Privacy Policy

Updated 30 August 2026

Levossa respects your privacy and processes your personal data confidentially and with care. This Privacy Policy explains what personal data Levossa processes, for what purposes it is used, and what rights you have.

1. Data Controller

Levossa / Päivi Karhu
Email: paivi@levossa.fi
Website: levossa.fi

If you have any questions about the processing of your personal data, you can contact us at the email address above.

2. What personal data do I process?

Käsiteltävät henkilötiedot riippuvat siitä, miten olet yhteydessä Levossaan.

For sleep therapy clients, the personal data processed may include, for example:

  • name and contact details
  • information about age, work and life situation
  • appointment and session information
  • information related to sleep, alertness, lifestyle and the sleep environment
  • information provided by the client about their health, medication and any sleep-related examinations
  • information provided by the client about psychological strain and their life situation
  • information about changes in lifestyle that arise in connection with the therapeutic work

My own working notes made during therapy sessions are primarily kept on paper. In files related to therapy that are stored electronically, I aim to avoid direct identifiers and use pseudonyms such as “Client J”. However, such pseudonymised data is still considered personal data if it can be linked to an individual.

For newsletter subscribers, the personal data processed may include the subscriber’s name and email address, as well as technical information related to subscribing to and receiving the newsletter.

When you use the website, data such as your IP address and technical information generated through cookies and server logs may also be processed.

3. For what purposes is personal data used?

Personal data is processed for:

  • planning and providing sleep therapy services
  • becoming familiar with the client’s situation before the first session
  • managing appointments and client communicationsmanaging the client relationship
  • invoicing, accounting and compliance with legal obligationssending newsletters to subscribers
  • operating, securing and technically maintaining the website.

Personal data is not used for automated decision-making or profiling that would have legal or similarly significant effects on you.

4. Legal bases for processing personal data

The processing of ordinary personal data related to sleep therapy is primarily based on the performance of a contract or on taking steps at the client’s request before entering into a contract.

Personal data related to invoicing and accounting is also processed to comply with legal obligations.

The sending of newsletters is based on consent. You can unsubscribe from the newsletter at any time.

5. Health data and other special categories of personal data

Health data may be processed through the sleep therapy intake form and in connection with therapy sessions. Under the EU General Data Protection Regulation (GDPR), health data is classified as a special category of personal data.

The processing of this data is based on the client’s explicit consent (Article 9(2)(a) GDPR). Under the GDPR, health data is classified as a special category of personal data, and its processing requires a separate legal basis under Article 9. Explicit consent is one such basis.

The intake form asks for separate explicit consent for this processing. Consent is not pre-selected and must be actively given by the client. This also reflects the GDPR requirement that consent must be given through a clear affirmative action.

You may withdraw your consent at any time by contacting paivi@levossa.fi. Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

If processing health data is necessary for providing sleep therapy, withdrawing consent may in practice affect my ability to continue providing the service.

6. Where is personal data obtained from?

Personal data is primarily obtained directly from you, for example:

  • through the intake form
  • when booking an appointment
  • by emailduring therapy sessions and related therapeutic work
  • when subscribing to the newsletter

As a general rule, personal data is not collected from other sources without the client’s knowledge.

7. How long is personal data retained?

Personal data is retained only for as long as it is needed for the purpose for which it was collected or as required by law.

Information provided through the sleep therapy intake form is retained in Google Forms only for as long as it is needed to prepare for the first session and begin the therapy process. Responses are deleted no later than 30 days after the first session.

Paper therapy notes and any pseudonymised electronic working files are destroyed when the client relationship ends and they are no longer needed to provide the service.

Information related to appointments and client communications is retained only for as long as necessary to manage the client relationship and any subsequent enquiries.

Invoicing and accounting records are retained for the period required by law.

Newsletter subscriber information is retained for as long as the subscription remains active or until the information is otherwise deleted.

8. Service providers used to process personal data

Levossa uses external service providers in its operations. These service providers may process personal data in order to provide their services.

These service providers currently include:

  • Google Workspace and Google Forms, for collecting sleep therapy intake information and processing it electronically
  • Nettiaika, for appointment booking
  • Zoom, for online sessions
  • OP Kevytyrittäjä, for invoicing and the related processing of personal data
  • Domainhotelli / Planeetta Internet Oy, for the technical provision of the website and email services
  • MailPoet, for managing newsletter subscribers and sending newsletters
  • Cloudflare Turnstile, for protecting online forms against spam and automated abuse

Zoom sessions are not recorded by Levossa.

Service providers process personal data in accordance with their terms of service, privacy policies and applicable data processing agreements.

Personal data is not sold to third parties.

9. Transfers of personal data outside the EU and EEA

Some of the international service providers used by Levossa may process personal data outside the European Union or the European Economic Area.

In such cases, appropriate safeguards are used to ensure that personal data is transferred in accordance with applicable data protection legislation. These safeguards may include an adequacy decision by the European Commission or Standard Contractual Clauses approved by the European Commission.

The GDPR also requires individuals to be informed about such transfers and the safeguards used to protect their personal data. 

10. How personal data is protected

Appropriate technical and organisational measures are used to protect personal data.

Access to the Google Workspace environment is protected by two-step verification. Access to files containing client information is restricted to those who need it.

Information collected through Google Forms is not unnecessarily shared with other users.

Paper therapy notes are stored securely so that they cannot be accessed by unauthorised persons. They are securely destroyed when they are no longer needed.

Directly identifying information is avoided where possible in electronic files related to therapeutic work.

11. Cookies and use of the website

The Levossa website uses cookies that are necessary for the website to function. With your consent, the website may also use other cookies, for example to measure how the website is used.

The use of cookies other than those strictly necessary is based on your consent. You can change your choices at any time through the Cookie Settings on the website.

With your consent, the website uses Google Analytics 4 to measure and improve the use of the website.

Google Analytics is only activated after you have consented to analytics cookies. You can decline consent or withdraw it later through the Cookie Settings on the website.

12. Your data protection rights

Under applicable data protection legislation, you have the right, among other things, to obtain information about how your personal data is processed, access the personal data held about you, request the correction of inaccurate data and, in certain circumstances, request the deletion of your data or restriction of its processing.

Depending on the circumstances, you may also have the right to receive the personal data you have provided in a structured format and have it transferred to another service provider.

Where the processing of your personal data is based on consent, you have the right to withdraw your consent at any time.

You can submit a request concerning your rights by email to paivi@levossa.fi. Your identity may be verified where necessary before the request is fulfilled.

13. Right to lodge a complaint

If you believe that your personal data has been processed in violation of data protection legislation, you have the right to lodge a complaint with the competent supervisory authority.

In Finland, the supervisory authority is the Office of the Data Protection Ombudsman.

14. Changes to this Privacy Policy

Levossa may update this Privacy Policy if its operations, the services it uses or applicable legislation change.

The current version of the Privacy Policy is always available on the Levossa website.