Dr. Jessica Di Bella | Data Privacy

1. Controller

The controller responsible for the processing of personal data on this website and in connection with my psychotherapy and coaching services is:

Dr. rer. pol. Jessica Di Bella
Waldowstraße 33
13156 Berlin
Germany
Email: mail@jessicadibella.de

2. Processing of Personal Data

I process personal data in accordance with applicable data protection laws, in particular the General Data Protection Regulation (GDPR).

The type of data processed depends on whether you visit my website, contact me, or make use of psychotherapy or coaching services.

In the context of psychotherapy, special categories of personal data within the meaning of Article 9 GDPR, in particular health data, may be processed. Such data is treated with particular confidentiality. As a professional psychologist, I am subject to statutory duties of confidentiality under Section 203 of the German Criminal Code (StGB).

3. Visiting this Website

When you visit my website, technically necessary information is processed by the web server. This may include your IP address, date and time of access, pages visited, and information about your browser and operating system. The processing is carried out where necessary to ensure the secure and technically reliable provision of the website and to prevent misuse.

This website uses Google Analytics to analyse website usage and reach. Information about page views, usage, devices and technical data may be processed. Google Analytics is activated exclusively with your prior consent in accordance with Art. 6 (1) (a) GDPR. You may withdraw your consent at any time with effect for the future.

4. Contact

If you contact me by email, the personal data you provide will be processed in order to respond to your enquiry and, where applicable, arrange an appointment.

Please note that email communication is generally not end-to-end encrypted. I therefore ask you not to send detailed information about your mental or physical health via unencrypted email.

The processing is carried out to handle your enquiry and, insofar as it concerns the initiation or provision of psychotherapy, on the basis of the applicable data protection provisions.

For online appointment scheduling, I use the Doctolib service. When making an appointment, the personal data you enter, in particular your name, contact details and appointment information, is processed by Doctolib. The processing is carried out for the purpose of scheduling and managing appointments. Further information on data processing can be found in Doctolib's Privacy Policy.

5. Psychotherapy in my Practice

Psychotherapy is provided at my own practice premises as well as as part of my work at other practice locations.

In the context of treatment, I process the personal data required for the provision and documentation of psychotherapy.

This may include, in particular:

Contact details,
Information about your personal circumstances and living situation,
Information concerning your mental and physical health,
Information concerning treatment and its progress,
Medical history, findings and diagnostic information,
As well as other information you share with me in the course of treatment.

Health data constitute special categories of personal data under Article 9 GDPR and are therefore subject to enhanced protection. The processing is carried out for the purpose of providing psychotherapy and fulfilling the associated legal and professional obligations.

As a psychologist, I am subject to statutory confidentiality obligations. Information obtained during treatment is treated as confidential and is only disclosed where there is a legal basis for doing so or where you have given valid consent.

The psychotherapy documentation is maintained and managed by me. Access to this documentation is restricted to the persons and purposes for which access is necessary.

6. Psychotherapy at Other Practice Locations

I also provide psychotherapy in cooperation with other practices. As part of this organisational cooperation, the respective practice may access the data required for appointment management. This is limited exclusively to names and appointment information.

The respective practice does not have access to psychotherapy documentation, health data, treatment notes or other content relating to psychotherapy, unless such access is legally required for the provision of treatment or you have given corresponding consent.

Access is restricted to the data required for the respective organisational task and is subject to applicable data protection and professional confidentiality obligations.

Where the practice acts as a data processor, the processing is carried out on the basis of a data processing agreement pursuant to Art. 28 GDPR.

7. Online Sessions via Zoom

For online sessions as part of my private self-pay practice, I use the video conferencing service Zoom.

Online sessions take place via my personal Zoom standard meeting room. No individual or publicly accessible meeting links are provided for individual clients.

When using Zoom, technical and personal data may be processed. This may include, in particular, your name or display name, technical connection data, IP address, device and browser information, as well as information about your use of the video conference.

During a psychotherapy session, health data and other particularly sensitive personal information may also form part of the communication.

Protection measures: For my online sessions, I have configured Zoom's data protection and security settings accordingly. In particular:

the data region for relevant Zoom data is set to "Germany",
"End-to-End Encryption (E2EE)" is enabled for sessions,
sessions are "not recorded",
no automated transcripts are created,
no AI functions are used for the sessions,
a waiting room is used,
and access to the session is protected by the relevant security features provided by Zoom.

When end-to-end encryption is enabled, Zoom cannot generally decrypt the content of the encrypted communication. However, E2EE requires the necessary technical conditions to be met on the participants' devices. Please use the current Zoom application to participate where this is required for the use of end-to-end encryption.

Data transfers by Zoom: Zoom is an international service provider. Although Germany has been selected as the data region for relevant Zoom data, it cannot be ruled out that certain technical, account, support or operational data may be processed by Zoom outside the European Union or European Economic Area.

Where personal data is transferred to third countries, such transfers are carried out on the basis of the data protection safeguards provided for this purpose, in particular the Standard Contractual Clauses provided by Zoom, where applicable.

The use of Zoom is subject to the applicable data protection terms and data processing agreements.

Further information on data processing by Zoom can be found in Zoom's Privacy Policy.

8. Coaching

In the context of coaching, personal data may be processed where necessary for the preparation, provision and follow-up of coaching services.

Please note that coaching does not replace psychotherapy. Where sensitive personal information is shared in the context of coaching, I nevertheless treat such information confidentially.

9. Documentation and Retention

Psychotherapy and counselling services are documented in accordance with applicable legal and professional requirements.

Personal data and treatment documentation are retained only for as long as necessary for the respective purpose or as required by statutory retention obligations.

The applicable statutory retention periods apply to data relating to psychotherapy. Once these periods have expired, the data will be deleted unless another legal basis requires continued storage.

10. Recipients and External Service Providers

Personal data is generally only disclosed to third parties where this is necessary for the provision of my services, where there is a legal obligation to do so, or where appropriate consent has been given.

Where I use external service providers that process personal data on my behalf, they are engaged in accordance with applicable data protection requirements.

Where required, appropriate data processing agreements pursuant to Art. 28 GDPR are concluded.

11. Your Rights

Subject to the applicable legal requirements, you have in particular the right to:

Access your stored personal data,
Request the correction of inaccurate data,
Request the deletion of your data,
Request restriction of processing,
Data portability,
Object to certain forms of processing,
As well as the right to withdraw consent with effect for the future where processing is based on consent.

You also have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates the GDPR.

12. Confidentiality

As a psychologist, I am subject to statutory professional confidentiality obligations.

All information entrusted to me or otherwise becoming known to me in the course of my professional activities is treated confidentially. Information is generally only disclosed to third parties where there is a legal basis for doing so or where appropriate consent or a waiver of confidentiality has been provided.

13. Updates to this Privacy Policy

I reserve the right to update this Privacy Policy if legal requirements, my services or the technical services I use change.