Versión en español ← Back to home

Privacy Policy

Last updated: October 9, 2026

This Privacy Policy describes how Vínculo Soluciones Digitales S.A. de C.V. (hereinafter "the Controller"), located at General Prim 184, Col. Vallarta Norte, Guadalajara, Jalisco, Mexico, phone +52 33 3839 6531, reachable at privacidad@sesiona.mx, collects, uses, and protects the personal data provided by users of the Sesiona platform (hereinafter "the Platform"), available at sesiona.mx.

This Policy is issued in compliance with Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), published in the Official Gazette of the Federation on March 20, 2025 and effective March 21, 2025 — which repeals the prior law of July 5, 2010 — together with its applicable implementing regulations. The competent data protection authority for private parties is the Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno), which assumed the functions previously held by the now-dissolved National Institute for Transparency, Access to Information and Personal Data Protection (INAI).

Sesiona's Role in Data Processing

Sesiona acts in a dual capacity depending on the type of data involved:

• Data Controller with respect to the data of therapists, institutional administrators, and students who register directly on the Platform (name, email, account settings, payment history).
• Data Processor with respect to the clinical and client data that therapists enter into the Platform (clinical records, session notes, tasks, emotional check-ins, client contact details). In this case, the therapist is the Controller under the LFPDPPP and NOM-004-SSA3-2012, and Sesiona processes such data solely under the therapist's instructions and to operate the service. This relationship is formalized upon acceptance of the Terms of Use.

1. Personal Data We Collect

Depending on user type, we collect the following data:

Therapists:

• Full name and email address (via Google OAuth).
• Google Calendar information (events, availability).
• Client data voluntarily entered by the therapist: full name, email address, phone number, and — for minor clients — the name and contact information of the parent or legal guardian.
• Clinical notes, records, and session logs entered by the therapist.
• Schedule settings and account preferences.

Clients:

• Full name and email address (via Google OAuth).
• Emotional check-ins voluntarily completed: emotional state, cognitive-behavioral therapy reflections, exploration of automatic thoughts and cognitive distortions. This data constitutes sensitive personal data under Article 3, section VI of the LFPDPPP, as it reveals aspects of the data subject's mental health. Its processing requires, and is carried out under, express consent granted at the time the account is linked.
• Information about therapeutic tasks assigned by the therapist.
• Acceptance record of the corresponding therapist's privacy notice.

Students (Campus portal):

• Full name and email address (via Google OAuth, the institution's invitation, or the sign-in link the student requests to their email).
• When requesting or using a sign-in link: the connecting IP address, used only to limit abuse and stored solely as a truncated fingerprint that cannot identify the address.
• Course progress: lessons viewed, quiz results, completion percentage.
• Activity submissions: texts, files, and exam answers.
• Participation in the course message board.
• Payment information processed by Stripe when a course has a cost (see Section 6).
• Live video classes: when the institution teaches a live class within the Platform, participants' image, voice, and screen are transmitted (camera and microphone are off by default — the student decides when to enable them). The institution may record the class as course material: recording is announced before joining and indicated visibly (🔴 REC) during the class, stored temporarily in encrypted form, and may be published for course students as an unlisted YouTube video. The institution is the data controller for these recordings; Sesiona acts as processor.

Billing data (therapists and institutions that subscribe to a paid plan):

• Only if you request an invoice: RFC (tax ID), name or legal business name, tax regime, postal code of the tax address, and email to receive invoices.
• Subscription data: plan, billing dates, and payment status. Card data is collected and processed directly by Stripe; Sesiona does not store it.

Institutional administrators:

• Full name and email address (via Google OAuth).
• Institution, course, and student information voluntarily entered.

2. Purposes of Data Processing

Primary purposes (required to provide the service):

• Authenticating user identity via Google OAuth or, in the Campus portal, via a single-use sign-in link sent to their email.
• Managing the therapist's schedule and syncing events with Google Calendar.
• Storing and displaying clinical records and session notes.
• Facilitating communication between therapist and client within the Platform.
• Generating appointment reminder messages for manual delivery via WhatsApp, using the client's name and appointment details.
• Enabling institutions to coordinate therapists, courses, and students.
• Providing therapists with the tools to keep and preserve clinical records under Mexican Standard NOM-004-SSA3-2012, compliance with which is the therapist's responsibility as the care provider.
• Charging for the paid plans subscribed to (through Stripe) and issuing the requested tax invoices (CFDI), in compliance with tax obligations.

