Privacy Policy

1. Data controller

The data controller is TODO ("Roots Wellness Center", "we"), registered office: TODO, VAT no.: TODO, General Commercial Registry (GEMI) no.: TODO, which organises and runs the FreeTherapy.gr program.

For any personal data matter, contact us at free@roots.gr or 2109510725. We have not appointed a Data Protection Officer (DPO); all requests go to the contact details above.

2. What data we collect

We only collect what you give us in the application, plus minimal technical data:

• Identity and contact details: full name, date of birth/age, address, telephone, email, availability for sessions.
• Social and demographic information: relationship status, education, work, cultural background.
• Special categories of data (GDPR Article 9): physical and mental health data, medication, sleep, substance use, sex life and sexual orientation, gender identity, religious or philosophical beliefs, experiences of trauma.
• Information about other people that you choose to mention (e.g. family mental-health history). Please only include what you consider necessary to understand your situation.
• Technical data: your IP address and access time are logged temporarily by our hosting provider for website security, plus the language cookie (see "Cookies").

3. Purposes and legal basis

• Assessing your application, the initial assessment meeting, matching you with a trainee therapist and communicating with you: your explicit consent (GDPR Articles 6(1)(a) and 9(2)(a)) and steps taken at your request before you join the program (Article 6(1)(b)).
• Providing psychotherapy, if you join the program: the provision of health care by professionals bound by professional secrecy (Article 9(2)(h) and 9(3)), together with your consent.
• Clinical supervision and training of trainee therapists: regular supervision is part of the program and takes place without information that identifies you. Session samples or extracts are used only with your separate, specific consent, which is requested later and which you may refuse with no effect on your participation.
• Website security and abuse prevention (e.g. limiting automated submissions): our legitimate interest (Article 6(1)(f)).
• Compliance with our legal obligations (Article 6(1)(c)).

4. Which details are required

Only your full name, telephone, email and the consent declarations are required; without them we cannot consider your application. Everything else is optional. If you leave it blank, your application is still considered, though those topics may be discussed at the initial assessment meeting.

5. Who has access to your data

Your data is never sold or used for advertising. Access is limited to:

• Authorised members of the center's assessment team, the trainee therapist you are matched with and the program's clinical supervisors, all of whom are bound by a duty of confidentiality.
• The trainee therapist's training institution (university or Lifelong Learning Centre), only for anonymised session material and only if you have given your separate consent.
• Service providers acting as processors under a data processing agreement (GDPR Article 28): Vercel Inc. (website hosting; your application passes through its servers only transiently, in memory, while being sent, and is not stored) and Google Ireland Limited (Google Workspace — the email service in which applications are received and kept).
• Public authorities, only where required by law.

6. Transfers outside the European Economic Area

The website runs on servers in the European Union (Frankfurt). However, Vercel Inc. and Google's parent company (Google LLC) are based in the United States and may process data from there. These transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework, for certified companies, and on the Commission's Standard Contractual Clauses (GDPR Article 46).

7. How your data is protected

• Your application is transmitted encrypted (TLS) from your device to the website and from there to the center's email. Sending is aborted if an encrypted connection cannot be established.
• The website keeps no database of your answers.
• Nothing is stored on your device: while you fill in the form, your answers stay only in browser memory and are discarded as soon as you close the page.
• Access to the center's email and records is restricted to authorised people.

8. How long we keep your data

• Applications that do not lead to participation (e.g. if the program is not suitable, you withdraw, or the waiting list ends): deleted no later than 12 months after the decision or our last contact.
• If you join the program: your application and therapy records are kept for the duration of therapy and, after it ends, for as long as our professional and legal obligations require, and are then securely destroyed.
• If you withdraw your consent or request erasure, your data is deleted without undue delay, unless the law requires us to keep it.
• Technical logs are kept by our hosting provider for a limited period.

9. Applicants aged 16–17

Applications are accepted from age 16. For participants under 18, written consent from a parent or legal guardian is required before sessions begin, and we will contact you about this. We do not accept applications from anyone under 16; if we find that one has been submitted, we delete it.

10. Your rights

You have the right to:

• access your data (GDPR Article 15);
• have inaccurate or incomplete data corrected (Article 16);
• erasure (Article 17);
• restriction of processing (Article 18);
• portability of the data you provided (Article 20);
• object to processing based on our legitimate interest (Article 21);
• withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal (Article 7(3)).

11. How to exercise your rights

Send your request to free@roots.gr. Exercising your rights is free of charge. We will reply within one month; for complex requests this may be extended by two further months, and we will let you know. We may ask you to confirm your identity so that your data is not disclosed to someone else.

12. Automated decisions

No decisions are made solely by automated means and no profiling takes place. Every application is assessed by people.

13. Cookies

We use no tracking, analytics or advertising cookies. The only cookie is a strictly necessary one (NEXT_LOCALE) that remembers the language you chose. Strictly necessary cookies do not require consent (Article 4(5) of Greek Law 3471/2006), which is why no cookie banner is shown.

14. Right to lodge a complaint

If you believe the processing of your data breaches the law, you have the right to lodge a complaint with the Hellenic Data Protection Authority (1-3 Kifisias Ave., 115 23 Athens, tel. +30 210 6475600, www.dpa.gr). We would, however, appreciate the chance to resolve the matter with you first.

15. Changes to this policy

We may update this policy from time to time. The date of the last update is shown at the top of the page. If a material change affects applications in progress, we will inform you directly.