Viimsi Teraapiakeskus
privacy notice

This is a translation of the Estonian original. In case of any discrepancy, the Estonian version prevails.

1. General provisions and definitions

1.1.This notice has been drawn up on the basis of Regulation (EU) 2016/679 of the European Parliament and of the Council and the Personal Data Protection Act of the Republic of Estonia. The document governs the principles and practice of personal data processing by Viimsi Teraapiakeskus OÜ.

1.2.The notice applies to all persons whose data Viimsi Teraapiakeskus processes in connection with the provision of services, including clients, parents, funders and cooperation partners.

1.3.Definitions:

• Controller is the person or organisation that determines the purposes and means of processing personal data. For the purposes of this notice the controller is Viimsi Teraapiakeskus OÜ; Viimsi Teraapiakeskus is the responsible data controller providing creative therapies, supervision and psychosocial services, and ensures compliance with applicable data protection requirements when processing personal data.
• Person is a natural person who can be identified directly or indirectly, for example by name, contact details or other characteristics.
• Client is a person receiving or seeking a service, including, in the case of a minor, their legal representative.
• Processor is a third party processing personal data on behalf of and under the instructions of Viimsi Teraapiakeskus (e.g. therapist, accountant, information system administrator).
• Funder is a public or private legal person that pays for the service on behalf of the client (e.g. local government, Health Insurance Fund, Social Insurance Board).
• Personal data is any information relating to an identified or identifiable natural person.
• Special categories of data are data whose processing is restricted, e.g. health data.

1.4.The notice applies both to adult and to minor clients. In the case of a minor, the contact details of the parent or guardian and, where necessary, their consents for the provision of the service are also processed.

1.5.Personal data is collected:

• from the client themselves or their legal representative (including through bookings);
• from the referring institution (e.g. school, local government, family doctor);
• from the information system of Viimsi Teraapiakeskus and from cooperation partners.

1.6.The data processed may include:

• name, contact details (email, telephone);
• date of birth or age;
• for a minor, the child's name, year of birth and the representative's relationship to the child;
• the time and place of the service and the status of the booking;
• health data, where necessary for providing the service (this is not asked when booking, but discussed at the session);
• information about sessions attended and how the service has progressed;
• billing-related data (invoice recipient's name, address, registry code, email);
• any link to project-based funding.

1.7.In connection with providing services, Viimsi Teraapiakeskus may share a limited amount of client data with funders (e.g. local government, Social Insurance Board) where this is necessary for reporting. The data shared may include the client's name, the fact of participation, and summarised information about the content and cost of the service (e.g. whether the client needs further therapy).

1.8.Retention periods for personal data:

• Accounting documents are retained for 7 years as required by law;
• Therapy materials created by the client are retained in accordance with the codes of ethics of the creative therapy and music therapy associations;
• On the website we use only strictly necessary cookies and local storage (language choice, logged-in user session) — we do not use tracking or advertising cookies and do not collect usage statistics;
• Where necessary, data is retained longer if justified (e.g. for resolving disputes or for supervisory purposes);
• Security camera data in shared spaces (e.g. the foyer, café, the front of the building) is the responsibility of the building manager Forus Spordikeskus and the security company Forus Securitas. Viimsi Teraapiakeskus neither records nor processes this data.

2. Collection of personal data and legal bases for processing

2.1.Personal data is collected from the client themselves, from a parent or guardian, through bookings, written applications, assessments, sessions and feedback, and also from cooperation partners (e.g. school, local government, support specialist, family doctor, unemployment insurance fund) where the service is referred or funded by them in part or in full.

2.2.Viimsi Teraapiakeskus processes personal data only to the extent necessary:

• to provide the service and perform contractual obligations;
• to improve the client experience and monitor quality;
• to fulfil obligations arising from law;
• for specific purposes on the basis of consent (e.g. direct marketing or a client survey).

