Privacy Policy
This policy explains what personal data Arvorina handles, why, where it is kept and what you can do about it. We try to collect only what a meeting between a person and a psychologist really needs — and to protect it as if it were our own.
1. Who we are
Arvorina is operated by Vitaliy Petroff, a sole trader (empresário em nome individual) established in Portugal. He is the controller of the personal data described here, unless this policy says otherwise. Address and tax number are listed in the legal notice.
- General contact: info@arvorina.com
- Privacy and data requests: privacy@arvorina.com
2. What this policy covers
It covers this website (arvorina.com) and the Arvorina service: a platform where Russian-speaking people living in Europe find a psychologist, and where psychologists keep a profile, a personal site, online booking, calendar sync, chat, video sessions and notes. The service is currently in a closed pilot; the public launch is coming soon.
Psychologists are independent professionals. When a psychologist works with a client — keeps notes, reads a shared diary, runs a session — the psychologist decides how that client information is used and is its controller. For those records Arvorina acts as the psychologist’s processor (Article 28 GDPR): we store and protect them on the psychologist’s instructions and do not use them for anything else.
3. This website
This coming-soon site sets no cookies, uses no local storage, runs no analytics, no trackers and no scripts, and loads nothing from other servers — fonts and images come from our own server.
Like every web server, ours records technical access logs: IP address, time, requested page, browser (user agent) and response code. We use them only to keep the site secure and working (legitimate interest, Article 6(1)(f) GDPR). They are rotated and overwritten automatically and are not combined with any other data.
If you write to us by e-mail, we use your address and message only to reply, and keep the correspondence as long as needed for that conversation.
4. Data in the Arvorina service
Everyone with an account
- E-mail address, password hash (we never store or know your password), role, account status, dates of registration and e-mail confirmation, the version of the terms you accepted.
- Sign-in and security data: session records, an optional second factor (2FA), IP address on failed sign-in attempts.
Clients
- Bookings: name, e-mail, chosen psychologist, service, date and time, status, and an optional comment (stored encrypted).
- Messages and chat with a psychologist, including attachments (stored encrypted).
- Mood diary, if you choose to keep one: mood, feelings, notes (stored encrypted under a key of its own). A psychologist sees it only if you share it, with a separate consent for each share, and you can stop sharing at any time.
- Matching, if you use it: the topics you pick and, if you choose to describe your situation in your own words, that text, so we can suggest suitable psychologists.
- Reminders: e-mail by default; optionally a Telegram chat ID or a phone number for SMS (stored encrypted).
- Reviews you write about a psychologist.
What people tell a psychologist often concerns their mental health. That is health data, a special category under Article 9 GDPR. We process it only with your explicit consent and only to provide the service you asked for.
Psychologists
- Profile and personal site: name, photo, professional title, education and training, approaches, languages, formats, prices, office address, contact details — each public or private as you choose; diplomas you upload for checks (visible to moderators only unless you make them public).
- Moderation and checks: results of reviews and the badges they produce.
- Practice tools: schedule and availability, bookings, client cards and session notes (stored encrypted; optionally in a personal vault, see section 11), blog posts.
- Subscription: plan, period, status and Stripe customer and subscription IDs. Card details are entered on Stripe’s page; we never receive or store card numbers.
- Calendar sync, if you connect Google or Outlook — see sections 6 and 7.
Video sessions
Video runs on our own server in the EU. Sessions are not recorded; audio and video pass through the server only in transit. We keep connection metadata (who joined and left, when) for 12 months to resolve disputes and keep the service reliable.
Technical data
Server and application logs (without form contents) and error reports that help us find and fix bugs.
5. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Accounts, profiles, booking, chat, video, reminders, calendar sync — running the service you signed up for | Contract, Art. 6(1)(b) |
| Health data in messages, bookings, the diary and matching text | Explicit consent, Art. 9(2)(a); you can withdraw it at any time |
| Session notes and client cards kept by a psychologist | The psychologist’s own basis as controller; we process on their behalf, Art. 28 |
| Reviewing profiles and content, protecting users, preventing spam, fraud and abuse | Legitimate interest, Art. 6(1)(f); legal obligations under the Digital Services Act, Art. 6(1)(c) |
| Psychologists’ subscriptions, invoices and accounting | Contract, Art. 6(1)(b); tax law, Art. 6(1)(c) |
| Service e-mails (confirmations, reminders, security notices) | Contract, Art. 6(1)(b) |
| Logs and error reports for security and reliability | Legitimate interest, Art. 6(1)(f) |
We send no marketing e-mails without your separate consent. We show no ads and do not sell personal data. We make no decisions with legal or similarly significant effects based solely on automated processing (Article 22 GDPR); automated checks only help a human moderator.
