Privacy Policy
Quilt Psychology
Privacy Statement
Online Counselling Services — The Netherlands | Last updated: May 2026
Quilt Psychology (hereafter “Quilt Psychology”, “we” or “the counselor”) is strongly committed to protecting your personal data. This Privacy Statement explains why and how we collect and use your personal data, and sets out your rights under applicable privacy legislation.
This Privacy Statement applies to the processing of personal data of clients, prospective clients, and any other person who visits our website or contacts us.
If you have questions about this Privacy Statement, wish to exercise your rights under the General Data Protection Regulation (GDPR / AVG), or wish to submit a complaint about the handling of your personal data, please contact us: Marisa@Quiltpsychology.com, www. Quiltpsychology.com.
If you are not satisfied with our handling of your complaint, you may also contact the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via www.autoriteitpersoonsgegevens.nl.
1. Who We Are
Quilt Psychology is the data controller responsible for the processing of your personal data as described in this Privacy Statement. We are an online counselling and education practice based in the Netherlands, providing psychological counselling services via video call. (KVK 94312400)
2. What Personal Data We Collect
Client File
In order to provide counselling services, we are required by law to maintain a client file. This obligation arises from the Wet op de Geneeskundige Behandelingsovereenkomst (WGBO). Your file may contain:
• Your name, address, date of birth, email address, and telephone number
• Notes relating to your mental health and wellbeing
• Observations, assessments, and counselling interventions made during sessions
• Any relevant information provided by other healthcare providers (only with your explicit consent)
This may include sensitive and/or special categories of personal data, such as health data. Such data is processed only with your explicit consent, which you provide by signing the Informed Consent and Counselling Agreement at the start of our work together.
Invoicing
For billing purposes, we process the following information:
• Your name, address, and place of residence
• Your date of birth
• Date(s) of session(s)
• Description of services provided (e.g. ‘counselling session’)
• Session fees and payment details
Contact
When you contact us via our website, email, or telephone, we process the information you provide, including your name, email address, telephone number, and the reason for your enquiry.
Website
When you visit our website, we may collect analytical data about your visit via cookies. Please refer to our Cookie Policy on our website for full details.
3. Why and How We Use Your Personal Data
Client File
Your personal and health data is used to provide counselling services to you. It may also be used for the following purposes:
• To share relevant information with other healthcare providers, where necessary for your treatment — only with your explicit consent
• To allow a colleague to take over your counselling during any period of absence by the counselor
• For colleague consultation or supervision — in which case only anonymised data is used; no personally identifying information is shared
• For any other purpose, we will inform you in advance and request your explicit consent
Invoicing
Your payment information is used solely for the purpose of billing you for services rendered. This processing is necessary to fulfil the agreement between you and Quilt Psychology.
Contact
Contact details you provide are used to respond to your enquiries, schedule or adjust appointments, and send invoices.
4. Legal Basis for Processing
We process your personal data on the following legal bases under the GDPR:
• Explicit consent (Article 9(2)(a) GDPR) — for the processing of health data in your client file
• Performance of a contract (Article 6(1)(b) GDPR) — for invoicing and service delivery
• Legal obligation (Article 6(1)(c) GDPR) — for maintaining your file as required by the WGBO and for financial records
• Legitimate interest (Article 6(1)(f) GDPR) — for responding to general enquiries
You have the right to withdraw your consent at any time. If you do so, we will no longer be able to process your health data or provide services to you, and your file will be closed. Withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal.
5. Third-Party Tools and Data Processors
In providing our services, we use the following third-party tools that may process your personal data on our behalf. We have entered into (or will enter into) Data Processing Agreements (verwerkersovereenkomsten) with each of these parties to ensure GDPR compliance:
Zanda Health (Practice Management Software)
We use Zanda Health to manage client records, appointments, and invoicing. Zanda Health is GDPR-compliant and holds ISO 27001 certification. Your data stored in Zanda is hosted in UK-based AWS data centres and is subject to appropriate safeguards including Standard Contractual Clauses (SCCs) for any data transfers outside the EEA.
Zoom (Video Conferencing)
Counselling sessions are conducted via Zoom. Zoom processes certain technical data (such as IP addresses and connection metadata) in order to facilitate video sessions. Zoom is GDPR-compliant. Sessions are not recorded without your explicit consent.
Website Hosting and Analytics
Any other service providers engaged by Quilt Psychology who may have access to your personal data will have signed a Data Processing Agreement or Non-Disclosure Agreement, or are otherwise bound by professional confidentiality obligations.
6. How Long We Keep Your Data
Client File
Your client file is retained for a minimum of twenty (20) years after the file is closed, as required by the WGBO. In exceptional circumstances — for example if a legitimate interest exists — it may be retained for longer.
Financial Records
Invoices and other financial records containing personal data are retained for seven (7) years after the end of the financial year, in accordance with Dutch fiscal retention obligations.
Contact Data
General contact details (e.g. from enquiry forms or emails) are retained for one (1) year after the last contact, unless you request earlier deletion.
7. How We Protect Your Data
We take appropriate technical and organisational measures to protect your personal data against loss, misuse, and unauthorised access. These measures include secure login credentials, encrypted storage via our third-party tools, and limiting access to your data to authorised persons only.
Please be aware that certain forms of communication — including email, SMS, WhatsApp, and standard telephone calls — cannot be guaranteed to be fully secure. We recommend that you do not send sensitive personal or health information via these channels. Where possible, please communicate sensitive matters through our secure client portal in Zanda Health.
8. Who We Share Your Data With
Your personal data is not shared with third parties except in the following circumstances:
• With other healthcare providers, where necessary for your treatment and only with your explicit consent
• With service providers who process data on our behalf (see Section 5), under appropriate data processing agreements
• If a complaint is submitted against Quilt Psychology, relevant data may be shared with the applicable professional complaints body (e.g. ABvC or SCAG), who are bound by confidentiality
• If required by a court order or applicable law
Your personal data will not be sold or provided to third parties for commercial purposes.
9. Your Rights
Under the GDPR, you have the following rights in relation to your personal data:
• The right to access your personal data and receive a copy (Article 15 GDPR)
• The right to have inaccurate or incomplete data corrected (Article 16 GDPR)
• The right to object to, or request restriction of, the processing of your data (Articles 18–21 GDPR)
• The right to erasure (‘right to be forgotten’) in certain circumstances (Article 17 GDPR)
• The right to data portability — to receive your data in a structured, commonly used, machine-readable format (Article 20 GDPR)
Please note that the right to erasure may be limited where we are legally required to retain your data (for example, under the WGBO retention period for client files).
To exercise any of these rights, please contact us using the contact details at the top of this document. We will respond within one month of receiving your request.
10. Amendments to This Privacy Statement
We may update this Privacy Statement from time to time to reflect changes in our practices or applicable legislation. In the event of significant changes, we will notify active clients by email. The most recent version is always available on our website or upon request.
Quilt Psychology — Privacy Statement — The Netherlands
Last updated: May 2026