Privacy policy

1. Who processes your data

The data controller is Tamara Danielyan, psychologist, Yerevan, Republic of Armenia. For any question about your data, write to info@tamaradanielyan.com or call +374 93 100651.

This policy has been prepared in accordance with the Law of the Republic of Armenia on Protection of Personal Data (2015).

2. What data we collect

• Account data: email address, name, optionally a phone number, language and time zone. If you sign in with Google, we receive your email address, name and profile photo from Google.
• Booking data: the format, date and time of sessions, their status, payment records, and the history of cancellations and reschedules.
• Health information: the reason for your request (if you choose to give it when booking), your messages with Tamara in your account, and Tamara’s working notes on the consultations. This is special category data, and we process it only with your separate consent.
• Consents: which consents you gave, in which version, and when.
• Technical data: IP address and browser details in security logs, and the cookies needed for sign-in.

We do not use advertising trackers or social media pixels, and we do not build advertising profiles. To improve the site, we collect pseudonymised usage statistics, described below.

3. Why we use it

• To create and maintain your account and to book your sessions (performance of the service contract).
• To provide consultations and keep professional records of them (your consent to the processing of health information).
• To send booking emails: confirmations, reminders, reschedules and cancellations. These emails contain no health information. The confirmation email for an online session, the reschedule email and the reminder one hour before the session contain a Google Meet link, which can be used to join only with Tamara’s permission.
• To protect the site and accounts against intrusion and abuse (legitimate interest).
• To keep payment records as required by the tax legislation of the Republic of Armenia (legal obligation).
• To send emails about new articles, only if you have separately agreed to this. You can unsubscribe at any time.

4. Who has access

Only Tamara sees health information, messages and notes. They are encrypted (AES-256) before being written to the database, so the database provider stores only encrypted text, and the key is kept separately. Access to Tamara’s working panel is protected by two-factor authentication, and actions on bookings are recorded in a log.

To run the site, we use trusted providers that process data only on our instructions:

• Supabase: database and account sign-in, servers in Frankfurt (Germany).
• Cloudflare: site hosting, protection against attacks and the “I am not a robot” check, global network.
• Resend: sending booking emails, Ireland.
• Zoho Mail: the info@tamaradanielyan.com mailbox, if you write to us by email.
• Google: only if you choose to sign in with Google yourself.
• Google Meet: video for online sessions. The meeting is created in Tamara’s calendar, your data is not passed to Google, and you can join only after Tamara lets you in.
• PostHog: pseudonymised usage statistics, servers in the EU (Frankfurt, Germany).

5. Usage statistics

To understand which sections and features are used and where the site is inconvenient, we collect statistics through PostHog (servers in the EU, Frankfurt). We see which pages were opened and which actions were taken (for example, “session format selected”, “message sent”, “PHQ-9 test completed”), as well as the device type, browser, language, time zone, country and city.

We never send PostHog your name, email, phone number, the text of messages or notes, the reason for your request, or test answers and results. Your account is identified by a random code from which PostHog cannot tell who you are, and the IP address is truncated to the network on our own server before anything is sent.

For visitors who are not signed in, a pseudonymised session recording may be made on site pages (except booking, sign-in and tests): how the page is scrolled and where people click. Everything typed into fields is hidden. No recording is made in the client account or the working panel.

Legal basis: legitimate interest in improving the service. You can turn statistics off at any time with the “Anonymous statistics” switch in your account profile. Browsers that send the Do Not Track signal are not counted.

6. We do not sell data

We do not sell your data or disclose it to third parties, except where expressly required by law (for example, by a court decision).

7. Storage outside Armenia

Our providers’ servers are located outside Armenia, mainly in the European Union, where a high level of data protection applies (GDPR). Data is transferred abroad only with your consent, which you give when you register.

8. How long we keep data

• Account, messages, reason for your request and notes: for as long as your account exists. They are deleted immediately when you delete your account.
• Records of past sessions (date, format, price, payment record): after the account is deleted, they are kept without any link to you for accounting and tax purposes, for the period set by the legislation of the Republic of Armenia.
• The booking change log (who created, rescheduled or cancelled a session and when, without the content of consultations): for record keeping and security.
• Providers’ technical logs and backups: for a limited period set by the provider, after which they are deleted automatically.

9. Your rights

• Get a copy of your data: the “Download my data” button in your account profile (a JSON file).
• Correct your data: in your profile or by email.
• Delete your account and data: in your account profile.
• Withdraw consent: consent to article emails can be turned off in the “Consents” section of your profile; other consents can be withdrawn by deleting your account or by writing to info@tamaradanielyan.com. Withdrawal does not affect the lawfulness of processing carried out before it. Without consent to the processing of health information, we cannot provide consultations.
• Object to processing or restrict it: write to info@tamaradanielyan.com.
• Lodge a complaint with the authorised body for the protection of personal data of the Republic of Armenia.

We reply to written requests within the period set by law, usually within 5 working days.

10. Cookies

The site uses only necessary cookies: for account sign-in (Supabase session), remembering your language, and bot protection (Cloudflare). Your choice of light or dark theme and the random statistics code (see “Usage statistics”) are stored in your browser, not in cookies. There are no advertising cookies.

11. Adolescents

Consultations for children and adolescents under 18 are provided only with the consent of a parent or legal representative. The parent or legal representative registers, books the sessions and manages the account.

12. Security

We encrypt data in transit and at rest, use two-factor sign-in for the psychologist, access control at the database level, and regular security checks. If a breach affecting your data occurs, we will notify you and the authorised body.

13. Changes to this policy

We will tell you about material changes by email or when you next sign in to your account and, where necessary, ask for your consent again.