Privacy policy

This privacy policy applies to the processing of personal data, including health data, by:

Path Within Therapy — Dimitar (Mitko) Lambov

Smaragdstraat 69, 1074 HE Amsterdam. KvK: 97269239. Email: hello@pathwithintherapy.com. Website: www.pathwithintherapy.com

Path Within Therapy is the data controller for this processing under the General Data Protection Regulation (GDPR), and is a registered healthcare provider under the Dutch Quality, Complaints and Disputes in Healthcare Act (Wkkgz).

For any question about how your data is handled, or to exercise any of the rights described in Section 12, email hello@pathwithintherapy.com.

Depending on your contact with the practice, the following may be processed:

• Identification and contact data: name, address, telephone number, email address
• Administrative and financial data: invoicing history, payment details, bank account number
• Health data: intake information, session notes, clinical observations and formulations, treatment goals, and progress
• Communication data: emails, messages, and details provided when booking or completing an intake

Information about your mental health is a special category of personal data under the GDPR and receives additional protection. So does the simple fact that you are a client of this practice — which is why that fact, too, is treated as confidential.

In relationship therapy, data is processed about each partner. Where information concerns both of you, requests to access or delete it are handled with care for the privacy of the other person, and it may not be possible to disclose everything one partner asks for.

Your data is processed in order to:

• Enter into and carry out a treatment agreement with you
• Keep clinical records, as required of a healthcare provider
• Communicate with you about appointments, treatment, and billing
• Maintain the practice’s financial administration and meet its tax obligations
• Maintain and improve the quality of the care provided (see Section 7)
• Operate the website and respond to enquiries

The legal bases relied on are:

• Article 6(1)(b) GDPR — processing necessary to perform the agreement with you
• Article 6(1)(c) GDPR — processing necessary to comply with legal obligations, in particular tax and healthcare record-keeping
• Article 9(2)(h) GDPR, as implemented in Article 30 of the Dutch GDPR Implementation Act (UAVG) — processing of health data for the provision of healthcare and the management of healthcare services, by or under the responsibility of a person bound to confidentiality
• Article 6(1)(a) and Article 9(2)(a) GDPR — your explicit consent, where it is relied on, for example to share information with your GP or to record a session

Where consent is the basis, you may withdraw it at any time. Withdrawal does not affect anything done before you withdrew it.

Everything you disclose in therapy is confidential. This duty arises from the treatment agreement with you, from Path Within Therapy’s obligations as a healthcare provider, and from the GDPR.

Confidentiality covers more than session notes. It also covers administrative and financial information about you, and the fact that you are a client of this practice at all. If someone contacts the practice asking whether you are a client, this will be neither confirmed nor denied.

The duty of confidentiality does not end when your therapy does. It continues indefinitely.

Path Within Therapy works in accordance with the professional code of the Dutch Association of Psychologists (Beroepscode NIP 2024) as a matter of practice.

Your therapist is the only person with access to your clinical records.

A small number of service providers process limited categories of your data on behalf of the practice. Each works under a written data processing agreement, may act only on the practice’s instructions, may not use your data for its own purposes, and is bound in writing to confidentiality:

If a third party approaches any of them for information about you, they must refuse to confirm or deny anything and refer the request to the practice.

Client’s name, address, and invoice details are seen by the practice’s bookkeeper, who prepares the financial administration and tax filings that the practice is legally required to keep. The bookkeeper has no access to your clinical records, session notes, or appointment history, and is bound in writing to confidentiality on the same terms that apply to your therapist.

Beyond these arrangements, your information is shared only:

• With your explicit, specific, written consent — for example with your GP, another healthcare provider, or an insurer. You will be told what information is involved and who will receive it before you decide, and you may withdraw consent at any time.
• Where the law requires disclosure, or where there is a serious risk of harm to you or to someone else. In that situation you will be told beforehand who is receiving information and what it concerns. If that is not possible, you will be told as soon as possible afterwards.

Your data is never sold, shared for advertising, or transferred to anyone not listed above.

Client records

Path Within Therapy uses Zanda (www.zandahealth.com) for electronic health records, scheduling, and secure client messaging, under a data processing agreement made in accordance with Article 28 GDPR.

Zanda provides:

• Encryption of your data in transit and at rest
• A secured client portal for intake, booking, and messaging
• Individual user authentication and access controls
• Automatic logging of access to client records, providing an audit trail

Client data processed through Zanda is stored in AWS data centres in the United Kingdom.

Because the United Kingdom is outside the European Economic Area, this is an international transfer under the GDPR. It is permitted because the European Commission has decided that the UK provides an adequate level of data protection. That decision was renewed on 19 December 2025 and runs until 27 December 2031, so no additional safeguards are required for the transfer.

Zanda’s own GDPR statement is available at https://zandahealth.com/general-data-protection-regulation-gdpr/

The Dutch information security standards for healthcare (NEN 7510 and NEN 7513) are taken into account in the selection and configuration of the systems used.

Online sessions

Online sessions take place via Zoom.

Zoom does not have access to your clinical records. It does, however, process technical information necessary to run the session: your IP address, device and connection information, the time and duration of the session, and the name you join under. Because sessions are hosted by this practice, the fact that you joined one is itself information Zoom holds.

