Dr. Ali Fenwick, Ph.D. Psychotherapy1. Who is responsible for your data?
Dr Fenwick Lab for Human Behavior & Technology, Unipessoal Lda. ("Dr. Fenwick Lab", "we", "us" or "our") is the controller of personal data processed through this website.
- NIF/VAT: PT518224910
- Registered office: Rua Castilho 14C, 1250-069 Lisbon, Portugal
- Privacy contact: support@redflagsgreenflags.com
This policy concerns the public website and initial online interactions. If you become a therapy, counselling, coaching, training or corporate client, additional privacy information and contractual or clinical documentation may apply.
2. Personal data we process and why
| Activity and data | Purpose | GDPR basis |
|---|---|---|
| Enquiries: name, email, country, service interest and message | Responding to you, assessing service suitability and taking requested pre-contractual steps | Article 6(1)(b); legitimate interests under Article 6(1)(f) for general business enquiries |
| Health or other sensitive information you voluntarily include | Understanding and responding safely to your request | Your explicit consent under Articles 6(1)(a) and 9(2)(a). Please provide only what is necessary at enquiry stage |
| Bookings and transactions: contact, appointment, billing and payment-status information | Scheduling, delivering and administering requested services, accounting and legal compliance | Articles 6(1)(b) and 6(1)(c) |
| AI assistant: text or voice input, transcript, conversation metadata and feedback you choose to provide | Providing the interactive assistant, answering service questions and improving safety and quality | Consent under Article 6(1)(a); Article 9(2)(a) if you choose to disclose special-category data |
| Technical data: IP address, device/browser data, timestamps, requested pages, security and server logs | Operating, securing and diagnosing the website; preventing abuse | Legitimate interests under Article 6(1)(f) |
| Assessment answers | Displaying general guidance about potentially relevant services | Your request under Article 6(1)(b). Answers are processed in your browser and are not submitted to us unless you separately choose to share them |
We do not use website data for solely automated decisions that produce legal or similarly significant effects. The assessment and AI assistant provide general guidance only; they do not diagnose, determine eligibility for care or replace professional judgement.
3. Special-category and clinical information
Information about physical or mental health is specially protected under the GDPR. Please avoid sending detailed clinical histories through the general enquiry form or AI assistant. Where you deliberately provide health information at enquiry stage, we rely on your explicit consent to review it for the limited purpose of responding. You may withdraw that consent, although this does not affect processing already carried out lawfully.
Clinical records created after a professional relationship begins are handled separately under applicable professional, confidentiality and record-keeping obligations. Website providers are not intended to serve as clinical-record systems.
4. Recipients and service providers
Access is limited to authorised personnel and providers that need data to perform their role. Depending on the feature you use, recipients may include:
- Formspree, which transmits website enquiries;
- Cal.com, which provides scheduling and booking functions;
- ElevenLabs, which provides the conversational AI and voice interface;
- Vercel, which hosts and secures the website;
- Google Fonts, which supplies web fonts and may receive technical request data;
- professional advisers, payment/accounting providers, regulators, courts or authorities where necessary or legally required.
Third-party booking, payment or community services may also act as independent controllers for their own purposes. Their privacy notices apply when you use their platforms.
5. International transfers
Some providers may process data outside Portugal or the European Economic Area. Where a destination is not covered by an adequacy decision, we use or require an appropriate GDPR transfer mechanism, such as the European Commission's Standard Contractual Clauses, together with supplementary safeguards where required. You may contact us for information about the relevant safeguard.
6. How long we keep data
- General enquiries that do not become a client relationship: normally up to 12 months after the last meaningful contact.
- Booking and service-administration data: for the duration of the relationship and thereafter for applicable limitation, tax, accounting and legal periods.
- Consent records: for as long as needed to demonstrate compliance and address legal claims.
- Technical/security logs: only for the period reasonably needed for security, troubleshooting and provider operations.
- Clinical records: according to the separate clinical notice and applicable professional and legal retention rules.
Data may be retained longer where required by law, needed for legal claims or subject to a preservation obligation. It is then deleted or irreversibly anonymised when no longer required.
7. Cookies and similar technologies
The website and its providers may use local storage, cookies or comparable technologies for security, functionality and embedded services. Strictly necessary technologies may operate without consent. Analytics, advertising or other non-essential technologies will be used only where a valid legal basis and, where required, your prior consent exist. You can withdraw consent through the website's cookie controls when presented and through your browser settings.
Loading or using third-party features such as Cal.com or the ElevenLabs assistant may cause that provider to receive device, network and interaction data under its own notice. You can choose not to use those features and contact us by email instead.
8. Your rights
Subject to the GDPR and any applicable limitations, you may request access, rectification, erasure, restriction, portability or objection; withdraw consent at any time; and ask not to be subject to qualifying solely automated decisions. To exercise a right, email support@redflagsgreenflags.com. We may need to verify your identity and normally respond within one month.
You may also complain to the Portuguese supervisory authority: Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal. We would appreciate the opportunity to address your concern first.
9. Security and confidentiality
We apply proportionate organisational and technical safeguards designed to protect personal data, including access controls, provider due diligence, secure transmission and confidentiality obligations. No internet service is completely secure, so please use the enquiry form and AI assistant only for information appropriate to those channels.
10. Children
This website is directed to adults and is not designed to collect personal data directly from children. A parent, guardian or authorised professional should contact us before submitting information concerning a minor.
11. Changes to this policy
We may update this policy when our services, providers or legal obligations change. The current version and effective date will always appear on this page. Material changes will be highlighted where appropriate.
12. Contact
Privacy questions and rights requests should be sent to support@redflagsgreenflags.com or by post to Dr Fenwick Lab for Human Behavior & Technology, Unipessoal Lda., Rua Castilho 14C, 1250-069 Lisbon, Portugal.