What I collect, and what I don't

This site sets no cookies and runs no analytics or advertising scripts. Fonts and images are served from the site itself, not from third parties, so browsing it doesn't report your visit to anyone.

The company hosting the site keeps standard server logs, which include IP addresses, for a short period and for security purposes. That is the only automatic record of your visit, and I don't use it to identify anyone.

If that changes, for instance if I start running advertising, this page will be updated and you will be asked for consent before any tracking runs.

Messages sent through WhatsApp pass through WhatsApp's own servers, which are operated by Meta. The contents are encrypted end to end, but Meta records that a message was sent and when. That is outside my control, and worth knowing before you write.

If you would rather not use WhatsApp, write to hello@merlo.care.

Whatever you send me, I keep only what's needed to reply and to arrange sessions. If we don't end up working together, I delete the exchange.

Once therapy begins, I keep clinical records, as the Brazilian Federal Council of Psychology requires of every registered psychologist. They exist so the work has continuity. They are held securely, with access restricted to me, and they are never sold, shared for marketing, or disclosed to anyone without your consent.

The one exception is the limit that applies to therapists everywhere: a serious and immediate risk to your life or someone else's, or a disclosure required by law or a court. Wherever it's possible, I would talk to you before acting.

Records are kept for a minimum of five years after the work ends, which is the retention period my professional council sets, and longer where the law requires it. After that they are securely destroyed.

I practise from Brazil, so anything you share with me is handled there rather than in the UK or the European Union. Brazil is not covered by a UK or EU adequacy decision.

Under UK and EU data protection law, transferring your information to me is permitted because it is necessary to provide the service you have asked me for, under a contract between the two of us. Brazil also has its own data protection law, the LGPD, which applies to me and which closely follows the same principles.

You can ask me what information I hold about you, ask for a copy of it, ask me to correct it, or ask me to delete it where I'm not required to keep it. Write to hello@merlo.care and I'll respond within a month.

Where I am required to keep clinical records for the retention period above, I can't delete them on request, and I'll tell you plainly when that's the case rather than leaving you guessing.