Privacy Policy
Last updated: October 2026
1. Controller Identity
IchangeWithin is operated by Irina Albulescu, PhD. I am committed to protecting your personal data in accordance with the European General Data Protection Regulation (GDPR / AVG) and Dutch healthcare privacy standards.
Practice Name: IchangeWithin
Owner: Irina Albulescu, PhD
Chamber of Commerce (KvK): 91457793
VAT Number (BTW-id): NL004897052B10
Business Location: Nieuwegein, Utrecht province, The Netherlands
Email: contact@ichangewithin.com
2. Personal Data Collected
I collect and process the following categories of personal data depending on your interaction with IchangeWithin:
- Contact & Profile Data: Full name, email address, phone number, and physical billing address.
- Billing & Payment Records: Invoices, payment statuses, and transaction reference details processed via accounting/payment tools.
- Health & Therapeutic Data (Special Category Data): Intake questionnaires, clinical session notes, goal assessments, and emotional history shared during hypnotherapy or 1:1 programmes.
- Personalised Audio Materials: Custom hypnotic audio recordings created specifically for your sessions.
- Emergency Contact Details: Name and phone number of a designated emergency contact, collected voluntarily for safety during 1:1 therapeutic work.
- Technical & Usage Data: IP address, device browser details, and contact form submission metadata.
3. Purposes & Legal Grounds for Processing
I process your personal data under the following GDPR Article 6 legal grounds and Article 9 exceptions for Special Category Data:
| Processing Purpose | GDPR Legal Basis (Art. 6) | Health Data Exception (Art. 9) |
|---|---|---|
| 1:1 Sessions & Custom Audio Delivery | Performance of a Contract (Art. 6(1)(b)) | Explicit Consent (Art. 9(2)(a)) & Healthcare Provision (Art. 9(2)(h)) |
| Responding to Inquiries & Clarity Calls | Pre-contractual Steps / Legitimate Interest (Art. 6(1)(f)) | N/A |
| Invoicing & Tax Administration | Legal Obligation (Art. 6(1)(c)) | N/A |
| Workshop Administration | Performance of a Contract (Art. 6(1)(b)) | N/A |
4. Third-Party Service Providers & International Transfers
Your data is processed using selected service providers necessary for administrative, scheduling, and security operations. All providers are bound by Data Processing Agreements (DPAs):
- Web Hosting: Strato (Servers located in the EU).
- Email, Calendar & Cloud Storage: Google Workspace & Google Drive (EU data storage / Standard Contractual Clauses).
- Appointment Scheduling: Calendly (Pre-session intake / Standard Contractual Clauses).
- Accounting & Financial Invoicing: e-Boekhouden.nl (EU-based).
- Payment Processing: Stripe (PCI-DSS compliant payment gateway).
- Encrypted Device Backup: Apple iCloud (Encrypted secure storage).
- Form Security: Google reCAPTCHA (Spam prevention on contact forms).
Where service providers transfer data outside the European Economic Area (EEA), safeguards such as EU Standard Contractual Clauses (SCCs) or EU-U.S. Data Privacy Framework certifications are implemented.
5. Data Retention Schedule
I do not retain data longer than necessary for the purpose for which it was collected. Specific retention periods apply:
- Therapeutic Records & Session Dossiers: Retained for 20 years in compliance with the Dutch Medical Treatment Contracts Act (WGBO) and CAT professional guidelines.
- Financial & Invoicing Records: Retained for 7 years to comply with Dutch Tax Authority (Belastingdienst) statutory obligations.
- General Inquiries & Unconverted Clarity Calls: Deleted after 1 year.
- Workshop Registration Data: Retained for 2 years following completion of the event.
- Personalised Audio Delivery Copies: Deleted 6 months after final delivery, unless requested otherwise by the client.
6. Your Rights & Complaints
Under the GDPR, you have the following rights regarding your personal data:
- Right to access, inspect, and receive a copy of your client dossier.
- Right to request rectification or erasure of inaccurate data (subject to statutory medical retention rules).
- Right to restriction of processing or data portability.
- Right to withdraw explicit consent at any time without affecting past lawful processing.
To exercise your rights, email contact@ichangewithin.com.
If you believe your personal data has been processed unlawfully, you have the legal right to lodge a complaint directly with the Dutch Data Protection Authority: Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). For clinical or therapeutic service disputes, refer to the GAT complaint procedure (gatgeschillen.nl).
7. Cookies & Security Technologies
This website uses essential functional cookies and Google reCAPTCHA to protect contact forms from automated spam. Functional cookies do not track personal activity across third-party websites and are placed based on legitimate technical interest.