Privacy policy — Psicobot

1. Controllers and processors

For direct Psicobot users, the service's own operations and the management of professional accounts, the controller is Manuel Rafael Elena Navarro, tax ID 30829665M, calle Princesa 9, 3.º B, 30002 Murcia, Spain, contacto@psicobot.net.

For a case initiated by an external psychologist or practice, when that professional determines the purposes and essential means of the case, that professional or practice is the controller of case data, and Psicobot processes the case under instructions and an Article 28 GDPR agreement. Its identity, contact details and privacy information must be displayed to the client before activation. Psicobot may remain a separate controller for its own accounts, billing and platform security. Actual activities determine legal roles, not contractual labels alone.

2. Information collected

Depending on enabled features, information may include names and account identifiers, email, protected credentials, language, professional relationship and profile, chat messages, questionnaire answers and scores, goals, life timeline, functional analysis, motivation, "My Process" content, files and transcriptions, professional plans and reports, AI-generated case summaries, the Structured Longitudinal Case Representation (SLCR; Spanish SLRC), security events, support communications, versioned acceptance and withdrawal records, and payment data where relevant.

This information may reveal health or other special-category data, even without a formal diagnosis. Removal of direct identifiers does not necessarily amount to anonymisation. Do not disclose unnecessary personal data concerning other people.

3. Purposes and legal bases

Account management and requested core functions: performance of a contract (GDPR Article 6(1)(b)); security may, where justified, rely on a balanced legitimate interest (Article 6(1)(f)).

Sensitive psychological information in direct use: the applicable Article 6 legal basis together with explicit consent under Article 9(2)(a) where needed for messages, assessments, plans, SLCR summaries and continuity of the service. You may refuse or withdraw consent at any time. Functions that require such data will then no longer be available. This is not consent to marketing or model training.

Cases managed by external professionals: the case controller determines, documents and explains its Article 6 basis and Article 9 condition, which are not necessarily consent in healthcare settings. Psicobot follows the controller's documented instructions and cannot independently repurpose case data for incompatible purposes.

Compliance, records, security incidents, legal claims and financial administration: relevant statutory obligations, justified legitimate interests and legal-claims provisions. Advertising, optional analytics, research and model training: not authorised by the core service consent; any such purpose would require separate transparent justification and permissions before activation. Personal psychological content is not sold to advertisers.

4. AI, professional access and longitudinal representation

Chat replies are generated automatically. They are not individually approved by a psychologist before being sent. Information necessary to support continuity is added to the longitudinal case representation after sessions. This integration is part of the current service rather than an independently optional sensitive-data feature. An assigned professional may access only the sections and data authorised under the actual account and case relationship, as described before access. Plans requiring professional publication are withheld until expressly reviewed and accepted for publication. AI can be inaccurate and is neither guaranteed clinical assessment nor emergency monitoring.

Psicobot does not use AI outputs, by themselves, to make decisions producing legal or similarly significant effects. If such decisions are enabled in future, applicable safeguards will be introduced first.

5. Recipients and international transfers

Access is restricted to authorised personnel, appropriately linked professionals and necessary technical provider categories: hosting, databases, email, security, support, AI, and voice/transcription or payments only if actually deployed. Competent authorities may receive information where legally required.

AI processing may use the OpenAI API and may involve access from, or transfers to, countries outside the European Economic Area. Where relevant, the required GDPR Chapter V safeguards must apply, such as adequacy decisions or standard contractual clauses and appropriate supplementary safeguards. Routine cross-border transfers are not justified simply by obtaining a general Article 49 risk consent. The linked, versioned Psicobot Provider and Transfer Register identifies only verified providers, functions, regions, safeguards and technical retention periods in the live environment.

Different API endpoints may store information for different periods. Psicobot does not promise exclusively European storage, complete anonymisation, no third-party retention, or special retention controls without deployment-specific evidence.

6. Retention

Direct non-healthcare account and psychological content: retained as needed during the relationship. Following withdrawal or account closure, erasure or legally required restriction is targeted operationally within 30 days, without overriding legal obligations or unresolved requests.

Ordinary backups under Psicobot's control: proposed maximum rotation of 90 days following operational deletion, contingent upon actual implementation; recovered copies must be reconciled with pending deletion records.

Acceptance, consent, withdrawal, contracts and rights-request evidence: where necessary for compliance and legal claims, separated and restricted for an ordinary period of up to five years after termination or closure, subject to different mandatory periods or pending claims. These audit records do not contain entire psychological conversations.

Minimised technical/security logs: up to 12 months when proportionate and necessary. Business records: applicable statutory periods, including six years for relevant commercial documentation. Healthcare records controlled by external clinicians: retained according to their legal duties and documented instructions; they are not automatically deleted merely because a user withdraws platform consent or closes an account.

Actual deletion and backup arrangements and supplier-side retention are specified in the verified provider/system inventory.

7. Rights and withdrawal

You may request access, rectification, erasure, objection, restriction, portability where applicable and safeguards concerning automated decisions. You may withdraw explicit consent at any time, without affecting lawful processing that already occurred. Withdrawal stops new processing that relies on that consent and may disable chat, tests and longitudinal functions. Your privacy and account-closure options remain accessible.

Contact contacto@psicobot.net or use "Privacy and rights" within the account. Requests relating to an external professional's case will be routed to that controller. Identity may be verified proportionately. You may complain to the Spanish Data Protection Agency (AEPD, www.aepd.es).

8. Security, children and amendments

Appropriate technical and organisational safeguards are required in line with the risk; specific public security claims must match verified production controls. No internet-based system can promise zero risk. Breaches will be assessed and notified where legally required. The service is limited to adults aged 18 or over; Spain's different age threshold for some data-processing consent does not change our admission policy.

Material changes to purposes, controller, recipient categories or applicable processing terms will lead to a version update and renewed information, acceptance or consent as legally necessary. Contact: contacto@psicobot.net.