1. General provisions1.1. This privacy policy describes how Heaolu Keskus OÜ (hereinafter „Heaolu Keskus“ or „the data controller“) processes the personal data of clients, website users and other individuals in connection with the provision of psychological counselling and other mental health services.
1.2. Heaolu Keskus processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), the Personal Data Protection Act, other applicable legislation, the professional standard for psychologists and the principles of professional ethics.
1.3. Personal data is processed in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, security and confidentiality.
1.4. Heaolu Keskus processes only those personal data that are necessary for providing the service, communicating with the client, fulfilling obligations arising from legislation or protecting legitimate interests.
2. Data controllerHeaolu Keskus OÜ
Registry code: 16208286
Address: Narva mnt 7, Tallinn 10117
Phone: +372 5690 0832
Email:
info@heaolu.eeWebsite:
www.heaolu.ee
3. Personal data processed3.1. The following personal data may be processed for the purpose of providing the service: a) first name and surname; b) personal identification code; c) telephone number; d) email address; e) booking and communication data; f) billing and payment data; g) health data, mental health data, background information and other personal information voluntarily disclosed by the client during the provision of the service; h) professional notes and documentation prepared during the provision of the service; i) technical data necessary for carrying out online counselling; j) technical and statistical data related to the use of the website.
3.2. Health data are classified as special categories of personal data and are processed in accordance with heightened confidentiality principles.
4. Purposes and legal bases for processing personal data4.1. Personal data are processed primarily for the following purposes: a) providing psychological counselling and other mental health services; b) advising and supporting the client; c) booking and managing appointments; d) communicating with the client; e) preparing invoices and managing payments; f) handling debts; g) ensuring the quality, continuity and professional standard of the service; h) fulfilling obligations arising from legislation; i) protecting the legitimate interests of Heaolu Keskus.
4.2. The legal bases for processing personal data may be: a) performance of a contract concluded with the client or steps taken prior to concluding a contract; b) the client's consent; c) fulfilment of an obligation arising from legislation; d) the legitimate interest of the data controller; e) in the case of processing special categories of personal data, the client's explicit consent or another basis provided by law.
5. Health data and professional documentation5.1. During the provision of a psychological service, the client may disclose information about their health, mental health, life circumstances, relationships, family, working life and other personal matters.
5.2. Such data are processed only to the extent necessary for providing a professional psychological service, supporting the client's wellbeing, ensuring the quality of the service and fulfilling obligations arising from legislation, the professional standard and professional ethics.
5.3. During the provision of the service, the psychologist may prepare professional notes, observations and other documentation that support the continuity and quality of the service and adherence to the client's best interests.
5.4. When processing health data, the principle of data minimisation is followed and only those data that are necessary to achieve the specific purpose are processed.
5.5. The personal data of minor clients are processed in accordance with applicable legislation, the principle of the child's best interests and subject to the consents necessary for ordering and providing the service.
5.6. A psychologist's professional notes are professional working tools intended to support the continuity and quality of the service and adherence to the client's best interests. Such notes are not automatically treated as documentation to be issued to the client, to the extent permitted by applicable legislation.
6. Confidentiality6.1. Heaolu Keskus treats all information that becomes known during the provision of the service as confidential.
6.2. The confidentiality obligation covers the client's personal data, health data, information disclosed during the counselling process and the fact that a person is or has been a client of Heaolu Keskus.
6.3. The confidentiality obligation also applies after the end of the service relationship.
6.4. The client's data or information that becomes known during the provision of the service is disclosed to third parties only: with the client's consent; in cases provided by law; on the basis of a lawful request from a competent authority; or where necessary to protect the life, health or safety of the client or another person.
6.5. To ensure the quality of professional work, the client's wellbeing and professional competence, Heaolu Keskus may use supervision, peer consultation or other measures for ensuring professional quality. In such cases the principle of data minimisation is followed and, where possible, anonymised or generalised information is used in a manner that does not allow the client to be directly identified.
