this website's server and passed on to Anthropic, PBC (USA), whose language model produces the answer.

• The practice does not store conversations and does not create profiles.
• The assistant sets no cookies. The conversation stays in your browser's local storage for at most one hour and can be deleted at any time with "Clear".
• To prevent abuse, your IP address is used to limit the number of requests. For this it stays in the server's memory for at most one hour and is not stored permanently.
• According to Anthropic, inputs and answers are not used to train its models and are deleted within 30 days, unless Anthropic has to keep them longer because of a breach of its usage policies.

Please do not enter health information or other sensitive details into the assistant.

Legal basis: legitimate interest in answering questions about the practice quickly (Art. 6(1)(f) GDPR).

Statistics and advertising (only with your consent)

If you agree in the cookie banner, this website loads the following services. Without your consent none of them is loaded, and your browser sends them nothing.

• Google Analytics (Google Ireland Limited): which pages are visited, how visitors found the website, approximate location, device and browser. The practice uses it to see how the website is used. According to Google, Google Analytics does not store IP addresses. Google Analytics keeps the data for 14 months.
• Google Ads (Google Ireland Limited): counts whether a visit that began with one of the practice's ads reached the "Services" page, and lets the practice show its ads on Google to people who have visited this website (remarketing).
• Meta pixel (Meta Platforms Ireland Limited): tells Meta which pages you visit, so that the practice can measure its ads on Facebook and Instagram and show them to visitors of this website. The practice and Meta are joint controllers for collecting and passing on this data; Meta's further processing is described in its privacy policy.

Google and Meta can link this data to an account you have with them and use it for their own purposes, including in the USA. As this is the website of a psychotherapy practice, the pages you visit can hint at health matters; your consent covers this too.

Legal basis: your consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR, § 165(3) of the Austrian Telecommunications Act 2021). You can withdraw it at any time under "Cookie settings" at the bottom of every page. Processing before the withdrawal is not affected.

Cookies and local storage

Without your consent this website sets only technically necessary cookies and entries. Under § 165(3) of the Austrian Telecommunications Act 2021 no consent is required for these.

The first three are set only when you log in. The assistant-chat entry is created only when you use the assistant.

With your consent, these are added:

Google and Meta may also set cookies on their own domains (for example doubleclick.net and facebook.com); their privacy policies describe them.

The pages operated by Wix for booking, payment, login and the client account set their own cookies, which are necessary for those functions.

Recipients

The following service providers process data on behalf of the practice, each under a data processing agreement (Art. 28 GDPR):

• Vercel Inc., USA: hosting of the website
• Wix.com Ltd., Israel: booking, payment, client account, contact form and blog
• Anthropic, PBC, USA: the AI assistant's language model
• Google Ireland Limited, Ireland: the practice's email and online sessions (Google Meet)

With your consent, Google Ireland Limited (Google Analytics and Google Ads) and Meta Platforms Ireland Limited (Meta pixel) also receive data, see "Statistics and advertising". Data is passed to other third parties only where the law requires it.

Transfers outside the EU

The European Commission has found that Israel provides an adequate level of data protection. Transfers to the USA rely on the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's standard contractual clauses.

Retention

Data is kept only as long as the purpose requires. Enquiries are deleted once they have been dealt with, unless the law requires them to be kept. The practice keeps booking and invoice data for ten years.

Your rights

You have the right to access, rectification, erasure, restriction of processing and data portability, and the right to object to processing that is based on legitimate interest. You can withdraw consent you have given at any time, for statistics and advertising under "Cookie settings" at the bottom of every page. To exercise these rights, write to office@padurariu.at.

If you believe that the processing of your data breaches data protection law, you can lodge a complaint with the supervisory authority:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40-42, 1030 Vienna, Austria
Email: dsb@dsb.gv.at
www.dsb.gv.at

No automated decisions

The practice makes no automated decisions and creates no profiles. If you agree to advertising, Google and Meta use the data to choose ads, which involves profiling on their part.

Changes

This policy is updated when the website or the law changes. The date of the last change is shown at the top of this page.