2.4.The personal data processed may include:

• identification data (name, date of birth);
• contact details (telephone, email);
• location data (the place where the service is provided);
• health data and background information voluntarily shared by the client or parent during the session;
• the number, duration, general course of and attendance at sessions;
• questions, assessments and feedback submitted by the client;
• billing data (e.g. information about payment by a local government, the Social Insurance Board or an employer).

2.5.Viimsi Teraapiakeskus does not process special categories of personal data (e.g. beliefs, sexuality, trade union membership) without an explicit need and a legal basis.

2.6.The basis for processing personal data may be:

• performance of a contract or steps taken prior to entering into a contract;
• an obligation arising from law (e.g. social welfare, accounting);
• legitimate interest (e.g. ensuring the functioning and security of the service);
• the person's voluntary and informed consent.

6. Rights of the person in relation to their data

6.1.The person has the following rights:

• to receive information about the data processed about them;
• to request correction, completion or erasure of their data;
• to withdraw consent previously given for the processing of personal data;
• to request restriction of the processing of personal data;
• to object to the processing of data where the basis is legitimate interest.

6.2.To exercise these rights, a digitally signed request should be sent by email to info@kunstidtervises.ee or in writing to the centre's address. Requests are answered within one month. If the request is complex, the response period may be extended by up to two further months.

6.3.Viimsi Teraapiakeskus may refuse to comply with a request if it is unable to identify the person, if there is no legal basis for erasing the data, or if the request is clearly unfounded or excessive.

6.4.For questions and enquiries, please contact:

The booking system and data collected on this website

Booking takes place in our own booking system on this website. Below you can see exactly what data we ask for when booking, why, where it is stored and who can see it.

When booking we collect:

• your name, email address and telephone number;
• for a minor, the child's name, year of birth and your relationship to the child;
• if you request an invoice, the invoice recipient's name, address and, for a company, the registry code (the invoice is always sent to the payer's own email);
• the booking itself: time, service, therapist, price, location and status;
• confirmation that you have accepted the collaboration terms (time and version of the terms).

The booking form does not ask for your reason for seeking therapy or any other health data — those topics are discussed only at the session, under professional confidentiality.

Why we need this data:

• to provide the service and hold the time in your name;
• to process the payment and the invoice and meet accounting requirements;
• to send you a confirmation, reminders and, if needed, a notice of a change or cancellation;
• so the therapist knows who is coming to the session.

Where the data is stored: bookings are saved in a secure cloud database (Lovable Cloud / Supabase) with servers located in the European Union. The connection is encrypted and database access is strictly limited.

Who can see the data:

• you — you can view, change and cancel your booking via the personal link in your confirmation email;
• your therapist — only clients related to their own sessions;
• the centre's administrator — bookings, payments and invoices, in order to run the centre;
• visitors who are not logged in cannot see any client data — only services, therapists and free time slots are public.

The management link in the confirmation email is personal and contains a random security code. Please do not forward it to anyone else — whoever holds the link can view and change the booking.

Third parties:

• the payment provider Montonio — the amount, reference number and description are transmitted to complete the payment; the bank returns the payer's name and payment method;
• an email delivery service — to send confirmations, reminders and invoices (recipient name and email address);
• where necessary, a funder (e.g. local government, Social Insurance Board) to the extent of reporting, as described in clause 1.7;
• we do not use tracking, analytics or advertising services and we never sell client data.

Retention and deletion: payment and invoicing data is kept for 7 years as required by accounting law; other booking data is not kept longer than necessary for providing the service and for supervision. You can always ask what data we hold about you and request its correction or deletion by writing to info@kunstidtervises.ee.

Cookies and local storage

On this website we use only strictly necessary storage: your language choice (Estonian or English) and the session of a logged-in user in the administration area. We do not use tracking, analytics or advertising cookies, and there are no third-party tracking scripts on the site. For this reason we do not ask for cookie consent.

When booking, the data needed to complete the payment is transmitted to the payment service provider, and confirmation and reminder messages are sent by email. This data is used solely to fulfil the booking.

Last updated: 25 August 2026