Zoom acts as a processor under a data processing agreement, and may use this information only to provide the service.

Zoom is a US company, so this involves an international transfer. It is permitted because Zoom participates in the EU-US Data Privacy Framework, and its data processing agreement additionally incorporates the European Commission’s standard contractual clauses as a further safeguard.

If you would prefer not to use Zoom, say so and an alternative will be arranged, whether that is a session in person or by telephone.

To maintain the quality of care, cases are discussed in supervision, intervision, and peer consultation. This is normal professional practice and forms part of providing good care.

Wherever possible this is done without using information that identifies you. Where identifying information is necessary, everyone involved is bound by confidentiality.

You may object to your information being used in this way. If you would prefer that your case is not discussed, say so and this will be respected.

Audio or video recordings of sessions are made only with your explicit prior consent.

Before you decide, you will be told why the recording is being made, who will see or hear it, and how long it will be kept. Your consent is noted in your file, and you may withdraw it at any time.

Recordings made for the purposes of your care form part of your clinical file. Recordings made for training, supervision, or professional certification are stored separately, used only for that purpose, and destroyed once no longer needed.

You do not need permission to record your own session, but please give notice beforehand. Recordings you make are for your personal use only.

Email, text messages, and WhatsApp are not fully secure. Messages sent through them can be intercepted, and can be seen by anyone with access to your device or account. For anything sensitive, please use the secure client portal.

Please note that messages cannot be monitored outside working hours. Email and messaging should never be used in an emergency. If you are in crisis, contact your GP, the out-of-hours GP service (huisartsenpost), or the emergency services on 112.

Clinical records are kept for 20 years from the date information was last added to your file — in practice, from the end of your therapy. This is the standard the WGBO sets for healthcare records, and Path Within Therapy applies it to ensure continuity of care and to meet its responsibilities as a healthcare provider.

For clients who were under 18 during treatment, the period may begin from their eighteenth birthday.

Financial and invoicing records are kept for 7 years, as Dutch tax law requires. This is a separate obligation and runs independently of the period above.

After the applicable period, records are securely destroyed or anonymised.

Asking for your records to be deleted. You may request deletion of your file, in writing or by email. Such requests are normally granted. They may be refused where the law requires the records to be kept, or where they are needed in connection with a complaint or legal claim. Any refusal will be explained, together with information about complaining to the Dutch Data Protection Authority.

If the practice closes. If Path Within Therapy ceases to operate, arrangements will be made for your records to be transferred to another care provider or securely retained for the remainder of the retention period, and you will be informed of those arrangements.

Your data is protected using appropriate technical and organisational measures, including:

• Encrypted storage through the electronic record system
• Individual accounts with multi-factor authentication
• Encrypted devices, kept up to date, with automatic screen locking
• Access logging for client records
• Secure disposal of any paper records
• Written data processing agreements with every service provider that handles your data

If a data breach occurs that is likely to result in a high risk to your rights and freedoms, you will be informed without undue delay, and the Dutch Data Protection Authority will be notified where required.

You have the right to:

• Access your personal data and receive a copy (Article 15 GDPR). The first copy is free; a reasonable fee may apply to further copies.
• Rectification of inaccurate data (Article 16)
• Erasure of your data (Article 17), subject to Section 10
• Restriction of processing (Article 18)
• Data portability (Article 20). This applies to information you have actively provided. It does not extend to clinical observations, formulations, or treatment notes — though you may ask for your records to be transferred to another care provider.
• Object to processing (Article 21)
• Withdraw consent at any time, where consent is the basis

Requests are answered within one month. If a request is complex this may take up to two months, and you will be told within the first month if that is the case. Any refusal will be explained, together with information about how to complain.

To exercise any of these rights, email hello@pathwithintherapy.com.

If you are unhappy with how your data has been handled, please raise it with the practice first — it is better to hear about it and put it right.

You can also:

• Complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl — for complaints about how your data has been handled.
• Use the healthcare complaints procedure — for complaints about your care. As a registered healthcare provider under the Wkkgz, Path Within Therapy is affiliated with Zorg voor ZZP, which provides an independent complaints officer and access to a recognised disputes body. The complaints officer is free of charge and can advise you, support you in formulating a complaint, and mediate. If a complaint cannot be resolved that way, it can be brought before the disputes body, whose decision is binding. Full details of the procedure: https://zorgvoorzzp.nl/klachtenprocedure/

The website uses functional cookies, which are necessary for it to work.

The website also uses Google Analytics to understand how the site is used. Analytics cookies are placed only if you consent, and you can withdraw or change your choice at any time via cookie settings.

No personal data is collected through cookies without your consent. Your data is not used for advertising and is never sold.

No automated decision-making or profiling is used. Decisions about your care are always made by your therapist.

This policy may be updated to reflect changes in the law or in how the practice works. The current version is always available at www.pathwithintherapy.com/privacy, with the date it was last updated shown at the top.

If a significant change is made affecting how your data is used, you will be told directly.

Questions? Email hello@pathwithintherapy.com