Secondary purposes (users may opt out without affecting core service):

• Sending communications about improvements, new features, or platform updates.

3. Use of Google Calendar API

The Platform uses the Google Calendar API to read, create, modify, and delete events in the therapist's calendar, exclusively with their express consent through Google's OAuth 2.0 authorization flow.

Google Calendar access is used solely for:

• Displaying the therapist's weekly schedule within the Platform.
• Creating, rescheduling, or canceling client appointments.
• Checking availability to suggest session times.

Data obtained from Google Calendar is not shared with third parties, not used for advertising, and not transferred outside the described service context. The Controller complies with the Google API Services User Data Policy, including its Limited Use requirements.

Therapists may revoke Google Calendar access at any time from the "Agenda" section of the Platform or directly at myaccount.google.com/permissions.

4. Google User Data: Retention and Deletion

What Google user data we store and for how long:

• Google Calendar authorization tokens — OAuth 2.0 refresh tokens that allow the Platform to access the therapist's calendar on their behalf. These tokens are stored in encrypted form on Google Cloud servers (Firestore, access restricted to server-side Cloud Functions only — never accessible from the browser). Tokens are retained for as long as the therapist maintains the Google Calendar connection. They are permanently deleted when the therapist disconnects Google Calendar from the Platform or revokes access at myaccount.google.com/permissions.
• Google account profile information (full name, email address, profile photo) — collected at sign-in and stored in the Platform's user database. Retained for as long as the user maintains an active account. Deleted upon account deletion request within 30 days.
• Calendar event data — the Platform reads event data in real-time to display the therapist's weekly schedule. Only appointment-specific fields (date, time, event title, Google Calendar event ID) are stored in the Platform's database to support appointment synchronization with the patient-facing app. This data is retained until the therapist deletes the corresponding appointment or requests full account deletion. Raw calendar event content is never stored beyond what is needed for the described purpose.

How to delete your Google user data:

• Disconnect Google Calendar only: click "Desconectar" (Disconnect) in the "Mi cuenta" (My Account) section of the Platform. This immediately revokes and deletes the stored authorization tokens. You can also revoke access directly at myaccount.google.com/permissions.
• Delete all stored Google data (full account deletion): send a request to privacidad@sesiona.mx with the subject line "Google Data Deletion Request". All Google-sourced data (profile, tokens, synced calendar events) will be permanently deleted within 30 days of the confirmed request.

Deletion requests cannot be undone. Clinical records and patient data entered manually by the therapist are governed by separate retention requirements under NOM-004-SSA3-2012 and are handled through the ARCO rights process described in Section 8.

5. Use of WhatsApp for Appointment Reminders

The Platform generates pre-written text messages containing appointment information (client name, date, and time) for the therapist to manually send to their clients via WhatsApp. The Platform does not send messages automatically and has no access to the therapist's or client's WhatsApp account; sending is always a voluntary, manual action by the therapist. WhatsApp is a service of Meta Platforms, Inc., subject to its own terms and privacy policy.

6. Data Transfers and Subprocessors

Personal data is not sold, assigned, or transferred to third parties, except in the following cases necessary to operate the service. All providers listed act as subprocessors and maintain adequate levels of protection in accordance with international standards. Data is stored on servers located primarily in the United States of America.

