Licensed psychotherapist · 10+ years · EMDR · Lifespan Integration · Certified HeartMath trainer · English, German, Hebrew · Online, worldwide
Licensed psychotherapist · 10+ years · EMDR · Lifespan Integration · Certified HeartMath trainer · English, German, Hebrew · Online, worldwide
Privacy
Written in plain English rather than boilerplate, because you should be able to read it and know where you stand.
Rotem Hess, MA, psychotherapist, operating as a sole proprietorship at Wickenburggasse 3/11, 1080 Vienna, Austria. I am the controller for all personal data described here, and there is no data protection officer — the practice is small enough that I handle this myself.
For anything to do with your data, write to contact@therapy-vienna.at.
The short version
The site is hosted by Hostinger. Like every web server, it records each request in a log file.
Your IP address, the page requested, date and time, the referring page, and your browser and operating system.
To deliver the site, keep it secure, and diagnose faults. These logs are not used to identify you and are not combined with anything else.
Server logs are kept for a short period by the host and then deleted or overwritten.
Legitimate interest in operating a functioning, secure website (Art. 6(1)(f) GDPR).
This site loads Google Analytics and a Google Ads tag, both provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics tells me which pages people read, how they arrived, and roughly where in the world they are — at country or city level, not street level. The Google Ads tag records whether a visit followed an advertisement and whether it led to a booking. Neither is connected to anything you tell me in therapy, and neither receives your name or email address.
Both services set identifiers in your browser and transmit data to Google, including to servers in the United States. Google acts as an independent controller for its own purposes; its practices are described in the Google Privacy Policy.
If you'd rather not be measured, you can install the Google Analytics opt-out browser add-on, use your browser's tracking protection, or block third-party storage for this site. None of that affects your ability to read the site or book a session.
The booking page embeds Calendly (Calendly LLC, Atlanta, USA). When you book, Calendly receives your name, email address, time zone and your answers to the intake questions, and passes them to me. Their handling is described in the Calendly privacy notice.
If you write or call, I keep the message and my reply for as long as the enquiry is live, and afterwards only if it has become part of a therapy record. Email is not an encrypted medium — please don't put anything in a first email you wouldn't want read in transit.
Sessions run on Zoom (Zoom Communications, Inc., San Jose, USA). Video sessions are encrypted — the conversation is protected in transit and cannot be read by anyone intercepting the connection. Zoom processes connection data and, in the ordinary course, meeting metadata. I do not record sessions. If a recording were ever useful, I would ask you first and you can say no without it affecting anything.
Notes, correspondence and administrative details are kept in my practice-management system, Freudio, under a data processing agreement. Access is mine alone.
What you say in therapy is health data, and it is treated as the most sensitive category there is. As a psychotherapist registered in Austria I am bound by professional confidentiality, which is stricter than data protection law and does not end when therapy does.
I process this data to provide the treatment you've asked for (Art. 6(1)(b) and Art. 9(2)(h) GDPR). I do not disclose it to family, employers, insurers or anyone else without your written consent — the rare exceptions are situations where disclosure is legally required of me.
HeartMath measurements, where we use them, are part of the clinical record and are handled the same way.
How long records are kept
These are the only third parties that touch your data, and each is used for one purpose:
| Hostinger | Website hosting and the contact@therapy-vienna.at mailbox |
| Calendly (USA) | Appointment booking |
| Zoom (USA) | Video sessions |
| Google Ireland | Analytics, advertising measurement, embedded map |
| Freudio | Clinical records and scheduling |
| Bank and tax advisor | Payment and statutory accounting |
Transfers outside the EU. Calendly, Zoom and Google involve processing in the United States. Those transfers rely on the EU–US Data Privacy Framework and on standard contractual clauses. Therapy content itself is not stored on any of them — Zoom carries the conversation, it does not keep it.
You can exercise any of these by emailing me. I'll respond within a month, and I won't ask why.
Ask what data I hold about you and get a copy of it.
Have anything inaccurate corrected.
Ask for deletion, or for processing to be paused. Statutory retention periods can limit what I'm able to delete, and I'll tell you plainly if that applies.
Receive your data in a portable format, or object to processing based on legitimate interest — including the analytics described above.
Complaints. If you think I've handled your data badly, tell me first — it's usually quicker. You also have the right to complain to the Austrian Data Protection Authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at.
If the tools I use change, this page changes with them. The version below is the current one.
Last updated: August 2026