Privacy

Privacy

How INTROSPECT processes personal and health-related data under the GDPR.

Controller

INTROSPECT (online psychiatry practice of Dr. Miftar Zenelaj) is the data controller for session requests, clinical reports, and session recordings created in this application.

Privacy contact

[email protected]

Purposes

• Respond to and schedule session requests.
• Provide online video sessions.
• Create and retain clinical documentation required for care.
• Secure the service (access control, audit logging, abuse prevention).

Lawful bases

• Art. 6(1)(b) - steps prior to a contract / provision of the requested session.
• Art. 6(1)(a) & Art. 9(2)(a) - explicit consent for health-related information you submit in the booking form (or on the join screen for clinician-scheduled appointments).
• Art. 6(1)(a) & Art. 9(2)(a) - optional explicit consent before any video recording may start; joining a session does not require recording consent.
• Art. 9(2)(h) - provision of health care / clinical documentation by a regulated professional, where applicable under national law.
• Art. 6(1)(f) - limited legitimate interests for security logging and fraud prevention.

Categories of data

• Identity and contact: name, email, phone (optional).
• Booking content: preferred language, topic, message, chosen slot.
• Clinical report fields written by the psychiatrist.
• Technical: session join tokens, IP addresses in security/audit logs, browser user-agent.
• Optional session recordings only after you give explicit consent (lobby checkbox or during the call); the clinician cannot start recording without that agreement. You may join without agreeing to be recorded.

Your rights

• Access, rectification, erasure, restriction, objection, and data portability where applicable.
• Withdraw consent for booking-form health data without affecting processing based on other lawful bases (e.g. existing clinical records).
• Lodge a complaint with your supervisory authority.
• Contact the practice privacy email to exercise rights. Clinical retention duties may limit erasure of medical records.

How long we keep information

We keep booking and clinical information for as long as care and the law require — usually up to seven years for clinical records, unless a longer period is required. Short technical security logs are kept so we can investigate misuse. You can ask us for the periods that apply to your situation.

How we protect your information

• Only authorised clinic staff can sign in, and accounts lock after repeated failed attempts. Staff sessions end automatically after a period of inactivity.
• The website uses an encrypted connection (HTTPS) so information you send is protected in transit.
• We keep an internal record when staff access, export, or erase personal data, so we can account for how information was handled.
• If a session is recorded (only with your clear agreement), the recording is stored privately and can be opened only by authorised clinicians — not by the public.

Where your data is held

We operate this service on systems under our control. If we use trusted providers for hosting, email, or backups, we choose them carefully and require written agreements that protect your information. We will not send your data outside the European data-protection area without appropriate safeguards and, where required, without informing you.

This notice was last updated on 9 September 2026. If we make important changes, we will update this page. When you request a session, you will be shown the current version of this notice before you give consent.