Privacy Notice

This notice explains what you share when you fill in the intake form, why it is asked for, where it goes, and how long it stays. This is not an ordinary contact form. It asks about the most private parts of your life, and you have a right to know what you are entrusting them to. Please read it before you fill out the form.

1. Who the data controller is

The controller is Onour Impram, acting in his individual capacity. He provides the clinical service and operates this website in his own name. This website is not operated by or on behalf of a company.

For any question, request, or complaint about this notice, write directly to [email protected].

2. What is collected

The intake form collects four kinds of information.

Identity and contact details. Your name, age, gender, marital status, email address, phone number, where you live, and anything else that identifies you and lets me reach you.

The context of your request. Why you are getting in touch, where you are in your life right now, your work and study situation, your close relationships, and whether you have had counseling or therapy before.

Health information. Your mental and physical health history, medication, diagnoses, and any history of harming oneself or attempting suicide attempts.

Your spiritual orientation. One question asks you to say a little about your spiritual practice, if you have one. I ask it clinically, because the place where a person makes meaning is often the place that holds them when things get hard. I am not assessing what you believe, only trying to understand what helps you.

Those last two groups are what data protection law treats as a special category. Health data and data revealing religious or philosophical beliefs carry the same stronger protection. The form has a separate consent box for health information.

The spiritual orientation question is required on the current form, and it has no separate consent box. Consent covering health information does not replace separate consent for processing data revealing religious or philosophical beliefs. This leaves an unresolved consent gap in the current form. This notice does not make the field optional or close that gap.

What you tell me about others. The form asks about your family: who they are, and whether there is chronic illness in the family. Those answers carry information about other people. I hold them only as your account of them, as part of the clinical picture. I do not contact the people you mention, I do not open a separate record about them, and I do not use this information anywhere outside your own file.

3. Why I ask for it

I process this information for five purposes. To assess the context of the request and whether psychological counseling may be appropriate. To prepare without asking you to repeat the same information from scratch in the first session. To refer you elsewhere if another service would be more appropriate. To act on your safety if I see an immediate and serious risk to life. To handle scheduling and correspondence.

This data is never used for marketing, never added to any list, never sold, never turned into research or teaching material, and never used as training data for AI tools.

4. Legal basis

Explicit consent is the basis for processing identity, contact and intake context information. The form has a separate consent for health data. Spiritual orientation is also special category data, but the current form has no separate consent specific to that field. I therefore do not claim that the form obtains separate consent for every type of special category data. Completing the form requires both consent covering health data and an answer to the required spiritual orientation field. Disclosing that requirement here does not resolve the consent gap.

One thing I should be honest about. Consent really is a precondition of the form. If you decline, the form is not completed and I cannot assess whether the request may be appropriate. No separate record is created because of that choice, you are not flagged, and applying again later does not become harder.

You can withdraw consent at any time without giving a reason. Write to the address above. Withdrawal does not make earlier processing unlawful. I stop new processing based on consent within the applicable technical and legal limits. Withdrawal does not automatically erase records already created or records that must be retained on another basis. I assess any deletion request under the scope described in section 6.

5. Who sees it, and where it goes

Only I see your responses. There is no secretary, no assistant, no team, no third person.

The form runs on Google Forms. Google therefore receives, processes and stores the responses on its infrastructure. Whether Google acts only as a data processor depends on the account type and the applicable agreement. A Google Workspace agreement or data processing addendum covering this form has not been documented here. I therefore do not describe Google as a data processor without qualification. Google is an external service used under its applicable terms and privacy rules.

Replies are handled over email. The address you see belongs to my own domain. Incoming messages pass through Cloudflare's email routing service and land in a Google Gmail mailbox. Outgoing replies are delivered through Brevo. These are external services. The data protection role of each service depends on the service used and the agreement that applies to it. I therefore do not describe all three without qualification as processors acting on my behalf.

Depending on what you prefer, I may also reply over WhatsApp or by phone. If you choose WhatsApp, the content of your messages is encrypted so that only you and the recipient can read it while it is in transit. WhatsApp cannot read the content. The messages do, however, remain on both phones afterwards, and the security of a device or its cloud backup is a separate question. Your phone number and the record of who messaged whom and when also reach Meta Platforms, which owns WhatsApp. If you would rather avoid that, we can keep everything to email. One sentence from you is enough.

Some data may be processed outside Türkiye or the European Economic Area because Google, Cloudflare, Brevo and Meta operate international infrastructure. No adequacy decision, standard contractual clause or other appropriate safeguard for these regular transfers has been documented in this notice. The consent recorded on the form does not by itself prove that such a mechanism is in place. I therefore do not present the transfer arrangement as a completed compliance safeguard.

I cannot see or choose which country's data center Google uses for your responses. If you need a guarantee about a particular country or transfer mechanism, write to me before completing the form. You should decide with the current limitation in view.

6. How long it is kept

If counseling begins: your intake form responses become part of your clinical file, together with the handwritten notes I take during sessions. Clinical files are kept for as long as professional ethics and the law I work under require.

If counseling does not begin: there is no implemented automatic deletion schedule for form responses. A finite retention period has not yet been set. Records may therefore remain until a deletion request is carried out or a verified deletion schedule is established. This is an existing compliance gap.

