Versión en español ← Back to home

Privacy Policy

Last updated: May 2026

This Privacy Policy describes how Francisco Javier Pérez Bouquet Lazcano (hereinafter "the Controller"), located in Guadalajara, Jalisco, Mexico, reachable at privacidad@sesiona.mx, collects, uses, and protects the personal data provided by users of the Sesiona platform (hereinafter "the Platform"), available at sesiona.mx.

This Policy is issued in compliance with Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) and its Regulations.

1. Personal Data We Collect

Depending on user type, we collect the following data:

Therapists:

• Full name and email address (via Google OAuth).
• Google Calendar information (events, availability).
• Client data voluntarily entered by the therapist: full name, email address, phone number, and — for minor clients — the name and contact information of the parent or legal guardian.
• Clinical notes, records, and session logs entered by the therapist.
• Schedule settings and account preferences.

Clients:

• Full name and email address (via Google OAuth).
• Emotional check-ins voluntarily completed by the client.
• Therapeutic tasks assigned by the therapist.
• Acceptance record of the therapist's privacy notice.

Institutional administrators:

• Full name and email address (via Google OAuth).
• Institution, course, and student information voluntarily entered.

2. Purposes of Data Processing

Primary purposes (required to provide the service):

• Authenticating user identity via Google OAuth.
• Managing the therapist's schedule and syncing events with Google Calendar.
• Storing and displaying clinical records and session notes.
• Facilitating communication between therapist and client within the Platform.
• Generating appointment reminder messages for manual delivery via WhatsApp, using the client's name and appointment details.
• Enabling institutions to coordinate therapists, courses, and students.
• Complying with Mexican Standard NOM-004-SSA3-2012 on clinical records.

Secondary purposes (users may opt out without affecting core service):

• Sending communications about improvements, new features, or platform updates.

3. Use of Google Calendar API

The Platform uses the Google Calendar API to read, create, modify, and delete events in the therapist's calendar, exclusively with their express consent through Google's OAuth 2.0 authorization flow.

Google Calendar access is used solely for:

• Displaying the therapist's weekly schedule within the Platform.
• Creating, rescheduling, or canceling client appointments.
• Checking availability to suggest session times.

Data obtained from Google Calendar is not shared with third parties, not used for advertising, and not transferred outside the described service context. The Controller complies with the Google API Services User Data Policy, including its Limited Use requirements.

Therapists may revoke Google Calendar access at any time from the "Agenda" section of the Platform or directly at myaccount.google.com/permissions.

4. Use of WhatsApp for Appointment Reminders

The Platform generates pre-written text messages containing appointment information (client name, date, and time) for the therapist to manually send to their clients via WhatsApp. The Platform does not send messages automatically and has no access to the therapist's or client's WhatsApp account; sending is always a voluntary, manual action by the therapist. WhatsApp is a service of Meta Platforms, Inc., subject to its own terms and privacy policy.

5. Data Transfers

Personal data is not sold, assigned, or transferred to third parties, except in the following cases necessary to operate the service:

• Google LLC — authentication (Firebase Authentication) and data storage (Firestore), under Google Cloud's privacy terms.
• Google LLC — Google Calendar API integration, with the therapist's express consent.

All transfers are made with providers that maintain adequate levels of data protection in accordance with international standards.

6. Data Security

The Controller implements the following technical and organizational measures:

• Encrypted transmission via HTTPS/TLS on all communications.
• Data access restricted by Firestore security rules: each user can only access their own data.
• Google Calendar access tokens stored securely in Google Secret Manager, inaccessible from the browser.
• Clinical record access log in compliance with NOM-004-SSA3-2012.
• Mandatory authentication via Google account for all users.

7. User Rights

Under Mexico's LFPDPPP, you have the right to Access, Rectify, Cancel, or Object to the processing of your personal data (ARCO rights). To exercise these rights, send a request to:

• Email: privacidad@sesiona.mx.
• Subject line: "ARCO Rights Request".

Requests will be addressed within a maximum of 20 business days as required by the LFPDPPP. If the request is approved, changes will be made within the following 15 business days.

8. Cookies and Tracking Technologies

The Platform uses browser local storage (localStorage and IndexedDB) exclusively to maintain the user's active session and save application preferences. No third-party tracking cookies or advertising technologies are used.

9. Children's Privacy

The Platform is not directed at minors. Therapists may register data of minor clients under their professional responsibility and with the consent of the corresponding legal guardian, in accordance with applicable regulations.

10. Changes to This Policy

The Controller reserves the right to modify this Policy at any time. Substantial changes will be communicated through the Platform or by email at least 30 days in advance.

11. Google API Limited Use Compliance

Sesiona's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: Google Calendar data is used only to provide and improve the calendar management features described in this policy; it is not used to serve advertising, is not sold or transferred to third parties for any other purpose, and humans do not read user data unless required for security, legal obligations, or with the user's explicit consent.

12. Contact