Privacy Policy
Last updated: 13 July 2026
Your privacy matters to me. This page explains, in plain language, what happens to the information you share with me through this website. There is not much of it, and I keep it for as long as I need it and no longer.
Who is responsible for your information
I am Flavia Dalmazo — a psychologist offering online therapy. I am the person responsible (the "data controller") for the information collected through this website.
You can reach me at hello@flaviadalmazo.com with any question about your privacy, or about anything on this page.
I work as an independent practitioner. I am currently based in Saudi Arabia, and I see clients online, including clients in the European Union. Because I offer my services to people in the EU, European data protection law (the GDPR) applies to how I handle your information, and this page reflects that.
What this website does not do
This is unusual enough to be worth saying plainly, and it is true of this site:
- No cookies. The website sets none. Not one.
- No analytics. No Google Analytics, no Plausible, no Umami — nothing.
- No tracking pixels, no advertising, no profiling, no automated decision-making.
- No third-party scripts, fonts, or content delivery networks. Nothing on the page is loaded from anyone else's server.
- No cookie banner, because there are no cookies to consent to.
I do not know who you are unless you tell me.
What I collect, and why
The only information I collect is what you type into the contact form, plus one technical value used to stop spam.
| What | Why | Lawful basis |
|---|---|---|
| Your name | So I know who I am replying to | Your consent (Art. 6(1)(a) GDPR) |
| Your email address | So I can reply to you | Your consent (Art. 6(1)(a) GDPR) |
| Your message (optional) | So I have some idea what you are looking for | Your consent (Art. 6(1)(a)); if you choose to mention anything about your health, your explicit consent (Art. 9(2)(a)) |
| Your consent tick | To record that you agreed | To demonstrate your consent (Art. 7(1)) |
| A one-way "fingerprint" of your IP address | To stop automated spam and abuse of the form | My legitimate interest in keeping the form usable (Art. 6(1)(f)) |
The message field is optional. You can send an enquiry with just your name and your email address, and I will still reply.
About that IP fingerprint. I never store your IP address. When you submit the form, your IP is converted into a short, irreversible code, and only that code is kept. It cannot be turned back into your IP address. The same code is briefly held in a counter that deletes itself after one hour, so that nobody can submit the form hundreds of times.
I do not ask for your phone number, your address, or your date of birth.
Please don't send me sensitive details in the form
The contact form is a first hello, not a consultation.
Please tell me only as much as you need to for me to reply — a sentence about what you are looking for is plenty. Please don't describe your symptoms, your diagnosis, your medication, or anything else about your health in the form. We will talk properly, and confidentially, on the intro call. That is what the call is for, and the less sensitive information travels through a web form, the better protected you are.
If you do choose to mention something about your health, you are giving me your explicit consent to handle that information for the sole purpose of replying to you. You can withdraw that consent at any time by emailing me, and I will delete your enquiry.
Who else can see it
- The Werks (Netherlands), the company that built and hosts this website, acting as my processor under a written agreement. They keep the site and its database running on my behalf.
- Hetzner Online GmbH (Germany), which provides the physical servers on which the website and its database run.
- Postmark, which sends the automatic emails that the website generates.
No one else. Your enquiry is not sent to a mailing list, a CRM, or an advertising network, and it is never sold or shared for marketing.
Where your information is stored, and where I read it
Your enquiry is stored on servers in Germany, inside the European Union.
I read my enquiries from Saudi Arabia, where I live. Saudi Arabia is outside the EU, and the European Commission has not decided that it offers a level of data protection equivalent to the EU's. This means that when I open your enquiry, your information leaves the EU.
I want to be straightforward about this, because it is the reason the contact form asks you to tick a consent box. By ticking that box and sending the form, you give your explicit consent for your information to be transferred to me in Saudi Arabia so that I can read it and reply to you (Article 49(1)(a) GDPR). If you would rather not consent to that, please do not use the form — you are welcome to reach me another way, and you can always email me directly.
You can withdraw your consent at any time, and I will delete your enquiry.
How long I keep it
Your enquiry is automatically deleted 90 days after you send it — whether or not we end up working together, and whether or not you ask me to.
If we do go on to work together, the records of our clinical work are kept separately, under the professional rules that apply to my work as a psychologist. Those records are not covered by this page, and I will explain how they are handled before we begin.
How your information is protected
- Every connection to this website is encrypted (HTTPS).
- Enquiries are stored in a database that isolates my data from every other site on the same system, at the database level rather than merely in software.
- The part of the website that receives your form submission is technically incapable of reading enquiries back out again. It can write, and it cannot read.
- Enquiries can only be read from a private, password-protected area that only I can log in to.
- The form is protected against automated abuse.
Your rights
You have the right to ask me to:
- See a copy of the information I hold about you;
- Correct it, if it is wrong;
- Delete it;
- Restrict how I use it, or object to my using it;
- Send it to you in a portable, machine-readable format.
Where I rely on your consent — which is nearly everything on this page — you can withdraw that consent at any time, without giving a reason. Withdrawing consent does not make anything I did before you withdrew it unlawful, but it does mean I will stop, and I will delete your enquiry.
To exercise any of these rights, email hello@flaviadalmazo.com. I will respond within one month. You do not need to explain why, and it will never affect how I treat you.
Complaints
If you think I have handled your information badly, please tell me first — email hello@flaviadalmazo.com and I will do my best to put it right.
You also have the right to complain to a data protection supervisory authority. If you are in the European Union, you may complain to the supervisory authority in your own country — the one where you live, where you work, or where you believe the problem happened. Each EU country has one, and you can find yours through the European Data Protection Board at edpb.europa.eu.
Changes to this page
If anything here changes, I will update it and change the date at the top of the page.