Privacy Policy

BELASAI S.L. (NIF B24825820), with registered office at Av. de las Universidades 24, 48007 Bilbao (Bizkaia), Spain, is the controller responsible for the processing of the personal data described in this policy.

Contact for data protection matters: ju@belasai.es. BELASAI is in the process of appointing a Data Protection Officer (DPO); once the appointment is formalised, the DPO's contact details will be published on this page and notified to the Spanish Data Protection Agency (AEPD).

This policy explains how we process your data depending on your relationship with beLASAI:

• Platform users: employees of a client company who have been registered by their employer to use the Employee Assistance Programme (EAP).
• Collaborating professionals: psychologists, nutritionists and sports professionals who handle consultations through the platform.
• Visitors to the public website, people who write to us through the contact form or who request a demo.

• Identification and contact data: first name, surname, email address, telephone number, preferred language and the company you belong to. This data is provided by your company when it registers you, or by you when you edit your profile or choose a contact method.
• Health data (special category, Article 9 GDPR): the content of the consultations you open (title and description), your chat messages with the professional, the files you attach, the video call while it is taking place (it is not recorded) and your answers and results in the wellbeing questionnaires.
• Usage and security data: login date and time, IP address and actions taken on your data by third parties (professionals, supervision or administration), which are kept in an audit log.
• Contact form or demo request data: name, company, email, telephone number and the message you send us.

• To create and manage your account and allow you to use the platform: performance of the service contracted by your company and BELASAI's legitimate interest in providing it (Articles 6(1)(b) and 6(1)(f) GDPR).
• To handle your psychological, nutritional or sports support consultations, including chat, video calls and attachments, and to run the wellbeing questionnaires: your explicit consent (Article 9(2)(a) GDPR), which we request on your first login, and the provision of care by professionals bound by professional secrecy (Article 9(2)(h) GDPR and Seventeenth Additional Provision of the LOPDGDD, the Spanish Data Protection Act).
• To send you communications required by the service (welcome email, password reset, notifications of new messages or of a consultation being closed, questionnaire reminders): performance of the service (Article 6(1)(b)).
• To keep the platform secure and record who accesses your data: legal security obligation (Article 32 GDPR) and legitimate interest (Article 6(1)(f)).
• To prepare aggregated, anonymous reports for your company on use of the programme and the wellbeing of the workforce: legitimate interest of BELASAI and of your company (Article 6(1)(f)). These reports never include data that could identify you and are not produced for groups of fewer than 10 people.
• To reply to your contact message or demo request: your consent and pre-contractual measures (Articles 6(1)(a) and 6(1)(b)).

Your company has no access to your consultations, your conversations, your files or your individual questionnaires. It only receives aggregated, anonymous information.

Your health data is accessed only by: the professional handling your consultation; the person in charge of that professional area, for clinical supervision and quality purposes; and BELASAI's administration staff, exclusively for technical support or incident resolution. All of them are bound by a duty of secrecy and confidentiality, and every access by someone other than you is recorded in the audit log with the date, time and identity of the person accessing it.

Until a professional takes on your consultation, the professionals in that area can see it in order to decide who is the right person to assist you. Once one of them takes it on, the others can no longer see it.

Video calls take place on the 8x8 service (Jitsi as a Service) and are neither recorded nor transcribed.

You can withdraw your consent at any time by writing to ju@belasai.es. Withdrawal does not affect the lawfulness of processing carried out beforehand. If you withdraw it, we will anonymise your consultations, conversations, files and questionnaires and you will no longer be able to use the support services, although we will keep your account for the period stated in section 8 in case you decide to come back.

We do not sell or transfer your data. The following providers process it on behalf of BELASAI, as data processors and under a contract that binds them to confidentiality and security:

• Collaborating professionals (for example, the psychology team at Adeitu Psikologia): handling of the consultations assigned to them. Location: Spain.
• Amazon Web Services (AWS): servers, database, storage of attached files and backups. Backups are stored in Ireland (EU). The application servers are currently located in the United States and their migration to the European Union is planned (see section 7).
• Vercel Inc.: hosting of the web application. United States.
• Brevo (Sendinblue SAS): sending of service emails. France (EU).
• 8x8 Inc. (Jitsi as a Service): video calls. United States. It only receives an internal identifier and your first name; never your email address or surname.
• Microsoft Ireland Operations Ltd. (Microsoft Bookings): demo booking calendar on the public website. If you book a demo, your contact details are sent to Microsoft.
• GitHub Inc.: code hosting and deployment automation. It does not receive any personal data about users.

Some of the providers listed above are established in the United States (AWS, Vercel, 8x8) or may process data from outside the European Economic Area. These transfers are covered by the adequacy decision for the EU-US Data Privacy Framework, to which these providers are certified, and by the standard contractual clauses approved by the European Commission that are included in their data processing agreements.

BELASAI has planned the migration of its servers and database to an AWS region in the European Union. This policy will be updated once the migration is complete.

• Consultations, conversations and attached files: 24 months from the closure of the consultation. They are then anonymised: the content, messages and files are removed and only the date, the area and the professional are kept for statistical purposes.
• Wellbeing questionnaires: 24 months from completion. They are then deleted.
• Access audit log (including IP address): 24 months.
• Technical server logs: 30 days. They contain no health data or full email addresses.
• Backups: 90 days, encrypted, in the European Union.
• Your account: for as long as your company's relationship with BELASAI lasts, plus 12 months. It is then anonymised.
• Contact and demo data: 12 months from the last communication.
• If you exercise your right to erasure or withdraw your consent, anonymisation is immediate.

• Encrypted communications (TLS) and passwords stored using secure key derivation functions.
• Two-step verification, mandatory for professionals and administrators and available to all users.
• Role-based access control: each person only sees the cases that concern them.
• Audit log of every third-party access to your health data.
• Attached files can only be downloaded through authorised links that are valid for a few minutes.
• Daily encrypted backups and automated tests before every software update.
• No analytics or advertising tools inside the private platform.
• Security breach management procedure, with notification to the supervisory authority within 72 hours and to the affected individuals where there is a high risk.

You may at any time exercise your rights of access, rectification, erasure, restriction of processing, data portability and objection, and withdraw your consent, by writing to ju@belasai.es or by post to the address in section 1, stating your name and the right you wish to exercise. We may ask you to prove your identity. We will reply within one month at most.

You can request a copy of all your data (consultations, conversations, questionnaires and consents) in electronic format by writing to ju@belasai.es.

If you believe we have not handled your rights properly, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid).

The wellbeing questionnaires automatically calculate an indicative score and may suggest services available on the platform, for example requesting a psychology consultation. This score is not a clinical diagnosis, is not shared with your company, has no legal effects on you and can always be discussed with a professional. We do not build profiles for advertising purposes.

The platform is intended for adult employees. We do not knowingly process data relating to anyone under 18 years of age.

We only use cookies that are strictly necessary for the platform to work (session and language). We do not use analytics or advertising cookies. Full details are available in our Cookie Policy.

If we make substantial changes to this policy, we will notify you within the platform and, where the change affects the processing of your health data, we will ask for your consent again. The version in force is always the one published on this page.