Last updated: October 2026
This privacy policy explains how personal data may be collected, used and stored when you visit the Arbórea website and use the contact channels provided here.
Rachel Engler Andalaft
Arbórea
Av. Paulista, 620
Bela Vista
São Paulo – SP, 01310-100
Brazil
E-mail: [email protected]
When you access this website, certain technical information is processed so that the page can work, remain stable and stay secure.
This information may include, in particular:
This website uses Cloudflare services for its technical infrastructure, delivery and security.
This data is used on the basis of the legitimate interest in providing the website in a secure, stable and efficient way, under Art. 7, IX of the Brazilian General Data Protection Law (LGPD, Law No. 13,709/2018) and, where applicable, Art. 6(1)(f) GDPR.
Technical logs are kept only for as long as necessary for these purposes and in line with the settings and retention periods of the services used.
Cloudflare is a global company headquartered in the United States and states that data may be processed both in the European Economic Area and in the United States. For international transfers subject to the GDPR, Cloudflare states that it uses the legally applicable safeguards.
When you contact me by e-mail, the data you send is used to receive, answer and follow up on your message.
Where the contact relates to a request for a first conversation or to the possible provision of services, this data may be used to take steps at your request before a possible contract begins, under Art. 7, V LGPD and, where applicable, Art. 6(1)(b) GDPR.
For other messages, the data may be used on the basis of the legitimate interest in answering the contact received, under Art. 7, IX LGPD and, where applicable, Art. 6(1)(f) GDPR.
Because messages addressed to a counselling practice may contain particularly sensitive personal information, I ask that the first contact include only the data needed for us to establish communication.
You do not need to send health-related information or details about your health to request a first conversation.
If a message spontaneously contains sensitive information, its use will be limited to what is necessary to manage the contact and will take place only to the extent permitted by the applicable law, including the rules for sensitive personal data in Art. 11 LGPD.
The data is kept for the period necessary to handle the contact and, where applicable, for as long as necessary to meet legal obligations or to protect rights.
The “Schedule appointment” buttons (in the header: “Schedule”) open a chat with me on WhatsApp, with an initial message already suggested, which you can change or delete before sending.
WhatsApp is not embedded directly in the Arbórea website. The connection to WhatsApp happens only when you decide to click one of these buttons, and no message is sent without your action.
When you contact me through WhatsApp, I receive your phone number, the name and profile photo you have set up, and the content of the messages you send.
This data is used exclusively to arrange and organise the first conversation and the contacts related to it. It is used to take steps you requested before a possible contract begins, under Art. 7, V LGPD and, where applicable, Art. 6(1)(b) GDPR.
As with e-mail contact, you do not need to send health-related information or details about your health to request a first conversation. If you prefer not to use WhatsApp, you can contact me by e-mail.
For users in Europe, WhatsApp is provided by WhatsApp Ireland Limited, a Meta group company. Messages are protected by end-to-end encryption, but WhatsApp/Meta may process usage data and metadata (for example phone number and time of messages), including with transfer to the United States. This processing is subject to the WhatsApp Privacy Policy.
Arbórea has a profile on Instagram.
This website does not embed any feed, posts, pixels or other scripts from Instagram or Meta. There is only an external link to the profile.
A connection to Meta’s services happens only when you decide to follow that link.
From that moment on, any data collected or used by Instagram/Meta is subject to the privacy policies of that service.
The website may contain links to other pages, including academic institutions, organisations mentioned in the content and other external services.
When you follow one of these links, you leave the Arbórea website. Any data collection and use by the destination site afterwards is subject to the privacy practices and policies of its operator.
The Arbórea website uses Google Analytics 4 to measure visits and the effectiveness of campaigns on Google Ads. In this version of the website, this measurement starts when the page opens, before an express choice, and can be declined at any time. Meta Pixel, session recording systems and behavioural advertising tools are not used.
Social media feeds or other external content that depends on optional tracking technologies are also not loaded automatically.
Necessary storage
Technical features strictly necessary for the operation, stability and security of the website may be used where indispensable.
