Privacy Policy

Last update March 2024.

Hello, dear one! Thank you for being here.

Your privacy matters to me, and I am committed to protecting your personal data. This policy explains the terms on which I collect and process your personal data, and how I protect your personal data when you visit my website at https://liliagraue.com/, you contact me, you engage me to provide my consulting services (medicine and psychotherapy for Mexican residents, coaching and mentoring for residents elsewhere), including any workshops, 1-1 sessions, and guided practices, or you otherwise engage with me. In addition, it explains your privacy rights and how the law protects you.

Please read this Privacy Policy carefully. By using this Website or its Content, you are consenting to this Privacy Policy, whether or not you have read it. If you do not agree with this Privacy Policy, please cease all further use of this Website.

1.              Who I am

I am Dr. Lilia Graue Olmos, MD, LMFT (“I”, “me” or “my”) and I am the controller responsible for your personal data. I comply with “data protection laws”, which means the Mexican Federal Law of Protection for Personal Data in Possession of Individuals and its Bylaws, the UK Data Protection Act 2018, the EU law retained version of the General Data Protection Regulation (EU) (2016/679)), the California Consumer Privacy Act (“CCPA”) and the California Privacy Rights Act (“CPRA”).

As I process the personal data of UK residents, I am registered with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (ico.org.uk), and my registration number is ZB670221. If you have any concerns about data protection, I would appreciate if you contacted me first so I can discuss these with you before you approach the ICO. You can reach me at lilia@liliagraue.com.  

2.              About my website

My website is hosted by Squarespace. As explained in this policy, Squarespace collects personal data when you visit my website, including:

• Information about your browser, network and device

• Web pages you visited prior to coming to this website

• Web pages you view while on this website

• Your IP address.

Squarespace needs the data to run my website, and to protect and improve its platform and services. Squarespace analyses the data in a de-personalised form.

3.              The data I may collect about you

Personal data/information means any information about an individual from which that person can be identified. It doesn’t include anonymous data. I may collect, use, store and transfer different kinds of personal data about you which I have grouped together as follows:

• Identity Data includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth, and gender.

• Contact Data includes billing address, email address and telephone numbers.

• Financial Data includes bank account and payment card details. Please note that my website uses Stripe to process your payment details, which I never see and do not have access to.

• Transaction Data includes details about payments to and from you and other details of the services you have purchased from me.

• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access my website.

• Profile Data includes your username and password (if applicable), purchases or orders made by you, your interests, preferences, feedback, and survey responses. 

• Usage Data includes information about how you use my website and services.

• Marketing and Communications Data includes your preferences in receiving marketing from us and my third parties and your communication preferences.

• Special Categories of Personal Data such as health data (as explained below).

• Aggregated Data such as statistical or demographic data for any purpose, isn’t considered personal data in law as this data will not directly or indirectly reveal your identity to me. I may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature.

As a rule, I don’t automatically collect any other Special Category Personal Data about you. This includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, genetic and biometric data. I also don’t collect any information about criminal convictions and offences

Health Data

Under the data protection laws, certain types of personal data is likely to be more sensitive and as such these are given additional protections. These are referred to as ‘special category personal data’ and include:

• personal data revealing racial or ethnic origin;

• personal data revealing political opinions;

• personal data revealing religious or philosophical beliefs;

• personal data revealing trade union membership

• genetic data;

• biometric data (where used for identification purposes);

• data concerning health;

• data concerning a person’s sex life; and

• data concerning a person’s sexual orientation.

 If you engage me to provide consulting services, it is essential for me that I collect certain special category personal data so that I can deliver my consulting services to you. I will therefore collect health data, such as your diagnosis, symptoms, and treatments and other data relevant to your life experience and wellbeing.

