Privacy Policy
How Todor S. Simeonov, Ph.D. collects, uses and protects your personal and health data under the GDPR.
1. Who is responsible for your data (Controller)
The data controller is Todor Simeonov Simeonov, Registered freelance professional - BG180215884, e-mail info@todorsimeonov.eu. Contact the Provider at this address for any question about your data or to exercise your rights.
2. What data we collect
2.1 Data you give us
- Identity and contact details: full name, e-mail address, and any phone number you provide.
- Booking and payment information: appointment details and the record of payment (payment card data is handled by the payment provider, not stored by us).
- Health and session data (clinical Services only): information you share before and during Sessions, and the clinical notes the Provider keeps. This is special-category data concerning health. In couple, family and group work this may include data about more than one person; each adult taking part is a data subject in their own right.
- Supervision data: for professional supervision, records relating to the Supervisee and, where cases are discussed, limited information the Supervisee presents about their own clients (normally without directly identifying those clients). The Supervisee remains the controller for their own clients’ data.
- Event and course data: your registration details and, for live group events, anything you choose to share during the event. Educational registrations do not require you to provide health data, and you are asked not to disclose sensitive health details in a group setting.
2.2 Data collected automatically
- Limited technical data (such as device and browser information) and cookies, as described in section 9 and the Cookie Policy.
3. Special-category (health) data
Because psychotherapy necessarily involves information about your mental and physical health, we process special-category data under Article 9 GDPR. We apply stricter safeguards to this data: access is limited to the Provider, clinical notes are stored securely and separately from marketing contacts, and the data is never used for advertising or profiling.
4. Why we use your data and our legal basis
- To provide the Services and manage your care - legal basis: performance of a contract (Art. 6(1)(b)); for health data, provision of health/social care or your explicit consent (Art. 9(2)(h) or 9(2)(a)).
- To keep clinical records to a professional standard - legal basis: legal obligation and legitimate interest, and the health-care condition above.
- To arrange appointments, take payment and keep accounts - contract and legal obligation (including tax/accounting law).
- To respond to your enquiries - legitimate interest, or steps taken at your request before a contract.
- To meet safety and safeguarding duties in the rare situations described in Part I clause 9 and Part III - legal obligation and protection of vital interests (Art. 6(1)(d), Art. 9(2)(c)).
- Website analytics and cookies - only with your consent (Art. 6(1)(a)); see section 9.
5. Who we share it with (Processors)
We do not sell your data and do not share it except as needed to run the practice or where the law requires it. The categories of recipient are:
- the video / telehealth platform used to deliver Sessions (Meet or Zoom);
- scheduling and booking software: www.todorsimeonov.eu;
- the payment provider and, where required, our accountant/tax authorities - Stripe, Bank Account;
- secure e-mail and file storage: Gmail is used for email services; notes stored in ReMarkable;
- website hosting: www.ns1.bg;
- website analytics, subject to your consent: Google Analytics (Google);
- the Provider’s own clinical supervisor, with whom cases are discussed in anonymised form as a routine part of safe practice, bound by professional confidentiality.
6. International transfers
Where a processor stores or processes data outside the European Economic Area, we ensure an appropriate safeguard is in place, such as an adequacy decision or the European Commission’s Standard Contractual Clauses.
7. How long we keep it (Retention)
Clinical records are kept 5 years, after which they are securely deleted or anonymised. Booking and accounting records are kept for the period required by Bulgarian tax and accounting law. Enquiry data that does not lead to a booking is kept only as long as needed to deal with the enquiry.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have data erased, where the law allows (note that clinical-record and tax-retention duties may limit this);
- restrict or object to certain processing;
- data portability for data you provided, where applicable;
- withdraw consent at any time, where processing is based on consent, without affecting processing already carried out.
To exercise any right, contact info@todorsimeonov.eu. You also have the right to complain to the Bulgarian supervisory authority, the Commission for Personal Data Protection (KZLD), at cpdp.bg, or to the authority in your country of residence.
9. Cookies and analytics
Essential cookies needed to run the Website are used without consent. Any analytics or non-essential cookies (for example Google Analytics) are set only after you give prior, specific, opt-in consent through the cookie banner. You can change or withdraw your choice at any time.
10. Security
We use reasonable technical and organisational measures to protect your data, including access controls, secure storage and encrypted communication where available. No online service can be guaranteed perfectly secure, and you share information online at your own risk, but we treat health data with heightened care.
11. Changes to this policy
We may update this Privacy Policy. The current version, with its effective date, is always published on the Website.