Privacy notice

Last updated: 26 October 2026

Aluf Psychology is operated by Dale Aluf, who is responsible for the processing of personal data described in this notice.

KvK: 94918732
Contact: [email protected]

Information collected

Depending on your contact with the practice, I process:

• Your name, email address, telephone number and correspondence.
• Your date of birth, address and other administrative details where necessary.
• Invoicing and payment information.
• Information relevant to psychological care, including intake information, health information and session notes.
• Technical information, including IP addresses and basic website request details.

I record only information necessary for the purpose concerned.

Purposes and legal grounds

I use personal information to respond to enquiries, arrange appointments, provide psychological services, maintain client records and process payments.

The legal grounds are taking steps at your request before entering an agreement, performing our agreement and meeting legal obligations. General correspondence and website security rely on my legitimate interests in responding to enquiries and operating a secure website.

I process health information where necessary to provide psychological care and maintain the associated client records, under Article 9(2)(h) GDPR and Article 30(3)(a) of the Dutch UAVG. This information is subject to confidentiality obligations.

Where processing relies on consent, you may withdraw it at any time. Withdrawal does not affect processing lawfully carried out beforehand.

Service providers and sharing

The following providers handle information as necessary for their services:

• Cloudflare: website hosting, security and contact-form processing.
• Google Workspace: email.
• WhatsApp Business: communications when you contact me through WhatsApp.

The website does not maintain a separate database of contact-form submissions. Messages are delivered to the practice’s Google Workspace inbox.

Other providers supporting client records, online sessions, payments or accounting receive information only as necessary for those purposes. Relevant information about their involvement will be provided before use.

I do not sell personal data. Client information is otherwise shared with your permission or where the law permits or requires disclosure.

Providers may process information outside the European Economic Area, including in the United States. Applicable transfer arrangements include European Commission adequacy decisions or Standard Contractual Clauses. Contact me for details or a copy of the relevant safeguards.

Email and WhatsApp

Please use email and WhatsApp primarily for enquiries and appointment arrangements, and avoid sending detailed health information in an initial message.

Information relevant to your care may be included in your client record.

Cookies

This website does not use cookies, browser storage, analytics or tracking technologies.

Retention

Different records have different retention periods:

• Treatment records: where the Dutch WGBO applies, generally 20 years from the last change to the record, subject to applicable exceptions, including lawful requests for earlier destruction or longer retention necessary for good care.
• Financial records: generally seven years under Dutch tax rules.
• Enquiries that do not lead to a client relationship: deleted within three months after the last contact, unless a legal obligation or legal claim justifies longer retention.
• Other correspondence: retained only as long as necessary for its purpose.

Correspondence included in a treatment record follows that record’s retention rules. Service providers retain technical logs according to their applicable service arrangements.

Your rights

Where applicable, you may request access to, correction or deletion of your personal data, restriction of processing, or transfer of your data. You may also object to processing based on legitimate interests or withdraw consent where processing relies on it.

These rights are subject to legal limits, including record keeping obligations.

Send requests to [email protected]. I may request information reasonably necessary to verify your identity. I normally respond within one month and will notify you if a lawful extension is required.

You may lodge a complaint with the Autoriteit Persoonsgegevens, the Dutch Data Protection Authority.

Security

I take appropriate technical and organisational measures to protect personal information against loss, unauthorised access, disclosure and alteration.

Automated decisions

I do not make decisions with significant effects on individuals solely through automated processing.

Updates

Changes to this notice will appear on this page with an updated date.