If you request deletion or withdraw consent: I assess the request across form responses, Gmail correspondence, Brevo delivery records and any WhatsApp or phone surface used. Deletion may not occur at the same time in every system. Provider limitations and records that must be kept for legal or professional reasons may affect the scope. I respond within one month and explain what was deleted and what remains, with the reason.

7. The limits of confidentiality

Everything you share is held in confidence, within professional ethics and the law. That sentence has two separate limits, and they should not be mistaken for one another.

The first is my judgment.If I see an immediate and serious risk to life, your own or someone else's, safety comes first and I take the minimum necessary step. I am writing it here so that it is never a surprise.

The second is not left to my judgment. If a court or a competent authority acting under law requests information, or if the law requires a report, professional ethics alone cannot answer that request. Its exact scope depends on the law of the country you are in, and I cannot give an exhaustive list in this notice. Saying that I cannot is more honest than pretending I can. If counseling has begun, I may also be required to retain part of the clinical file. That is the situation described in section 6.

Two things hold at both limits: what is shared stays limited to the minimum necessary, and I tell you first in every case where I am not legally prevented from doing so.

This site and this form are not an emergency service. If you do not feel safe, contact the emergency services where you are.

8. Your rights

You have the right to know whether your data is being processed, to receive a copy of it, to have it corrected if it is wrong or incomplete, to request erasure under the applicable conditions, to have processing restricted, to receive your data in a portable form, to object to processing, and to withdraw consent you have given. There is one route for all of them: write to the address above. I will respond within one month at the latest. Where to complain is set out in section 13.

This list has a limit, and I would rather not hide it from you: which data protection regime applies to you depends on where you are, and the regimes do not define these rights identically. Some are drawn wider in one regime and narrower in another. So I would rather you read the list above not as "the law grants you these" but as my undertaking: whichever regime applies, I act on this list rather than on the narrower one. The month, likewise, is not the maximum some statute allows me. It is the ceiling I set for myself.

9. Cookies and measurement

This site uses no cookies for advertising or tracking across sites. Its only site cookie is functional. NEXT_LOCALE records the language you chose and is not used for advertising. Cloudflare Web Analytics does run a JavaScript beacon supplied by another organization. The beacon is not used for advertising or tracking across sites.

I do keep visit statistics. On each page view, the Cloudflare beacon sends the page path, referring host, approximate country, device type, browser, operating system and page performance measurements. It does not use cookies or local storage. Cloudflare states that it keeps raw, unsampled beacon data for 7 days, then aggregates it to about 10 percent of the original volume for storage over the long term. I use these measurements to see which pages are read and where performance needs attention.

The intake page is included in this count too, and I would rather not hide that. The count is at page level: I see how many times that page was opened, not who opened it. Nothing you write into the form enters this measurement. The form is a separate frame and what you put in it stays on Google's side. The count here only counts the page itself and cannot see inside the form.

Beyond that, the one exception is the Google Forms frame embedded on the intake page. What happens inside that frame is governed by Google's own rules, and its own cookies may be used there. A browser may load this frame as the page opens, before you scroll to the form. In that case, a request reaches Google. Everywhere else on this site, no cookie is set on your device other than the language cookie above.

There is one more record that is not a cookie, and I want to count it too. When you switch language, a small key is written to your browser session storage so the page can remember where you were. That record is never sent to a server, is not tied to your identity, and is deleted when you close the tab.

10. Security

The record surfaces that may hold information about you are the intake form responses, my handwritten clinical notes, incoming Gmail correspondence, Brevo delivery records and metadata for outgoing messages, and any WhatsApp or phone communication records and metadata where those channels are used. I use no separate clinical database or client management system. The handwritten notes are not stored on a system connected to the internet. Other records may be processed on the relevant external infrastructure. I control access to my accounts, but no system is completely secure.

11. Age

The psychological counseling service and intake form are for adults aged 18 or older. If you are under 18, do not complete this form or apply for psychological counseling through this site. Please contact an appropriate mental health service that works with children and adolescents.

12. Automated decisions and profiling

No automated decisions are made about you and no profiling is carried out. A human being, meaning me, reads your form. There is no AI system on this site that talks to you, processes your data, or generates replies to you. If that ever changes, this notice changes first.

13. Where you can complain

If you are not satisfied with my response, you may complain to the data protection authority in your country. In Türkiye that is the Personal Data Protection Authority (KVKK Kurumu). In the European Union, it is the supervisory authority of your own country.

This notice is written in GDPR form and is intended to meet the disclosure duty under KVKK as well if you are in Türkiye. I am not claiming that the list in section 8 reproduces any one statute article by article. The regimes do not draw the same boundaries, and deciding which right belongs to which regime is a lawyer's call, not mine. What I can commit to is simpler: where more than one regime could apply, I follow whichever gives you more protection, and in every case I act on the list in section 8.

Let me say this plainly: this notice has not been reviewed by a lawyer. I have tried to describe my actual practice as honestly as I can, but whether a document meets the law is not something its own author can certify. If you find something missing or wrong, write to me. I will correct it, and I will tell you what I changed.

14. Updates

This notice is updated as practice changes. You are reading version 4.0. I put a version number on it so that which text you consented to does not become a guess later. A substantive change increases this number. Last updated: 14 August 2026.