Privacy policy

At Vínculo we handle very sensitive information: that of people looking for psychological help and that of the professionals who provide it. This policy explains what data we handle, why, on what legal basis, how long we keep it and what rights you have. It applies to https://vinculo.app, the app and our communications with you.

The essentials:

• Vínculo is a directory with booking and a practice management tool for psychologists. It is not a healthcare centre: your therapy is provided by your psychologist, who decides about your clinical record.
• We do not sell your data or use it for advertising. There are no advertising pixels or third-party trackers on the booking or therapy pages.
• Your data is hosted in the European Union, clinical notes are stored encrypted and video sessions are never recorded.
• You can exercise your rights from your account settings or at privacidad@vinculo.app.

1. Who we are

• Owner: Vínculo Salud Digital, S.L. (being incorporated).
• Tax ID (NIF): [pending: NIF].
• Registered office: [pending: registered office], Madrid (Spain).
• Companies Registry: [pending: registration details].
• Privacy contact: privacidad@vinculo.app.
• Data Protection Officer: dpo@vinculo.app (section 12).

2. Our two roles

The controller decides why and how data is used. The processor handles it on the controller’s behalf and following their instructions (articles 4 and 28 of the General Data Protection Regulation, GDPR). Vínculo plays both roles:

As a processor, we handle data only to provide the service to the professional, with the safeguards of the Data processing agreement. Your psychologist will give you their own data protection information and handles your rights over the clinical record (section 11.3).

[pending: confirm with a lawyer — the chat is a single thread that moves from Vínculo as controller to the professional as controller after the first paid session; validate the split and how to explain it in the chat itself.]

3. What data we handle

• If you are looking for care: name, email, phone number (optional) and date of birth; searches and favourites; answers to the assistant; details of your bookings and the pre-session questionnaire (reason for consultation, previous therapy and goals); payments; tax ID and address if you ask for a full invoice; messages, reviews and support requests; your diary, if you use it. Your full card details are handled by Stripe, not by Vínculo.
• If you are a professional: identity and identity document; degree, professional association and membership number, your practice’s healthcare registration and insurance; your public profile; payout and verification (KYC) data through Stripe; income and expenses from the tax tools; DAC7 data (tax ID, address, date of birth and IBAN); and your calendar, if you connect it.
• For everyone: IP address, device, access and security logs, push notification identifier and your preferred language.

If you book couples therapy and give the other person’s name and email, make sure they know. We will send them an invitation with a link to this policy (article 14 GDPR).

4. Why and on what basis

4.1 If you are looking for psychological care

4.2 If you are a professional

4.3 For all users

5. Your health data

Knowing that someone books with a psychologist already reveals information about their health. That is why we treat your bookings, the pre-session questionnaire, your answers to the assistant and your messages as special categories of data (article 9 GDPR), even though they are not part of a clinical record.

To handle them we ask for your explicit consent when you book or use the assistant. You can withdraw it whenever you like from your settings or at privacidad@vinculo.app. Withdrawing it does not affect what has already been processed (article 7.3 GDPR) or the clinical record kept by your psychologist, but it will stop us from managing new bookings for you. [pending: confirm with a lawyer — whether appointment management must rely on explicit consent (article 9.2.a) or can be handled on the professional’s behalf under articles 9.2.h and 9.3 GDPR.]

Our commitments:

• Your pre-session questionnaire is only seen by the professional you book with. Once we pass it on, it becomes part of your clinical record, under their responsibility.
• We do not use health data for advertising, commercial profiling or training artificial intelligence, and we do not sell it.
• We do not include health data in notifications, email subject lines, calendar events, web addresses or technical logs.
• Invoices carry neutral descriptions, with no diagnoses.

Your psychologist handles your clinical record under article 9.2.h GDPR, the 17th additional provision of Spanish Organic Law 3/2018 (LOPDGDD) and Law 41/2002. For that they do not need your consent under data protection law, but they will ask for your informed consent to the treatment.

6. Adults only

Vínculo is only for people aged 18 and over. We ask for your date of birth when you sign up and for an express confirmation when you book. If we detect an account belonging to a minor, we will deactivate it and delete their data, except what we must keep by law. Caring for minors requires additional safeguards (article 9 of Law 41/2002 and article 57 of Organic Law 8/2021) that we do not offer today.

7. Who we share data with

7.1 Recipients

• The professional you book with or talk to, only with the data they need.
• Our providers, as processors under an article 28 GDPR contract (table below).
• Stripe, which is also an independent controller of certain data to prevent fraud and money laundering (Stripe’s policy).
• The Spanish Tax Agency (AEAT): Verifactu records of invoices and professionals’ DAC7 reporting.
• Authorities and courts, when the law requires it.
• Emergency services, only when there is a serious and imminent risk to life (article 18 of Regulation (EU) 2022/2065).