6. Google user data
Psychologists can choose to connect a Google Calendar so that busy times in their calendar block booking slots on Arvorina, and sessions booked on Arvorina appear in their calendar. Clients never connect a Google account, and nothing happens until the psychologist starts the connection and approves it on Google’s consent screen.
Permissions (OAuth scopes) we request
| Scope | Why |
|---|---|
openid, email | To show which Google account is connected. |
https://www.googleapis.com/auth/calendar.readonly | To list your calendars so you can choose which ones count as busy, and to read the start and end times of events in those calendars. |
https://www.googleapis.com/auth/calendar.events | To create, update and delete the events for sessions booked on Arvorina in the one calendar you choose, and to receive change notifications so availability stays current. |
What we read
- Your calendar list: calendar ID, name, whether it is primary, and whether we can write to it.
- For the calendars you mark as busy: for each event, only its ID, start and end time, whether it is all-day, whether it is cancelled, and whether it is marked “free”. We do not read or store event titles, descriptions, locations, attendees or attachments.
What we write
- For each confirmed booking, one private event in the calendar you chose. By default it is titled “Session (Arvorina)” without the client’s name; you can choose to show the service name or the client’s name instead, or to write nothing at all.
- When a booking is moved or cancelled, we update or delete that event. We never touch events we did not create.
What we store
- Access and refresh tokens and the connected account’s e-mail — encrypted with the psychologist’s own key.
- Calendar IDs and names, your sync settings, and technical sync markers (sync tokens, notification channel IDs).
- Busy intervals (start, end, event ID) for a window from 7 days in the past to 180 days ahead; intervals older than 7 days are deleted automatically.
- Links between bookings and the events we created, so we can update or remove them.
How we use it — and how we don’t
- We use Google user data only to show your availability and keep your calendar and your Arvorina bookings in sync — a feature you turned on and can see.
- We do not sell it, use it for advertising, retargeting or interest-based ads, use it to build user profiles, or use it to develop, improve or train generalised AI or machine-learning models.
- We do not transfer it to anyone, except to the hosting provider that stores our encrypted database (as our processor), when required by law, or as part of a merger or acquisition with prior notice to you.
- No person at Arvorina reads it, except with your explicit permission for a specific support request, when necessary for security (for example, investigating abuse), to comply with applicable law, or where the data has been aggregated and anonymised for internal operations.
Disconnecting
You can disconnect at any time in your account settings. We then stop the change notifications, revoke the token at Google, and delete the tokens, calendar list and busy times straight away; you can also choose to remove the events we created. You can revoke access independently at myaccount.google.com/permissions; we notice it at the next sync and stop.
Arvorina’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
7. Microsoft (Outlook) calendar data
Psychologists can also connect an Outlook or Microsoft 365 calendar through Microsoft Graph. It works exactly like the Google connection above: same purpose, same data read, written and stored, same limits on use, sharing and human access, same deletion on disconnect.
Permissions we request: openid, email and User.Read (to show which account is connected), offline_access (to keep syncing without asking you to sign in again), and Calendars.ReadWrite (to read event times in the calendars you choose and to write events for your Arvorina bookings). Events we write are marked private. When you disconnect we delete the tokens on our side; you can remove Arvorina’s access in your Microsoft account at account.live.com/consent/Manage (personal accounts) or myapps.microsoft.com (work or school accounts).
8. Who receives data
Other users
Visitors see what a psychologist chose to make public. A psychologist sees what a client sends or shares with them. A client sees their own bookings, messages and diary.
