Loading
Last updated: 11 June 2026
This website is operated by Vasiliki Koumantaki, Clinical Psychologist, based in Ilioupoli, Athens, Greece. As the data controller, I am responsible for the personal data collected through this website.
When you submit the request form on this website I collect your name, email address, an optional phone number, the reason you are contacting me (selected from a fixed list), and the free-text message you choose to write. If you select a therapy-related reason, the message you write may include health-related information — I only see what you voluntarily choose to share in that field.
When you submit the request form I also record a one-way hashed identifier derived from your IP address (the raw address is not stored) and a truncated copy of your browser user-agent string. This metadata is used only for fraud prevention and abuse investigation, and is automatically deleted 90 days after submission via a scheduled retention job.
I use your personal data to respond to your request, schedule and manage appointments where relevant, send confirmations and reminders, and communicate with you about your enquiry or sessions. For non-therapy enquiries (business, media, supervision, or general questions) the data is used solely to respond to your message.
General personal data (name, email, phone, message content, technical metadata) is processed on the basis of your explicit consent under GDPR Art. 6(1)(a), given when you tick the consent checkbox on the request form. For therapy-related enquiries, any health information you include in your message is a special category of personal data under GDPR Art. 9. I process this information only on the basis of your explicit consent under Art. 9(2)(a), given when you tick the second, dedicated health-data consent checkbox. You may withdraw either consent at any time by contacting me using the details below.
Submission records are retained while they remain operationally relevant (typically until your enquiry is resolved, or a therapy relationship is concluded). Where you become a client, clinical records are retained for the period required by Greek healthcare regulations (commonly ten years). Technical metadata (hashed IP and user-agent) is automatically deleted after 90 days. If you request deletion of non-clinical data, I will comply within 30 days, except where retention is required by law.
Your submission is stored on my hosting provider (Railway) and the transactional emails are sent through a third-party email provider (Resend). Media files are stored using Cloudflare R2 object storage, served via Cloudflare CDN, and protected by Cloudflare security and bot-mitigation services. Railway, Resend, and Cloudflare all act as data processors on my behalf under appropriate contractual safeguards. Your data is not shared with anyone else, is not used for marketing, and is not sold.
Some of my data processors are based outside the European Economic Area. Resend Inc. is a US-based company; your data is transferred to Resend under the EU–US Data Privacy Framework or Standard Contractual Clauses. Cloudflare Inc. is US-based; transfers to Cloudflare occur under the same mechanisms. Railway is currently hosted in [REGION TO BE CONFIRMED]; if the deployment region is outside the EEA, transfers are covered by Standard Contractual Clauses or an equivalent safeguard. Each transfer is necessary to provide the service you have requested, and each processor is bound by a data processing agreement.
Under the General Data Protection Regulation (GDPR), you have the right to: access your personal data, request correction of inaccurate data, request deletion of your data, request restriction of processing, data portability, and object to processing. For special-category health data you may additionally withdraw your Art. 9(2)(a) consent at any time. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA / ΑΠΔΠΧ) at www.dpa.gr.
I use only strictly necessary cookies — no tracking, no analytics, no advertising. For a full list of cookies and their purposes, see the Cookie Policy.
For any questions about this privacy policy, to exercise your rights, or to withdraw a consent, please contact me at [email protected] or call 210 9968965.