Dilay Sevahil, running the self-pay psychological practice Mosa Psychologie in Maastricht, attaches importance to the protection of personal data. This privacy statement handles information about an identified or identifiable natural person, as referred to in the General Protection Regulation (GDPR).

1. Application

This privacy statement applies to the following categories of natural persons whose personal data Mosa Psychologie processes:

(Prospective) clients
Visitors to the practice of Dilay Sevahil
Visitors of Dilay Sevahil
Visitors to the website www.mosapsychologie.com
All other persons whose personal data Mosa Psychologie processes in the course of its activities

Mosa Psychologie is a self-pay psychological practice run by Dilay Sevahil, NIP-registered psychologist (registration number 249552). The practice provides psychological support in English and Turkish. Mosa Psychologie does not contract with health insurers, does not submit claims on behalf of clients, and does not share information with insurers or general practitioners unless the client explicitly requests this in writing.

2. Processing of personal data

Mosa Psychologie processes personal data that:

a data subject has provided personally during an intake or session, by telephone, or digitally (via email, secure messaging through Zivver, or web forms on the website). This includes contact details, date of birth, and information about the client's situation, complaints, and goals discussed in the context of psychological support;
are exchanged with other care providers only at the explicit written request of the data subject (for example, when the client asks for a referral letter or for information to be shared with their GP);
are generated when a data subject visits the website, such as the IP address and basic browsing behavior (pages viewed, navigation patterns). These are processed via the website platform (Wix) and any analytics tools enabled on the site.

Mosa Psychologie does not collect or register the Burgerservicenummer (BSN) of clients. Because the practice operates outside the insurance-funded healthcare system (Zvw/Wlz), there is no legal basis or obligation to register the BSN.

No camera footage is recorded by Mosa Psychologie at the practice. The building (De Fronten Gezondheidscentrum) may have its own security arrangements; for information about that, please contact the building management.

3. Purposes of processing

Mosa Psychologie processes personal data for the following purposes:

providing and administering psychological support sessions, including intake, session notes, and any written reports (such as EMA analysis reports);
invoicing and financial administration;
maintaining contact with clients about appointments and practical matters;
responding to inquiries received via the contact form, email, or telephone;
improving the website www.mosapsychologie.com and analyzing basic, aggregated user statistics that cannot be traced back to individual visitors;
complying with legal obligations, such as tax retention requirements.

4. Legal basis

Mosa Psychologie processes personal data on the basis of one or more of the following legal grounds under the GDPR:

Consent of the data subject. Consent may be withdrawn at any time, without affecting the lawfulness of any processing carried out before the withdrawal;
Performance of an agreement for psychological support services between the client and Mosa Psychologie, including the financial administration that follows from this;
Legal obligation, such as the obligation to retain financial records for tax purposes;
Legitimate interest, such as using contact details to respond to a question received via the contact form, or to send appointment reminders.

For processing data concerning health (a special category under Article 9 GDPR), Mosa Psychologie relies primarily on the explicit consent of the client, given at the start of the support relationship.

5. Processors

Mosa Psychologie engages a limited number of service providers (processors) that process personal data on behalf of the practice. Mosa Psychologie concludes a data processing agreement (verwerkersovereenkomst) with each processor in line with the requirements of the GDPR.

The main processors used by Mosa Psychologie are:

Zivver: secure email and file exchange platform used for all sensitive digital communication with clients (Dutch company, EEA-hosted);
WeSeeDo: secure video calling platform used for online sessions (Dutch company, servers in the Netherlands, ISO 27001 and NEN 7510 certified). Access to WeSeeDo is provided via Privacy Helder, who acts as reseller and signs the data processing agreement on WeSeeDo's behalf;
Wix: website hosting platform for www.mosapsychologie.com, including the contact form and online booking functionality;

An up-to-date overview of processors can be requested by contacting Mosa Psychologie.

6. Sharing personal data with third parties

Mosa Psychologie does not share personal data with third parties, except:

with the client's explicit written consent (for example, to share a referral or report with the client's GP or another care provider);
when necessary to comply with a legal obligation (such as a court order or tax inspection);
in exceptional situations where the safety of the client or another person is at serious risk, and there is no other way to address that risk. In such situations, Mosa Psychologie will, wherever possible, discuss this with the client first.

Mosa Psychologie does not share personal data with third parties for commercial purposes.

7. Online sessions

Mosa Psychologie offers psychological support sessions both in person at the practice in Maastricht and online via secure video calling.

