Practice information

Privacy statement

Version July 2026 · Sati Psychologie · Jasper von Richthofen, MSc · Psycholoog NIP (member no. 242129) · Dutch Chamber of Commerce (KvK) 71982787 · De Bilt

Your privacy is at the heart of good care. In this statement you can read which data Sati Psychologie processes, why, how long it is kept and what rights you have. The processing complies with the General Data Protection Regulation (GDPR) and the Dutch WGBO act. This is an English translation for your convenience; the Dutch version prevails in the event of any discrepancy.

1. Who is responsible?

Sati Psychologie, based in De Bilt, the Netherlands (KvK 71982787), is responsible for the processing of personal data as described in this statement. Data controller: Jasper von Richthofen, MSc, Psycholoog NIP. Contact: info@satipsychologie.nl.

2. Which data is processed?

  • Contact and identification data: name, address, date of birth, telephone number and email address.
  • Health data: the information needed for good treatment, recorded in the client file: intake data, treatment plan, session notes, questionnaires and correspondence relating to the treatment. This is special category personal data.
  • Payment data: data needed for invoicing and the statutory administration.
  • Website data: data you fill in via the sign-up form. The website sets no cookies and no visitor profiles are built.

3. For what purpose and on what legal basis?

  • Carrying out the treatment agreement: intake, treatment and evaluation (basis: contract).
  • Keeping the legally required client file (basis: legal obligation, WGBO).
  • Invoicing and administration (bases: contract and legal obligation, including the tax retention obligation).
  • Answering questions and sign-ups via the website (basis: legitimate interest or consent).

Health data is processed by a care provider bound by professional confidentiality, within the statutory exception for healthcare. Data is never sold or shared for commercial purposes. Because the care is uninsured, nothing is shared with health insurers and no diagnostic information is submitted to national systems.

4. Confidentiality

As a psychologist I have a duty of confidentiality (NIP code of conduct). Information about you is only shared with third parties, for example your GP, if you give explicit written consent for this, unless I am legally obliged to provide data. Any client organisation or employer never gains access to substantive treatment information, even if they (partly) pay for the treatment.

5. How long is data kept?

  • Client file: 20 years after completion of the treatment, in line with the statutory retention period of the WGBO, or longer if needed for good care. You can request earlier destruction in writing; this will be honoured unless the law precludes it.
  • Financial administration (invoices with name and address details): 7 years, in line with the tax retention obligation.
  • Sign-ups and enquiries without follow-up: as long as needed to handle them, up to a maximum of 6 months.

6. Systems, processors and security

  • Video calls: sessions take place via Zoom, using a paid business account. Zoom acts as a processor here; Zoom’s Data Processing Addendum applies. Sessions are encrypted, secured with a waiting room and access code, and are never recorded.
  • Invoicing and bookkeeping: Moneybird, with a processing agreement. The administration contains only the data needed for invoicing (name, address, invoice amount), no substantive treatment information.
  • Client file: the file is stored locally on an encrypted computer (FileVault), secured with a strong password and two-factor authentication. No cloud service processes file data. Backups are also stored encrypted.
  • Sign-up form: technically processed by Formspree Inc. (USA, certified under the EU-US Data Privacy Framework); submissions are deleted after processing.
  • Email: info@satipsychologie.nl. We prefer to exchange substantive or sensitive information in the session, not by email.

In the event of a data breach with risk to those involved, a report is made to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and you will also be informed if that is required.

7. Your rights

  • The right to access your file and to a copy of it.
  • The right to rectification of incorrect data and to add your own statement to the file.
  • The right to erasure of your data, within the limits of the statutory record-keeping obligation.
  • The right to restriction of processing and the right to object.
  • The right to data portability.
  • The right to withdraw consent you have given.

Send a request to info@satipsychologie.nl; you will receive a reply within four weeks. To be sure the request comes from you, proof of identity may be requested. Not satisfied with how your data is handled? You can lodge a complaint with the Dutch Data Protection Authority.

8. Website

The website satipsychologie.nl uses a secure connection (https). Data you send via the sign-up form is only used to contact you. The site sets no cookies and uses no tracking; any visitor statistics are anonymous and cannot be traced back to you. Fonts load from this website or your own device; your browser does not connect to Google Fonts for this.

9. Changes

This privacy statement may be amended, for example in the case of new legislation or different systems. The current version is always on this page.