Privacy Policy
Last updated: 24 October 2026
1. Who we are
CWALERA SIB S.R.L. owns willingnestclinic.com and runs the WillingNest Clinic platform. It offers the platform, free of charge or for a fee depending on the arrangement, to the partner psychologists listed on the site. CWALERA SIB S.R.L. is the data controller for data collected through the website: messages, bookings, payments, course accounts, the newsletter and website statistics.
When you start therapy or an assessment, the psychologist you work with provides that service through their own registered practice. That psychologist is the controller of your clinical records and is bound by professional secrecy (see section 3).
- Company: CWALERA SIB S.R.L., Str. Tipografilor nr. 24, ap. 2, Sibiu, Romania
- Registration: J32/177/2022 · Tax ID (CUI) 45557703
- Represented by: Andrei-Raul Cojocaru and Alexandra-Maria Iurian
- Privacy contact: office@willingnestclinic.com
We are a small practice, so we have not appointed a Data Protection Officer. Write to the address above for any question about your data; we reply within one month.
2. What we collect and why
We collect only what we need for each purpose below. The legal basis comes from Article 6 GDPR, and for health information also Article 9.
| Purpose | Data | Legal basis |
|---|---|---|
| Answering your message (contact form, email) | Name, email, what you write | Steps before a contract, Art. 6(1)(b); our legitimate interest in replying, Art. 6(1)(f) |
| Booking a free call or a session | Name, email, time zone, chosen time, optional note | Steps before a contract, Art. 6(1)(b) |
| Providing therapy and assessment | Contact details, session notes, questionnaire results, health information you share | Contract, Art. 6(1)(b); health care provided by a psychologist bound by professional secrecy, Art. 9(2)(h) |
| Payments and invoices | Name, email, billing address, amount, payment status (card details stay with the payment provider) | Contract, Art. 6(1)(b); legal accounting duties, Art. 6(1)(c) |
| Online courses | Account name, email, course progress | Contract, Art. 6(1)(b) |
| Newsletter and free guide | Email, first name, opening of emails | Your consent, Art. 6(1)(a), which you can withdraw at any time |
| Website security and spam protection | IP address, browser data, anti-bot check | Legitimate interest in a safe website, Art. 6(1)(f) |
| Website statistics | Pages visited, device, approximate location | Your consent through the cookie banner, Art. 6(1)(a) |
We do not sell your data, and we do not use it for automated decisions about you.
3. Health information and confidentiality
What you share in therapy stays between you and your psychologist. Our psychologists are bound by professional secrecy under the Romanian Code of Ethics for psychologists (Colegiul Psihologilor din România) and the NIP Code of Ethics.
- We never put clinical notes in email marketing, analytics or payment tools.
- We keep clinical notes in a separate, access-controlled system (our own client records system or Google Workspace), never on the website.
- Our psychologists discuss cases in professional supervision without information that identifies you.
- We share health information only with your written consent, or where the law requires it, for example a serious and immediate risk to life.
4. Service providers and transfers outside the EU
We use a small number of providers that process data on our behalf under data processing agreements.
| Provider | What they do for us | Where data may go |
|---|---|---|
| SiteBunker (hosting) | Hosts the website and its database | Romania (EU) |
| Google Workspace | Video sessions (Google Meet), email and secure storage of client files (Google Drive) | EU and US, under the EU–US Data Privacy Framework |
| Cloudflare | Runs our booking system (bookings are stored in Cloudflare Workers KV) and the spam protection on our forms (Turnstile) | Global network, under the EU–US Data Privacy Framework |
| MailerLite | Newsletter and free guide emails | EU; some US sub-processors under Standard Contractual Clauses |
| Brevo | Sends the website’s automatic emails (form confirmations, orders) | EU (France) |
| Stripe and WooPayments | Card payments and invoices | EU and US, under the EU–US Data Privacy Framework |
| Google (Analytics, Search Console) | Website statistics, only after cookie consent | US, under the EU–US Data Privacy Framework |
| Jetpack (Automattic) | Login protection and basic site statistics | US, under the EU–US Data Privacy Framework |
When data leaves the EU, we rely on the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.
5. Cookies and statistics
We use strictly necessary cookies to run the site, the cart and your login. Statistics cookies load only if you accept them in the cookie banner. You can change your choice at any time via the banner or our Cookie Policy.
6. How long we keep data
| Data | How long |
|---|---|
| Clinical records (notes, assessments, test results) | At least 10 years after our work together ends, as the Romanian Code of Ethics for psychologists requires (art. 42); then securely destroyed (art. 44) |
| Invoices and accounting records | 10 years, as Romanian accounting law requires |
| Booking details | Until the appointment has passed, then as part of your client record if you start therapy |
| Messages that do not lead to therapy | 12 months after our last reply |
| Newsletter data | Until you unsubscribe |
| Course accounts | Until you ask us to close the account, or 3 years without activity |
| Server and security logs | Up to 90 days |
If a complaint or legal claim is open, we keep the relevant records until it is resolved.
7. Your rights
You can ask us at any time to:
- see the data we hold about you and get a copy;
- correct data that is wrong;
- delete your data, unless the law requires us to keep it (for example invoices or clinical records);
- limit or object to how we use it;
- receive your data in a portable format;
- withdraw consent, for example to the newsletter, without affecting what we did before.
Write to office@willingnestclinic.com. We may ask you to confirm your identity first.
You can also complain to a data protection authority: in Romania the ANSPDCP, or the authority in the EU country where you live, such as the Autoriteit Persoonsgegevens in the Netherlands.
8. Security, age and changes
Security. The site uses an encrypted connection (HTTPS), spam and bot protection on forms, login protection and regular backups. Access to client data is limited to your psychologist.
Children and young people. We work with clients under 18 only with the agreement of at least one parent or legal guardian, as the Romanian Code of Ethics for psychologists requires (art. 137 and 157). The exceptions are emergencies or a court decision. We also explain our work to the young person in words they understand and ask for their own agreement. Parents or guardians exercise the young person’s data rights on their behalf. From age 12 we involve the young person in these decisions, and from age 16 we treat their own wishes as decisive where they can reasonably judge their interests (NIP Code of Ethics, art. 7). What a young person shares in sessions stays confidential, except where their safety or the law requires otherwise. The newsletter and online courses are for people aged 16 and over.
Changes. We update this policy when our services or providers change. The date at the top shows the latest version; for important changes we will also tell current clients by email.