Privacy Policy

Effective Date: 01/05/2025

Company Name: S@rma Ltd

Registered Office: S@RMA LTD 201B.3 Cardinal Ροint Park Road Rickmansworth

Hertfordshire WD3 1RE

Contact Email: info@sarmapsych.com

Company Activity: Provision of psychological and mental health services online

 

1. Introduction

S@rma Ltd (“we,” “us,” “our”) is committed to safeguarding the privacy of our clients and

website visitors. This Privacy Policy explains how we collect, use, store, and protect personal

data—especially health-related data—in compliance with the General Data Protection

Regulation (EU) 2016/679 (“GDPR”).

We understand the sensitive nature of psychological data and treat all personal and health-

related information with the utmost confidentiality and care.

 

2. Data We Collect

We may collect and process the following types of personal data:

a. General Data

• Identity Data: Full name, date of birth

• Contact Data: Email address, phone number, address

• Technical Data: IP address, browser type, device information

• Usage Data: Interactions with our website, session durations, clicks

b. Special Category Data (Sensitive Data)

• Health Data: Information related to mental health, psychological history, therapy

sessions, assessments, or treatment

• Session Notes: Notes taken by licensed professionals during consultations

• Communication Data: Messages or information exchanged during therapy (e.g., via

secure messaging or video calls)

We only collect sensitive health data with your explicit consent or where it is necessary to

provide our services and ensure your well-being.

 

3. Purpose of Data Collection

We process personal data for the following reasons:

• To deliver psychological consultations, assessments, and support

• To maintain records of therapy sessions as required by clinical standards and legal

obligations

• To respond to your inquiries and provide customer support

• To improve our services and website functionality

• To comply with legal and regulatory requirements

• To provide billing and invoicing for paid services

 

4. Legal Basis for Processing

The legal bases under the GDPR for processing your data include:

• Explicit Consent (Article 9(2)(a)): Required for collecting and processing special

category data (e.g., psychological and health data)

• Performance of a Contract (Article 6(1)(b)): When you sign up for psychological

services

• Legal Obligation (Article 6(1)(c)): Complying with medical, financial, or regulatory

requirements

• Vital Interests (Article 6(1)(d)): In emergencies or to prevent harm

• Legitimate Interests (Article 6(1)(f)): Managing and improving our business, unless

overridden by your rights

 

5. Cookies and Analytics

Our website uses cookies for basic functionality, performance monitoring, and improving

user experience. We do not use cookies to track or profile users for psychological

purposes.

 

6. Data Sharing and Confidentiality

We do not sell or share your personal or health data with advertisers or third parties for

marketing.

We may share your data only with:

• Licensed psychologists and qualified professionals under confidentiality obligations

• IT service providers that maintain our secure infrastructure (bound by strict data

protection agreements)

• Legal authorities when required by law (e.g., duty to report imminent harm or abuse)

All disclosures are strictly limited to what is necessary.

 

7. Data Security

We use strong encryption, secure data storage, and role-based access control to ensure

confidentiality and integrity. All sessions are conducted using encrypted, GDPR-compliant

platforms.

Data is hosted in secure European data centers or other locations that comply with GDPR

transfer standards.

 

8. Data Retention

We retain psychological and health records:

• For 7 years after the end of treatment (or as required by national clinical guidelines)

• For shorter periods for general browsing or analytics data

After this, data is securely erased or anonymized unless further retention is legally required.

 

9. Your Rights

You have the following rights under the GDPR:

• Access: Request a copy of your data

• Correction: Fix inaccurate or incomplete data

• Erasure: Request deletion of data (subject to legal and ethical constraints)

• Restriction: Ask us to limit data processing

• Portability: Receive your data in a structured, machine-readable format

• Objection: Object to data use under certain conditions

• Withdraw Consent: You may withdraw consent at any time without affecting past

lawful processing

To exercise any of these rights, contact us at: info@sarmapsych.com

 

10. Children’s Privacy

Our services are intended for adults (18+). If you are under 18, please do not use our services

without parental/legal guardian consent. We will delete any personal data of minors collected

without such consent.

 

11. Changes to This Policy

We may update this Privacy Policy occasionally. The latest version will always be available

on our website with an updated “Effective Date.” We encourage you to review it regularly.

 

12. Contact Us

If you have any questions, concerns, or would like to make a data access request, please

contact:

Data Protection Officer

S@rma Ltd

201B.3 Cardinal Ροint Park Road Rickmansworth Hertfordshire WD3 1RE

Email: info@sarmapsych.com

You also have the right to lodge a complaint with your national Data Protection Authority

(DPA).