Privacy Policy

Introduction

This privacy policy describes how Prof. Dr. Igor Krnetić (hereinafter: "we", "us" or "our") collects, uses and protects your personal data when you use our website krnetic-demo.jjovan.com and related services.

Data We Collect

• Name, email address and phone number — when scheduling appointments or sending messages through the contact form
• Session data — dates, notes and therapy progress (for registered portal clients)
• Technical data — IP address, browser type and site usage data (cookies)

How We Use Your Data

• To provide psychotherapy services and communicate with clients
• To schedule and manage appointments
• To improve our website and user experience
• To fulfill legal obligations

Data Protection

Your data is protected by 256-bit SSL encryption in transit and AES-256-GCM encryption at rest (email and phone number). Only authorized personnel have access to personal data. We do not share your data with third parties for marketing purposes.

Technical Service Providers (Sub-processors)

To operate the website we rely on the following vetted service providers, which process a limited subset of data solely to deliver the technical infrastructure:

• Neon (Postgres database) — EU region
• Vercel (hosting + CDN) — global edge network
• Resend (email delivery)
• Twilio (SMS delivery and OTP codes)
• Upstash (Redis cache for rate-limiting and sessions)
• Sentry (application error tracking)
• Cloudflare Turnstile (bot abuse protection on forms)
• Telegram (operational notifications to the operator)

Confidentiality of Therapeutic Relationship

All information you share during therapy sessions is strictly confidential, in accordance with professional ethical codes and legal regulations. Confidentiality may only be breached in exceptional circumstances prescribed by law.

Special Category Data (GDPR Article 9)

The mental-health data we process — reason for seeking therapy, anamnesis, diagnoses and ICD codes, treatment plan, session notes, risk assessment and safety plan — constitutes a special (sensitive) category of personal data under Article 9 of the General Data Protection Regulation (GDPR). The lawful basis for processing this data is your explicit consent, given when you book your first appointment, register on the portal, or complete the clinical intake questionnaire. Without that consent, we cannot provide therapy services.

Withdrawing Consent

• You may withdraw consent at any time — without giving a reason and without any fee.
• Withdrawal is done via the portal (Settings → Privacy) or by emailing krnetic@blic.net.
• Withdrawing consent means therapy services will stop from the moment we receive your request.
• Existing clinical records are deleted in line with our data protection policy, except for those we are legally required to retain (e.g. invoices and accounting records — 10 years under Bosnia and Herzegovina law).
• Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Email Communication — Transactional and Marketing

• Transactional emails (appointment confirmations, pre-session reminders, invoices, security notices) — lawful basis: performance of contract. While you are an active client, you cannot opt out of these messages because they are necessary to deliver the service.
• Marketing and educational emails (newsletter, workshop announcements, educational content) — lawful basis: your explicit consent. You can withdraw consent at any time via the unsubscribe link in the footer of every such message, or in writing at krnetic@blic.net.

Your Rights (GDPR)

• Right of access — you can request access to your personal data
• Right to rectification — you can request correction of inaccurate data
• Right to erasure — you can request deletion of your data
• Right to portability — you can request a copy of your data in a standard format
• Right to withdraw consent — you can withdraw consent for data processing at any time

Cookies

We use functional cookies that are necessary for the website to function (e.g., language selection). We do not use tracking or marketing cookies without your explicit consent.

Contact

For all questions regarding data protection, contact us at krnetic@blic.net or by phone at +387 65 560 512.