Welcome to APONIA.ro. We care about your privacy, not just checking a legal compliance box. Please read carefully: written for humans, not lawyers.

1. Who We Are and What We Do

APONIA.ro is an online scheduling and practice management platform connecting psychotherapists with their clients. We process personal data as a Data Controller for account, platform security, and billing operations, and as a Data Processor (Art. 28 GDPR) on behalf of therapists for clinical session notes and patient intake records, in compliance with Regulation (EU) 2016/679 (GDPR).

If you have questions about how we handle your data, you can reach us at the contact details below.

2. What Data We Collect

2.1 Data You Provide Directly

Category	Details
Identification Data	First and last name
Contact Data	Email address, phone number
Platform Role	Therapist or patient / client
Booking Data	Date, time, and session parameters
Session Notes & Intake	Clinical observations entered by the therapist
Billing Data	Relevant exclusively to therapists (subscriptions and invoicing)

2.2 Automatically Collected Technical Data

When using the platform, our systems log standard technical data (IP address, browser type, device information, access timestamps) strictly for operational stability, rate limiting, and security monitoring.

2.3 Special Category Health Data (Art. 9 GDPR)

Session notes, psychological intake forms, and clinical observations fall under GDPR Article 9 as special category health data. For these records, the psychotherapist acts as the independent Data Controller, and APONIA acts strictly as a Data Processor under our Data Processing Agreement (DPA). We never access, reuse, or train AI models on clinical notes.

3. Legal Bases and Purposes of Processing

Every processing activity relies on a defined GDPR legal ground:

Performance of Contract (Art. 6(1)(b) GDPR)

• Creating and managing your user account
• Scheduling and managing therapy sessions
• Transactional communications (confirmations, automated reminders)
• Subscription management and SaaS billing (for therapists)

Legal Obligations (Art. 6(1)(c) GDPR)

• Compliance with Romanian tax and accounting laws (Romanian Law No. 36/2023)
• Responding to lawful requests from competent public authorities

Legitimate Interests (Art. 6(1)(f) GDPR)

• Platform security, brute-force mitigation, and unauthorized access prevention
• Resolving technical errors and infrastructure diagnostics

Explicit Consent & Healthcare Grounds (Art. 9(2)(a) & Art. 9(2)(h) GDPR)

• Processing sensitive mental health data and clinical notes under the direction of the therapist

4. Data Retention Periods

We retain personal data no longer than necessary for the underlying purposes:

Data Category	Retention Period
Active Account	Duration of the active contract/account
Session Records & Clinical Notes	Active contract duration + 30-day export grace period, or upon therapist deletion request
Invoices & Accounting Records	5 years starting July 1 of the year following issuance (Romanian Law No. 36/2023)
Technical Security Logs	Up to 90 days (12 months for authentication audit logs)

Upon expiration of the retention period, data is permanently erased or irreversibly anonymized.

5. Where Your Data Is Stored

All customer data is hosted on Google Cloud Platform / Firebase infrastructure located in the europe-west3 region (Frankfurt, Germany), strictly within the European Economic Area (EEA). All data is encrypted in transit (TLS 1.3) and at rest (AES-256).

6. Subprocessors and Third Parties

We do not sell, rent, or commercialize your personal data. We engage vetted subprocessors strictly under GDPR Article 28 data processing agreements:

• Google Cloud / Firebase (Frankfurt, EEA): Hosting, database, authentication infrastructure.
• Brevo (Sendinblue SAS, France, EEA): Transactional email delivery and security OTP codes.
• Stripe Payments Europe Ltd. (Ireland, EEA): SaaS payment processing and subscription billing.

7. Your GDPR Rights

Under the GDPR, you have the right to:

• Right of Access: Request a complete copy of personal data held about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data, subject to statutory retention obligations.
• Right to Restriction of Processing: Request suspension of processing under specific circumstances.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing carried out under legitimate interest.
• Right to Withdraw Consent: Withdraw previously granted consent at any time without retroactive impact.

To exercise your rights, email us at privacy@aponia.ro. We respond within 30 days.

You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP) at www.dataprotection.ro.

8. Data Security Measures

We implement strict technical and organizational measures (TOMs): role-based access control (RBAC), end-to-end transport encryption, encrypted backups, and mandatory Multi-Factor Authentication (Email OTP) for therapists.

9. Policy Updates

We may update this policy periodically. Material changes will be communicated via email or an in-platform notification at least 14 days prior to taking effect.

10. Contact

---

This privacy policy applies exclusively to the APONIA.ro platform.