Platform: Online sessions are conducted via WeSeeDo, a Dutch secure video calling platform designed specifically for healthcare consultations. WeSeeDo's servers are located in the Netherlands, the platform is ISO 27001 and NEN 7510 certified (the Dutch information security standard for healthcare), and conversations are end-to-end encrypted. WeSeeDo does not store the content of sessions. Mosa Psychologie has a data processing agreement (verwerkersovereenkomst) in place for the use of WeSeeDo.
How it works: Before each online session, you receive an email from Mosa Psychologie containing a unique link. At the scheduled time, you click the link in your browser and enter a digital waiting room; the practitioner then admits you to the session. No download, installation, or account is required on your side. The link works on laptops, desktops, tablets, and phones.
No recording: Mosa Psychologie does not record online sessions. Neither video, nor audio, nor screen content is recorded. Clients are likewise asked not to record sessions without prior explicit agreement. If a recording is ever made for a specific clinical reason, this is only done with the client's written consent in advance, and the recording is stored and deleted in line with the retention rules described above.
Your environment: Online sessions take place partly in an environment that is outside the control of Mosa Psychologie, your home, office, or wherever you choose to dial in from. Clients are responsible for ensuring that they are in a private, quiet space, that other people cannot overhear or see the session, and that the device and internet connection they use are reasonably secure (for example, by avoiding shared or public Wi-Fi networks for sensitive conversations). Mosa Psychologie cannot guarantee privacy on the client's side of the connection.
Clients dialing in from outside the EEA: If a client joins an online session while they are physically located outside the EEA, the connection still terminates on WeSeeDo's servers in the Netherlands, but the data is transmitted from the client's location to the Netherlands. Mosa Psychologie does not actively transfer client data to countries outside the EEA, but cannot prevent or control where a client chooses to connect from.
Technical issues: If a session is interrupted due to a technical problem (connection loss, platform outage), Mosa Psychologie will attempt to reconnect via WeSeeDo first, and if that fails, will follow up via Zivver secure message or by phone to agree on how to continue or reschedule. No session content is transmitted via unsecured channels.

8. Transfer outside the EEA

Mosa Psychologie stores client records and confidential files within the European Economic Area (EEA). The two healthcare-relevant processors: Zivver (secure communication, EEA-hosted) and WeSeeDo (video sessions, Netherlands-hosted), keep all session and client data within the Netherlands or the EEA.

Some service providers used by the practice such as the website platform (Wix) may process limited data (such as website analytics or contact form submissions) on servers outside the EEA, including in the United States. Where this occurs, Mosa Psychologie relies on the safeguards provided by these processors, such as Standard Contractual Clauses approved by the European Commission and, where applicable, certification under the EU-US Data Privacy Framework.

Sensitive client information (session notes, reports, secure messages, video sessions) is not processed outside the EEA.

9. Data storage

Digital communication with clients is conducted via Zivver, a secure platform that complies with NTA 7516 (the Dutch standard for secure healthcare email);
Online sessions are conducted via WeSeeDo, a Dutch video platform with servers in the Netherlands that is ISO 27001 and NEN 7510 certified (the Dutch information security standard for healthcare);
Digital client files are stored in password-protected folders on a device used exclusively by the practitioner;
Any physical reports or notes are kept in a locked cabinet;
The website uses HTTPS encryption.

Mosa Psychologie does not retain personal data longer than necessary. The following retention periods apply in principle:

Client records (intake notes, session notes, reports, correspondence relating to the support relationship): retained for at least 7 years after the end of the support relationship, in line with the retention period under the Wkkgz (Wet kwaliteit, klachten en geschillen zorg) and consistent with general administrative obligations. In specific cases, for example where a longer retention is needed for the client's interest or where the work qualifies as a geneeskundige behandelovereenkomst under the WGBO, records may be kept for up to 20 years;
Financial and administrative data (invoices, payment records): 7 years after the end of the relevant financial year, in line with the Belastingdienst retention obligation;
Contact form submissions and email correspondence from prospective clients who do not start a support relationship: deleted within 12 months, unless the data subject objects earlier;
Website visitor data: retained for a maximum of 24 months;
A client may at any time request that their data be deleted earlier, subject to the legal retention obligations above.

10. Changes to privacy statement

Dilay Sevahil may amend this privacy statement at any time. A current version of the privacy statement is published on the website of Mosa Psychologie. It is advisable to consult this privacy statement regularly so that you are aware of any changes.

11. Right, questions and complaints

You have the right to request Dilay Sevahil to access, rectify, delete, transfer, restrict the processing of, and object to the processing of your personal data. You may withdraw consent at any time, where processing is based on consent. You can contact Dilay Sevahil regarding this by sending an email to info@mosapsychologie.com