Privacy policy
Last updated: September 29, 20261. Data we collect
Name, email, password (encrypted), intake form answers, session history, billing data. Video calls are NOT recorded unless explicitly consented.
2. Use of data
Your data is used exclusively to provide the service: schedule sessions, process payments, send reminders and maintain your clinical history. We never share information with third parties for commercial purposes.
3. Confidentiality
Everything discussed in session is confidential and is not shared with anyone. The only exceptions are situations of serious risk to you or to third parties, and anything the law requires to be reported.
4. Where your data lives and who processes it
The database and the application run on our own server hosted by Leaseweb in Frankfurt, Germany. That is where your account, your appointments, your intake form answers, the session notes and the record of your payments live. Files you upload — documents and transfer receipts — and the database backups are stored in Amazon S3 (AWS, eu-central-1, Frankfurt); the backups are encrypted. The emails we send you go out through Amazon SES (AWS, eu-central-1). You pay through whichever method your therapist has enabled: if it is a transfer, the receipt you upload is kept in that same storage and your therapist reviews it; if it is a card, the charge is processed by Stripe, which receives your email and your card details and tells us only whether the payment went through. Those card details never pass through us and are not stored here. Confirmed appointments are mirrored in the therapist's professional calendar in Google Workspace, with your name and the time. Site analytics are processed by Google (Google Tag Manager and Google Analytics 4), and only if you accepted analytics cookies. Google is a US company certified under the EU–US Data Privacy Framework; the rest of the processing happens in the EU. All traffic between your browser and us travels encrypted (HTTPS).
5. What protects each piece of data
Session notes and the therapist's private notes are NOT individually encrypted inside the database: what protects them is the database's own access control (RLS), which limits each record to the therapist who wrote it and the person it belongs to. Backups are stored encrypted, and your password is never stored in the clear.
6. Your rights
You can request access, rectification, deletion or portability of your data at any time by writing to contact@psychology-therapist.today. We respond within 15 business days.
7. Cookies and analytics
We use essential cookies (your account session and your own choice about cookies) and, only if you accept them, Google analytics cookies: the site loads Google Tag Manager (container GTM-T6M8LTSK) with Google Analytics 4 behind it. Until you accept, nothing from Google is loaded and no analytics cookie is written. We measure public pages and the booking funnel; never the dashboard screens (/app), because a dashboard pageview would say that whoever is looking is a patient in treatment. Details and how to revoke it are in the cookie policy.
8. Emails we send you
There are two kinds and they are treated differently. Service emails — appointment confirmation, cancellation, reminder, payment notice — are sent because they are necessary to provide the service, and cannot be turned off while you have an account or an upcoming session. Informational emails — news, workshops, events — are only sent to people who gave us their address for that purpose or who have already booked a similar service, and every one carries an unsubscribe link. Unsubscribing from these does not affect service emails.
9. Measurement of informational emails
Informational emails include a tracking image, and their links go through a redirector, so we record whether a message was opened and which links were clicked, tied to your address. This is individual measurement, unlike the site analytics, which are anonymous. We use it to learn which content is useful and to detect addresses that no longer exist. Processing is carried out by Amazon SES (AWS) on EU servers; this data is not shared with third parties and is never used to make any decision about your treatment. If you would rather it was not recorded, you can unsubscribe from any of those emails or ask us to disable it at contact@psychology-therapist.today. Service emails carry no such measurement.
10. Bounces and complaints
If your address permanently rejects our messages, or you mark one as spam, your address is automatically unsubscribed from informational emails. We keep that fact — not the content — so we do not write to you again.
11. Retention
Clinical records are kept for 10 years from the last session, per professional regulation. Billing data, 5 years. Email measurement data, 24 months. Everything else is deleted when you close your account.
12. Contact
Data protection officer: Mariel Maguna · contact@psychology-therapist.today.