We do not pass data to advertisers, insurers, employers or data brokers.

7.2 Providers

8. International transfers

We host data in the European Union. If a provider handles it outside the European Economic Area, it does so with the safeguards of chapter V of the GDPR: the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795) or standard contractual clauses (Implementing Decision (EU) 2021/914) with a transfer assessment. The Framework has been challenged before the Court of Justice of the EU; if it were annulled, we would use standard clauses with additional measures or change provider. The clinical record never leaves the European Economic Area [pending: confirm against the final Supabase, LiveKit and Cloudflare configuration]. You can ask for a copy of the safeguards at privacidad@vinculo.app.

9. How long we keep data

We keep data for the periods given in section 4. After that we block it: it remains available only to judges, courts and authorities while liability can still be claimed, and is then deleted or anonymised (article 32 LOPDGDD).

[pending: confirm with a lawyer — 12 months of blocking for account data is short compared with the general 5-year limitation period for personal claims (article 1964 of the Spanish Civil Code).]

The clinical record follows its own periods, decided by your psychologist as controller:

Access logs for the clinical record will be kept for [pending: proposed 5 years, in line with the clinical record]. While the legal period lasts, Vínculo technically prevents the deletion of the clinical record, even if you close your account or ask for erasure.

10. How we protect your data

• Hosting in the European Union and encryption in transit and at rest.
• Clinical notes additionally encrypted with AES-256-GCM, with a key per professional protected by a platform master key (envelope encryption). This is not end-to-end encryption: Vínculo holds the master key, which is why it restricts and logs any technical access.
• Role-based access with row-level security in the database: each person only sees what is theirs.
• A log of every access to the clinical record.
• Video sessions encrypted in transit and never recorded.
• Phone numbers, emails and links hidden in the chat until the first paid session.
• Staff bound by confidentiality, with the minimum access they need.
• A breach procedure to notify the AEPD within 72 hours (article 33 GDPR) and, where appropriate, the people affected (article 34).
• [pending: two-step authentication for professionals and administrators, and a penetration test before launch.]

11. Your rights

11.1 What rights you have

You can access your data and get a copy (article 15 GDPR), rectify it (article 16), ask for its erasure (article 17), object to processing based on legitimate interest and to marketing communications (article 21), ask for restriction of processing (article 18), portability of the data you gave us (article 20) and withdraw your consent at any time (article 7.3).

11.2 How to exercise them

From your settings you can download your data, correct it and close your account. You can also write to privacidad@vinculo.app stating the right you are exercising; if we are unsure of your identity, we will ask for the minimum needed to confirm it. It is free and we will reply within a month, extendable by two months in complex cases (article 12.3 GDPR).

11.3 If it concerns your clinical record

The controller is your psychologist. You can contact them or us: we will pass your request on without delay [pending: proposed maximum of 5 working days] and help them respond. You have the right to access your clinical record and get a copy, except the professional’s subjective annotations and third-party data (article 18 of Law 41/2002). Erasure is limited while there is a legal obligation to keep it (article 17.3.b GDPR).

11.4 Complaining to the AEPD

You can complain to the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid, www.aepd.es). Beforehand, if you wish, you can contact our Data Protection Officer, who will reply within two months at most (article 37 LOPDGDD).

12. Data Protection Officer

Vínculo handles special categories of data on a large scale, so it will appoint a Data Protection Officer before launch (article 37.1.c GDPR and article 34 LOPDGDD) and notify the AEPD within ten days (article 34.3 LOPDGDD). Contact: dpo@vinculo.app. [pending: appointment.]

13. Automated decisions

We do not make decisions based solely on automated processing that produce legal effects on you or similarly significantly affect you (article 22 GDPR).

• Order of profiles: based on how well they match your search (reason, format, location, language, availability and price) and reliability signals (published availability, speed of response, few cancellations or no-shows and a complete profile). Reviews do not count and payment never has any influence. Details in the Terms and conditions.
• “Help me choose” suggests profiles; the decision is always yours.
• Hiding contact details in the chat is automatic, but decides nothing about you.
• No automatic triage or diagnosis and, for now, no artificial intelligence. If we introduce it (intended provider: Anthropic), we will tell you first, ask for your consent where needed and update the impact assessment.

14. Cookies

We only use technical cookies needed for the service to work and be secure. We explain them in the Cookie policy.

15. Changes to this policy

At the top of this page you will see the current date and version. If we make significant changes, we will let you know by email or in the app before applying them. If a change requires your consent, we will ask for it.