To remember your cookie choice, the website saves in your browser’s local storage (localStorage), under the key arborea_cookie_consent, only your preferences (Analytics and Advertising: yes or no) and the date of the choice. This record contains no name, IP address, browsing history or health-related information. It stays only in your browser, and the choice is requested again after 12 months. A recorded refusal is applied on later visits before Google Analytics is loaded at all.
Google Analytics 4
Google Analytics 4 is an access analysis service provided, for users in the European Economic Area, by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and by Google LLC in the United States.
I use Google Analytics to understand how the website is used, for example which pages are visited, what kind of device is used and from which approximate region visits come, and to measure the effectiveness of Arbórea’s promotional campaigns.
Before a choice: in this version of the website, until you accept or decline, Google Analytics is loaded when the page opens, sets cookies and sends browsing data to Google, including for ad measurement. Continuing to browse does not mean you have agreed. The legal basis for this processing before the choice, under the LGPD and, where applicable, the GDPR and national rules on storing information on the user’s device (such as § 25 TDDDG in Germany), has not yet been defined and depends on legal review.
Google Analytics sets the cookies _ga and _ga_QBL322VSD7, which may remain in the browser for up to 2 years unless deleted earlier. If the Advertising category is active and you reached the website through a Google ad, the cookie _gcl_aw is also set, which stores the identifier of that click for up to 90 days. With the Advertising category active, Google may also set the cookie _gcl_au, used to associate visits and conversions with ads, also for up to 90 days.
Arbórea’s Google Analytics property is configured as follows:
According to Google, Google Analytics 4 does not log or store IP addresses. Google LLC states that it participates in the EU-U.S. Data Privacy Framework for data transfers to the United States. Data processed by Google is also subject to the Google Privacy Policy.
Clicks on “Schedule appointment”
When Analytics is active, a click on a “Schedule appointment” button may be recorded as a technical event called agendar_click, together only with the indication of where the button is on the page (for example header, hero or contato) and the WhatsApp destination address without the suggested message (https://wa.me/5516991067716). This event does not include the reason for seeking counselling, health-related information, your phone number or the content of messages sent through WhatsApp.
Advertising / ad measurement
In this version of the website, this category is active until you make a choice. It allows the identifier of an ad click (_gcl_aw) and the cookie _gcl_au to be stored in your browser, and Google Analytics measurement data to be sent to Google and used to evaluate the effectiveness of Arbórea’s campaigns on Google Ads, with the linked accounts. The website does not load any Google Ads tag of its own. Ad personalisation remains switched off regardless of this choice.
Your choice
On your first visit, a notice tells you that measurement is already active and lets you accept, decline or configure each category (Analytics and Advertising) separately. If you decline, new transmissions to Google Analytics are blocked and the website deletes the cookies _ga, _ga_QBL322VSD7 and _gcl_* that it can remove. If you switch off only Advertising, Analytics continues and only the _gcl_* cookies are deleted. Declining does not limit access to the website’s content or to booking.
You can change or withdraw your consent at any time through the Cookie preferences link, available in the footer of every page.
Declining or withdrawing consent stops transmissions from that moment on, but does not automatically delete data already sent to Google before then. This data follows the retention settings of the property (2 months for event data) and can be the subject of a deletion request through the channels given in section 9.
The controller is established in Brazil, and the processing is subject to the LGPD, including its rules on international data transfers (Arts. 33 to 36). For visitors in the European Union, the GDPR also applies where relevant.
In 2026, the European Commission recognised Brazil as a country offering an adequate level of personal data protection under Art. 45 GDPR.
Some of the technical providers used by the website, including Cloudflare and Google, operate internationally and may process data in different countries.
Where applicable, these providers are responsible for using the legally provided mechanisms to protect international data transfers.
Under the applicable data protection law, including Art. 18 LGPD and, where relevant, the GDPR, you may, depending on the case, exercise rights relating to your personal data, including:
To exercise these rights, you can write to:
You also have the right to lodge a complaint with the Brazilian National Data Protection Authority (ANPD) or with another competent data protection authority, in particular in the European Union Member State of your habitual residence, place of work or place of the alleged infringement.
This privacy policy may be updated when there are changes to how the website works, to the services used or to the applicable legal requirements.
The current version is always available through the “Privacy policy” link in the website footer.