• Google LLC (USA) — authentication (Firebase Authentication), database (Firestore), and server functions (Cloud Functions). Google Privacy Policy.
• Google LLC (USA) — Google Calendar API integration, under the therapist's express consent. See Section 3.
• Cloudflare, Inc. (USA) — storage and playback of recorded course videos in the Campus portal, via Cloudflare Stream. Videos are streamed with temporary access tokens. Cloudflare Privacy Policy.
• Resend, Inc. (USA) — delivery of transactional emails (welcome messages, account reminders, student invitations, and Campus portal sign-in links). Resend Privacy Policy.
• Stripe, Inc. (USA) — payment processing for therapist and institution subscriptions, and Campus course payments. Stripe handles card data directly; Sesiona does not store payment instrument data. Stripe Privacy Policy.
• SAT-Authorized Certification Provider (PAC) — solely to stamp the requested tax invoices (CFDI), using the billing data described above.
• LiveKit, Inc. (USA) — transmission of teleconsultation video calls between therapist and client, and of live classes in the Campus portal. Audio and video are encrypted in transit; LiveKit acts as a subprocessor for session transport and its servers may be located outside Mexico. Sesiona does not record therapeutic teleconsultations; Campus live classes may be recorded by the institution (with prior notice and a visible indicator), using LiveKit recording infrastructure and encrypted Google Cloud storage. LiveKit Privacy Policy.
• Firebase Cloud Storage / Google Cloud Storage (USA) — storage of files attached to clinical records, sessions, tasks, and course resources.

7. Data Security

The Controller implements the following technical and organizational measures:

• Encrypted transmission via HTTPS/TLS on all communications.
• Data access restricted by Firestore security rules: each user can only access their own data.
• Google Calendar access tokens stored securely in Google Secret Manager, inaccessible from the browser.
• Clinical record access log in compliance with NOM-004-SSA3-2012.
• Mandatory authentication via Google account for all users, except student access to the Campus portal with a single-use link sent to their email, which expires after 60 minutes and of which only a cryptographic fingerprint is stored.

8. User Rights (ARCO)

Under Mexico's LFPDPPP, you have the right to Access, Rectify, Cancel, or Object to the processing of your personal data (ARCO rights). To exercise these rights, send a request to:

• Email: privacidad@sesiona.mx.
• Subject line: "ARCO Rights Request".

Requests will be addressed within a maximum of 20 days as required by the LFPDPPP. If the request is approved, changes will be made within the following 15 days.

If you believe your request was not adequately addressed, you may contact the competent data protection authority for private parties, the Ministry of Anti-Corruption and Good Governance (which assumed the functions of the now-dissolved INAI).

9. Cookies and Tracking Technologies

The Platform uses browser local storage (localStorage and IndexedDB) exclusively to maintain the user's active session and save application preferences. No third-party tracking cookies or advertising technologies are used.

10. Children's Privacy

The Platform is not directly aimed at minors. Therapists may register data of minor clients under their professional responsibility and with the consent of the corresponding parent or legal guardian, in accordance with the LFPDPPP and applicable professional standards. By registering a minor client, the therapist confirms having obtained such consent. Sesiona does not independently verify the existence of guardian consent; that responsibility rests with the therapist as the Controller of the processing.

10 bis. Data Retention and Deletion

Data is retained for the following periods:

• Clinical records and session notes — at least 5 years from the last consultation, under NOM-004-SSA3-2012. They may be retained longer where applicable professional standards so require.
• Client emotional check-ins — for as long as the client's account is active and linked to the therapist. The therapist may delete them at any time.
• Google Calendar tokens — until the therapist disconnects the calendar or cancels their account. See Section 4.
• Payment data (Stripe) — Stripe retains transaction records under its own policy; Sesiona retains only the customer and subscription identifiers for as long as necessary to manage the account.
• Student progress in Campus — for as long as the student maintains an active enrollment with the corresponding institution.
• Live class recordings (original MP4 file) — kept temporarily while the institution downloads and publishes them as course material, and deleted according to the applicable retention policy.
• Account data (name, email) — until the user requests account deletion, with a maximum deletion period of 30 days from confirmation.

Audit data (the clinical-record access log under NOM-004) cannot be deleted during the mandatory retention period established by that standard.

11. Changes to This Policy

The Controller reserves the right to modify this Policy at any time. Substantial changes will be communicated through the Platform or by email at least 30 days in advance.

12. Google API Limited Use Compliance

Sesiona's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: Google Calendar data is used only to provide and improve the calendar management features described in this policy; it is not used to serve advertising, is not sold or transferred to third parties for any other purpose, and humans do not read user data unless required for security, legal obligations, or with the user's explicit consent.

13. Contact