By purchasing my consulting services and by completing my intake forms, you give your express consent for my processing this special category personal data. I will only use this health data for the purpose it was collected for (i.e. delivery of my consulting services). You have the right to withdraw your consent to the processing of your special category personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, you may not be able to continue to participate in my consulting services. I will advise you if this is the case at the time you withdraw your consent. For more information, please contact me at lilia@liliagraue.com.  

4.              How is your personal data collected?

I may use different methods to collect data from and about you including through:

• Direct interactions. You may give me your Identity Data and Contact Data by filling in forms or by corresponding or engaging with me by post, phone, email, social media or otherwise. You may also give me your Health Data during your attendance of the consulting services.

• Automated technologies or interactions. As you interact with my website, I will automatically collect Technical Data about your equipment, browsing actions and patterns. I collect this personal data by using cookies, server logs and other similar technologies. I may also receive Technical Data about you if you visit other websites employing my cookies.

• Third parties or publicly available sources. I may receive personal data about you from various third parties and public sources, such as Google, Companies House, or the electoral register.

5.              How I use your personal data

I will only use your personal data when I can rely on a legitimate (lawful) basis, such as:

• Contract: Where I need to perform the contract, I am about to enter into or have entered into with you.

• Legitimate Interests: Where it is necessary for my legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

• Legal Obligation: Where I need to comply with a legal obligation.

6.              Purposes for which I will use your personal data

I have set out below the ways I may use your personal data, and which of the legitimate bases I rely on to do so:

7.              Mailing list and unsubscribing

If you have previously subscribed to my e-newsletter or updates, you may unsubscribe at any time through the unsubscribe link at the footer of all e-mail communications. I manage email lists through a list management system. Unsubscribing from one list managed by me will not necessarily remove you from all publication email lists. If you have questions or are experiencing problems unsubscribing, please contact me.

I have a no spam policy and provide you with the ability to opt-out of my communications by selecting the unsubscribe link at the footer of all emails. I will not sell, rent or share your email address.

8.               Cookies

My website uses cookies in accordance with the relevant parts of the Privacy and Electronic Communications (EC Directive) Regulations 2003 and data protection laws to distinguish you from other users of my website. This helps me to provide you with a good experience when you browse my website and also allows me to improve my website. A cookie is a small file of letters and numbers that I store on your browser or the hard drive of your computer if you agree. Cookies contain information that is transferred to your computer’s hard drive.

My website uses the following cookies:

• Strictly necessary cookies. These are cookies that are required for the operation of my website. They include, for example, cookies that enable you to log into secure areas of my website, use a shopping cart or make use of e-billing services.

• Analytical or performance cookies. These allow me to recognise and count the number of visitors and to see how visitors move around my website when they are using them. This helps me to improve the way my website works, for example, by ensuring that users are finding what they are looking for easily.

• Functionality cookies. These are used to recognise you when you return to my website. This enables me to personalise my content for you, greet you by name and remember your preferences (for example, your choice of language or region).

Please note that third parties may also use cookies, over which I have no control. These named third parties may include, for example, advertising networks and providers of external services like web traffic analysis services. These third-party cookies are likely to be analytical cookies or performance cookies or targeting cookie.

My website, hosted by Squarespace, uses the following cookies:

• Squarespace Analytics: Squarespace provides an integrated analytics platform that helps monitor and analyse website traffic and user behaviour. This service utilises cookies to gather data about how visitors interact with the website, such as the number of visitors, the pages they visit, the duration of their visits, and the referral sources (e.g. search engines, direct links, or social media). This information assists in understanding visitor patterns and improving the website's content and user experience to better serve the audience.

• Squarespace Marketing Cookies: In addition to analytics, Squarespace websites may use marketing cookies if the website employs Squarespace Email Campaigns or other marketing features. These cookies help in tracking the effectiveness of advertising campaigns by monitoring the actions that users take after viewing or clicking on an ad. This data aids in optimising marketing strategies, personalising content, and measuring the performance of ads to ensure targeted and efficient advertising efforts.