Service providers (processors)
They act only on our instructions, under data processing agreements (Article 28 GDPR). Some are used only when you turn on a feature.
| Provider | What for | Where |
|---|---|---|
| Hetzner Online GmbH, Germany | Servers, database, file storage, video server | EU (Germany, Finland) |
| Brevo (Sendinblue SAS), France | Sending service e-mails | EU |
| Stripe Payments Europe Ltd., Ireland | Psychologists’ subscription payments (Stripe is also an independent controller for its own legal and anti-fraud duties) | EU; some data may go to Stripe, Inc. in the US |
| Twilio Ireland Ltd. | SMS reminders — only if a client chooses them | EU (Ireland); Twilio Inc. in the US may access |
| Anthropic (Claude model), through an EU cloud region | Understanding free-text descriptions in matching — only if a client writes one; not used to train models | EU |
| Functional Software, Inc. (Sentry), EU data region | Error reports, without form contents | EU (Germany); US company |
Services you connect yourself
Google, Microsoft and Telegram receive data only when you connect them, and they handle it under their own terms. For Telegram reminders, the reminder text goes to Telegram’s servers; it contains the time of a session, never its content.
Authorities
We disclose data only when the law requires it, and only as much as it requires.
9. Transfers outside the EU
We store data in the EU. Where a provider listed above may access data from outside the European Economic Area (Stripe, Twilio, Sentry), the transfer relies on the European Commission’s Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework. Telegram is used only if you choose it.
10. How long we keep data
| Data | How long |
|---|---|
| Account, profile, bookings, messages, notes, diary | While the account exists; deleted within 30 days after the account is deleted. You can delete the diary, notes and individual messages yourself at any time. |
| Messages sent through a psychologist’s contact form | 12 months; the sender’s IP address and browser details 30 days |
| Calendar busy times (Google, Microsoft) | Rolling window; deleted 7 days after they end, and immediately on disconnect |
| Calendar tokens | Until you disconnect or revoke access |
| Video connection metadata | 12 months |
| Sign-in sessions | Up to 30 days of inactivity, never more than 90 days |
| Failed sign-in attempts | 24 hours |
| Stripe service events | 90 days |
| Invoices and accounting records | As long as Portuguese tax law requires (currently up to 10 years) |
| Backups | Overwritten on a rolling schedule; deleted data disappears from them when the cycle completes |
11. Security and encryption
- All connections use HTTPS. Passwords are stored only as hashes.
- Messages, booking comments, session notes, diary entries, reminder contacts and calendar tokens are encrypted in the database with AES-256-GCM, under keys that belong to each person. Those keys are themselves encrypted by a master key held in a separate key-management system and never stored with the data or its backups.
- Personal vault. Psychologists can keep session notes in a vault that is encrypted in their own browser with a password only they know. We store only ciphertext and cannot read, search or recover those notes — not even on request.
- Session notes require two-factor authentication. Database access is limited per user at the database level, and every access by staff to private files or reports is logged.
- If a personal data breach occurs, we notify the supervisory authority within 72 hours and tell affected people without undue delay when there is a high risk to them (Articles 33–34 GDPR).
12. Cookies
This website sets no cookies at all. The Arvorina app uses only strictly necessary cookies: to keep you signed in, to protect forms against cross-site request forgery, and to remember a choice you made (for example, that you have already marked a post as useful). There are no analytics or advertising cookies, so we don’t ask for cookie consent.
13. Your rights
Under the GDPR you have the right to:
- access your data and get a copy (Art. 15);
- have inaccurate data corrected (Art. 16) — most of it you can edit yourself;
- have your data erased (Art. 17);
- restrict processing (Art. 18);
- receive your data in a machine-readable format (Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw consent at any time, without affecting processing that happened before (Art. 7(3)).
Write to privacy@arvorina.com from the address linked to your account. We reply within one month; if a request is complex we may extend this by two more months and will tell you why. For records a psychologist keeps about you, we will pass your request to the psychologist and help them answer it.
You can also complain to a data protection authority — in Portugal, the Comissão Nacional de Proteção de Dados (CNPD), or the authority in the EU country where you live or work.
14. Children
Arvorina is for adults. You must be at least 18 to create an account. If you believe a child has given us personal data, write to us and we will delete it.
15. Changes to this policy
Each version has a date and a version number. If we make a significant change, we will tell account holders by e-mail before it takes effect. Earlier versions are available on request.
16. Contact
Vitaliy Petroff, Arvorina — privacy@arvorina.com for anything about your data, info@arvorina.com for everything else. Postal address: see the legal notice.