Privacy Statement

This page explains what personal data SarvCare collects, why, how it's protected, and what your rights are under the GDPR. For the rules that govern therapy itself (sessions, fees, cancellations, complaints), see the Treatment Agreement and Complaints Procedure.

1. Who We Are

SarvCare is an online psychology and counselling practice based in the Netherlands, operated by Atena Karimzadeh, Psycholoog NIP® (registration #250722). Sessions are offered in English and Farsi.

• Practice (handelsnaam): Sarv Psychology, trading as SarvCare
• KvK: 42054574
• Email: info@sarvcare.nl
• Website: sarvcare.nl

2. What Data We Collect

We collect only the data necessary to provide our services.

Contact form & booking

• Name
• Email address
• Phone number (optional)
• Preferred language
• Your message (optional)

Therapy sessions

• Intake responses you provide before our first session
• Session notes (kept strictly confidential)
• Treatment records as required by Dutch healthcare law (WGBO)
• Invoices and payment records (financial administration)

Therapy notes and intake responses are special category data under GDPR Article 9 (data concerning health). We treat them with the additional care that category requires.

Website

The website loads a small set of third-party services. Some of them set cookies or share your IP with the provider. We don't sell or share your data with anyone, and we don't use any advertising or marketing trackers. Each service is listed in the next section.

3. Third-Party Processors

SarvCare relies on the following services. Each has its own privacy policy and processes data on our instruction under a data-processing agreement (verwerkersovereenkomst) where applicable.

Loaded on every page

• Google Analytics (GA4) — to see which pages are visited and which buttons are clicked. Sets cookies and shares basic interaction data with Google. Privacy policy.
• Google Fonts — web fonts served from Google's CDN. No cookies, but Google may log your IP when fonts are fetched.
• Cal.com — the booking widget loads on every page so it's ready to open when you click "Book a Consultation". Privacy policy.

Loaded when you take a specific action

• Google Meet — encrypted video for online sessions. End-to-end encrypted in transit; Google does not retain session content. Privacy policy.
• Tally — intake and consent forms (EU-based, GDPR-compliant). Used once your therapy starts. Privacy & GDPR.
• Mollie — Dutch payment processor for iDEAL invoices. Used for paid sessions. Privacy policy.

4. Why We Collect Your Data and Legal Basis

We process your personal data for the following purposes, on the legal bases listed:

• To respond to inquiries and book consultations — your consent (GDPR Art. 6(1)(a)).
• To provide therapy — performance of the treatment agreement with you (GDPR Art. 6(1)(b)) together with Dutch healthcare law (WGBO).
• To process health data (therapy notes, intake responses) — your explicit consent (GDPR Art. 9(2)(a)). You give this consent in the intake form before our first session.
• To meet legal record-keeping obligations — Dutch healthcare and tax law (GDPR Art. 6(1)(c)).

5. How We Protect Your Data

• Communication is handled through secure, encrypted channels.
• Session notes are stored in line with NEN 7510-compatible practices and are accessible only to your therapist.
• We do not share your data with third parties unless legally required (see Section 8).
• Online sessions are conducted via secure, encrypted video.

6. Data Retention

• Contact form submissions: deleted within 12 months after last contact, unless you become a client.
• Client records (medical): retained for 20 years after the last session, as required by the WGBO.
• Financial records (invoices): retained for 7 years, as required by Dutch tax law.

7. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the right to:

• Access — request a copy of your personal data.
• Rectification — correct inaccurate data.
• Erasure — request deletion of your data, subject to legal retention requirements (e.g., the 20-year WGBO obligation for therapy records).
• Restriction — limit how we process your data.
• Portability — receive your data in a portable format.
• Objection — object to data processing.
• Withdraw consent — at any time, for processing based on consent.

To exercise any of these rights, email info@sarvcare.nl. We respond within 30 days.

You also have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

8. Confidentiality

As a NIP-registered psychologist, Atena Karimzadeh is bound by professional confidentiality. Everything discussed in therapy sessions is strictly confidential and will not be shared with third parties without your explicit consent, except when:

• There is a serious and immediate risk to your safety or the safety of others.
• Suspected child abuse or domestic violence triggers obligations under the Meldcode huiselijk geweld en kindermishandeling.
• Disclosure is required by law (e.g., a court order).

9. Treatment Terms and Complaints

The terms governing therapy itself (sessions, fees, cancellations, payment, scope of services) are set out separately in the Treatment Agreement. The procedure for raising a concern is on the Complaints Procedure page.

10. Changes to This Policy

We may update this privacy statement from time to time. The latest version is always available on this page.