For information about viewing the cookies dropped on your device, visit The cookies Squarespace uses.

I will always ask for your consent to use non-essential cookies. You are free to withhold consent to this, but it means that I might not be able to provide the full website experience to you, including some elements of video advertising. If at any time you wish to disable my cookies, you can do so through the settings on your browser, or whenever the pop-up appears on the website (each time you access the website).

Browser cookie controls

You can block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of my website.

Information about how to configure your browser to block cookies can be found at:

• Google Chrome

• Microsoft Edge

• Internet Explorer

• Firefox

• Safari

• Safari Mobile

• Opera

9.              Disclosures of your personal data

I may disclose your information in the following cases:

• With your explicit consent, for example, if referring you to another professional for services that I cannot provide

• In the event of selling my business or company, only anonymised or aggregated data that does not identify you directly would be disclosed to the potential buyer

• I can disclose it to other businesses in my group, as defined in the UK Companies Act 2006

• I can disclose it if I have a legal obligation to do so, or in order to protect other people’s property, safety, or rights

• I can exchange information with others to protect against fraud or credit risks.

I use a variety of third party services (sub-processors) as part of my business activities and you/I will therefore share your personal data with these sub-processors. The types of sub-processors I might use fall into different categories, as follows:

• Video conferencing platforms, such as Zoom. You can read Zoom’s privacy policy at https://explore.zoom.us/en/privacy/.

• Credit card processing services, such as Stripe. You can read Stripe’s privacy policy at  https://stripe.com/gb/privacy

• Order fulfilment service providers

• Analytics service providers

• Event/campaign management service providers

• Website management service providers, such as Squarespace. You can read Squarespace’s privacy policy at https://www.squarespace.com/privacy

• Information technology and related infrastructure provision

• Email delivery services

• My auditors and legal advisors.

It is important to note that all third parties and sub-processors are bound by data protection obligations and, in the case of any third parties I sub-contract my services to, I will enter into a contract with them with comprehensive data protection obligations to ensure the security of your personal data.

10.              Data security

Data security is of great importance to me, and to protect your data I have put in place suitable physical, electronic, and managerial procedures to safeguard and secure data I collect. In addition, I limit access to your personal data to those employees, agents, contractors and other third parties who have a business to know. They will only process your personal data on my instructions, and they are subject to a duty of confidentiality. I have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where I am legally required to do so.

If there is an incident where I become aware that there has been a data breach, I will let you know without undue delay. I will then take all necessary steps, including informing the ICO, to limit the extent of the breach and to prevent a further reoccurrence.

11.              International transfers

I may transfer your personal data outside of the UK or the European Economic Area (EEA) where I engage third parties to provide services on my behalf, such as to receive services or deal with payment. Whenever I transfer your personal data out of the UK or the EEA, I ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• I will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data

• where I use certain service providers, I may use specific contracts approved for use in the UK which give personal data the same protection it has in the UK.

 Please contact me if you want further information on the specific mechanism used by me when transferring your personal data out of the UK or the EEA.

12.              Data retention

I will only retain your personal data for as long as reasonably necessary to fulfil the purposes I collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. I may retain your personal data for a longer period in the event of a complaint or if I reasonably believe there is a prospect of litigation in respect to my relationship with you.

To determine the appropriate retention period for personal data, I consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which I process your personal data and whether I can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

13.              Children’s Personal Data

My website isn’t intended for use by children under the age of 18, and I don’t knowingly collect personal data from children under the age of 18. If I become aware that I have collected personal data from a child under the age of 18, I will promptly delete that data. If you believe I have collected personal data from a child under 18, please contact me by emailing me at lilia@liliagraue.com.

14.              Your legal rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data:

• Request access to your personal data.

• Request correction of your personal data.

• Request erasure of your personal data.

• Object to processing of your personal data.

• Request restriction of processing your personal data.

• Request transfer of your personal data.

• Right to withdraw consent.