6.6. Participants in supervision, peer consultation or other professional discussions are subject to the confidentiality obligation and are required to comply with data protection and professional ethics requirements.
6.7. When processing personal data and providing the service, Heaolu Keskus is guided by the client's wellbeing, the principles of professional ethics and professional independence.
7. Transfer of personal data7.1. Heaolu Keskus does not sell or disclose the client's personal data for marketing purposes.
7.2. To provide the service, Heaolu Keskus may use processors and cooperation partners, including providers of booking, communication, cloud, IT, payment and accounting services.
7.3. Only those data that are necessary for providing the specific service or fulfilling obligations arising from legislation are transferred to cooperation partners.
7.4. All processors are obliged to ensure the protection of personal data and to process data only on the instructions of Heaolu Keskus.
7.5. Where data are transferred outside the European Economic Area, safeguards approved by the European Commission or other protection mechanisms provided by law are applied.
7.6. Secure communication and video solutions are used for carrying out online counselling. During online counselling, only the data necessary for providing the service are processed.
8. Retention of personal data
8.1. Heaolu Keskus retains personal data only for as long as is necessary to fulfil the purposes for which they were collected, to perform the contract concluded with the client, to provide the service, to fulfil obligations arising from legislation or to protect the legitimate interests of Heaolu Keskus.
8.2. Client data collected during the provision of the counselling service are retained during the provision of the service and are deleted or anonymised within a reasonable time after the end of the service, typically within three months, unless their retention is necessary for fulfilling an obligation arising from legislation or for submitting, defending or handling legal claims.
8.3. Heaolu Keskus does not retain notes concerning the content of counselling after the end of the service, except to the extent necessary for fulfilling obligations arising from legislation or for submitting, defending or handling legal claims.
8.4. Data related to service booking, client communication and the organisation of the service are retained only for as long as is necessary for providing the service, offering client support or resolving possible questions related to the service.
8.5. Accounting source documents and the personal data related to them are retained for the period laid down in the legislation regulating accounting.
8.6. Where the retention of personal data is necessary for resolving possible disputes, complaints, legal claims or professional obligations, Heaolu Keskus may retain only the information necessary for that purpose until the relevant need ceases or the applicable limitation period expires.
8.7. Upon expiry of the retention period, personal data are securely deleted or anonymised, unless legislation imposes an obligation or right to retain them for longer.
9. Security of personal data9.1. Heaolu Keskus applies appropriate technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, destruction or other unlawful processing.
9.2. Access to personal data is granted only to those employees or cooperation partners who have a justified need for it arising from their work duties.
10. Client's rights10.1. The client has the right: a) to receive information about the processing of their personal data; b) to access the data processed about them; c) to request the correction of incorrect or incomplete data; d) to request the erasure of data or the restriction of processing in cases provided by law; e) to object to the processing of data; f) to withdraw consent where processing is based on consent; g) to receive their data in a structured, commonly used and machine-readable format in cases provided by law; h) to lodge a complaint with the Estonian Data Protection Inspectorate.
10.2. To exercise their rights, the client may contact info@heaolu.ee.
11. Cookies11.1. The website uses cookies for the purposes of the functioning of the website, improving usability, collecting statistics and marketing activities
.11.2. Strictly necessary cookies are used on the basis of legitimate interest. Analytical and marketing cookies are used only with the user's consent
.11.3. The user can manage the use of cookies through the cookie solution displayed on the website or through their browser settings.
12. Complaints and supervision12.1. If the client considers that their personal data are being processed unlawfully, they have the right to contact Heaolu Keskus or to lodge a complaint with the Estonian Data Protection Inspectorate.
13. Amendments to the privacy policy13.1. Heaolu Keskus has the right to update this privacy policy from time to time in order to ensure its compliance with legislation, the development of services and data processing practices.
13.2. The version published on the website is always the valid and current version.