If you wish to exercise any of the rights set out above, please contact me by emailing me at lilia@liliagraue.com.

You won’t have to pay a fee to access your personal data (or to exercise any of the other rights), but I can charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive, or I can refuse to comply in these circumstances.

I may need you to provide evidence of your identity as a security measure and I may also contact you to ask you for further information in relation to your request to speed up my response.

I try to respond to all legitimate requests within one month, but it could take longer than a month if your request is particularly complex or you have made a number of requests. In this case, I will notify you and keep you updated.

15.              Notice for California residents of privacy practices and rights

If you are a California resident, the CCPA grants you specific rights regarding your personal information. This section describes your CCPA rights and how to exercise those rights.

Right to Know and Access

You have the right to request that I disclose certain information to you about my collection and use of your personal data over the past 12 months. Once I receive and confirm your verifiable consumer request, I will disclose to you:

• The categories of personal data I collected about you.

• The categories of sources for the personal data I collected about you.

• My business or commercial purpose for collecting or selling that personal data.

• The categories of third parties with whom I share that personal data.

• The specific pieces of personal data I collected about you (also called a data portability request).

Right to Delete

You have the right to request that I delete any of your personal data that I collected from you and retained, subject to certain exceptions. Once I receive and confirm your verifiable consumer request, I will delete (and direct my service providers to delete) your personal data from my records, unless an exception applies.

Right to Non-Discrimination

I will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, I will not:

• Deny you goods or services.

• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.

• Provide you a different level or quality of goods or services.

• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Do Not Sell My Personal Data

I do not sell your personal data. However, if in the future I decide to sell personal data, I will update this privacy policy to inform you of your right to opt-out of the sale of your personal data.

Exercising Your CCPA Rights

To exercise the access, data portability, and deletion rights described above, please submit a verifiable consumer request to me by contacting me.

Only you, or someone legally authorised to act on your behalf, may make a verifiable consumer request related to your personal data. I may only respond to two verifiable consumer requests per consumer per 12-month period.

15.              Notice for residents of Mexico of ARCO rights

If you are a resident of Mexico, you or your legal representative may exercise any of the rights of access, rectification, cancellation or opposition (hereinafter “ARCO Rights”), as well as the procedure for revoking your consent for the processing of your personal and/or sensitive data by sending your request to lilia@liliagraue.com. In order to attend to your ARCO Rights in a timely manner, as well as to revoke your consent, it is necessary that you indicate the following in your request:

a. The name of the owner and their email account to communicate the response to their request.

b. Attach the document that proves your identity, as well as, where applicable, the corresponding legal representation.

c. The clear and precise description of the personal data with respect to which one seeks to exercise any of the aforementioned rights.

d. Any other element or document that facilitates the location of personal data.

Indications for each case of requests:

• Rectification: The owner must indicate the modifications to be made and provide the documentation that supports the request.

• Revocation: Specific mention that it is your will to revoke the consent, scope and the reasons for which you do so.

In the event that the information provided is erroneous or insufficient, or the corresponding accreditation documents are not accompanied, you may be required to provide the necessary elements or documents to process it. You will have ten (10) business days to respond to the request, counting from the day after you received it. If a response is not provided within said period, the corresponding request will be deem not submitted. The response will be given electronically to the email address specified in the request.

17.           Third party links

This policy only relates to my website and my business. I might have links on/within my services to other website, and these websites will have their own terms and conditions and privacy policies. You should check those privacy policies before providing your personal data to those websites.

18.           Changes to this policy

I can update this policy from time to time as laws change or as my website or services change. If I make material changes to this policy, you are currently engaged with my services with a contractual relationship, and I need your consent to those changes, I will contact you by email to do so.

If you have any questions about this Privacy Policy, please contact me by emailing me at lilia@liliagraue.com. 

Please refer to this Website's Terms & Conditions in addition to the Privacy Policy set forth above.