Privacy policy for clients and visitors

Who is responsible for your data#

1. The platform Psychotherapy Partners (PP, https://psychotherapy.partners) is operated by Handel i Usługi Kamil Durkiewicz, ul. Bacciarellego 54 BB / 12, 51-649 Wrocław, Poland, tax identification number (NIP) 8951851925. The operator is the controller of the personal data described in this policy. Contact for everything about your data: privacy@psychotherapy.partners. The competent supervisory authority is the Polish one, the President of the Personal Data Protection Office (UODO).
2. PP and each therapist are separate, independent controllers. PP is responsible for the platform and for everything it does as a service: your account and signing in, the public profiles and the search, the booking engine, the payment status of each meeting as the therapist marks it, the therapists' occupancy and commission, ratings and comments, carrying the chat and the online meetings, the e-mail notifications, PP's charges to therapists and the therapists' specialty declarations.
3. Each therapist you book is responsible, as their own controller, for the data they receive in order to work with you and to get paid: your name, your phone number if you gave one, your bookings, the chat with you, your payments and refunds, and their no-show and payment marks, and for anything they keep outside the platform, such as their notes. The therapist informs you about their own processing; PP is not responsible for what a therapist does with the data they have received.
4. PP is not the therapists' processor, because it uses the booking and payment data for purposes of its own, such as computing occupancy and commission and deciding who may rate whom. Nor are PP and a therapist joint controllers: PP provides its service to you under the clients' terms, while the therapist provides therapy on their own account.
5. Only a narrow part of the platform's data is ever visible to a person at PP, through the administration panel: PP's charges to therapists, which carry a month's aggregate figures only (the month, its occupancy and commission rate, the number of paid meetings, the revenue and the commission), and the therapists' billing identities needed to invoice a commission. Nobody at PP can see the content of your messages, and no charge ever names a client or a single meeting.

What we process and why#

Searching for a therapist as a visitor creates no data about you beyond the server logs and the aggregate statistics: your filters live in the page address, not on our servers.

Health data and your consent#

1. Data about psychotherapy is health data, a special category of personal data under Article 9 of the GDPR, and the category is wide: the mere fact that you have a client account, or have booked a meeting with a psychotherapist, reveals information about your health. Your chat messages, cancellation notes, rating comments and the e-mails about your meetings may reveal it as well.
2. We therefore process your data as a client on two bases together: the contract with you (the clients' terms and conditions, Article 6(1)(b)) and your explicit consent to the processing of your health data (Article 9(2)(a)).
3. You give the consent on the registration form, in a separate checkbox that is never pre-ticked. A client account cannot be created without it.
4. Withdrawing the consent means deleting your account, which you can do at any time in Account settings. Withdrawal does not affect the lawfulness of the processing before it. Deletion is refused while you still have meetings booked ahead, as the terms explain, so cancel them first; if that prevents you from withdrawing, write to privacy@psychotherapy.partners and we will find a way that respects both your withdrawal and the meetings still booked.
5. Minors have no accounts. If you book for your child from your own account, you are the client of record and the data on the platform is yours; your therapist handles your child's data as their own controller and obtains any consent the law requires outside the platform.

Legal bases in short#

1. Clients: the contract (Article 6(1)(b)) together with your explicit consent to the processing of health data (Article 9(2)(a)).
2. The call-quality survey you may answer after an online meeting: PP's legitimate interest (Article 6(1)(f)) in the quality of its calls, together with your explicit consent for health data. You may object to it, and you can simply leave the survey unanswered.
3. Visitors without an account: PP's legitimate interest (Article 6(1)(f)) in keeping the site secure and measuring its use. No health data is collected from visitors.
4. After your account is deleted, your past meetings are kept only in anonymised form, which no longer identifies you and is therefore no longer personal data. They are kept because the therapist's occupancy and PP's charges were computed from them.
5. We make no decisions about you by automated means that would have legal or similarly significant effects. Nothing on the platform blocks you from booking, and calling off a meeting that was not paid for by its deadline is always the therapist's own decision, never an automatic one.

The chat#

1. The chat is a messaging service between you and each therapist you have booked, provided by PP. It is not the therapist's clinical documentation; whatever notes your therapist keeps, they keep outside the platform as their own controller.
2. Messages are stored on PP's servers, because that is how they are delivered and how the conversation history is shown to both of you. They are encrypted in transit, but they are not encrypted end to end.
3. Nobody at PP reads your messages. There is no administrative view of message content; the people at PP can see bookings and their payment status, for example to help with a dispute, but never a conversation. Access to the underlying database is limited to technical maintenance and is logged. The chat is not monitored, which is also why it is not for emergencies.
4. The e-mail that tells you about new messages carries only their number, never their text or the sender's name.
5. When either you or the therapist deletes their account, the conversation is deleted for both of you.

Online meetings#

1. Online meetings use WebRTC. Your browser and the therapist's connect directly to each other (peer to peer), with the help of Cloudflare's STUN servers; when a direct connection is not possible, the call is relayed through Cloudflare's TURN servers. Both are used under PP's own Cloudflare account and data processing agreement.
2. The audio and the video are encrypted end to end (DTLS-SRTP), so the relay cannot decrypt them: Cloudflare sees only IP addresses and connection times.
3. In a direct connection, each browser learns the other party's IP address. This is how peer-to-peer connections work; if you would rather not disclose your IP address to your therapist, use a VPN.
4. Cloudflare, Inc. is a US company. The transfer relies on its certification under the EU–US Data Privacy Framework, with the standard contractual clauses of its data processing agreement as a fallback.
5. Exactly two connections take part in a meeting, the therapist's and yours; no third participant can join.
6. After a call, the video room offers a short, optional survey of the call's quality. If you answer it, your answer is stored with the technical summary of the connection listed above. It contains nothing of what was said or shown; only PP uses it, to improve the calls, and your therapist never sees it.

Who receives your data#

1. Your therapists, as independent controllers, receive your name, your phone number if you gave one, your bookings, your messages, the payment status of your meetings and your ratings, as described above. Every therapist resides in the EU/EEA, the United Kingdom or Switzerland; the last two are covered by adequacy decisions, so passing your data to a therapist is never a restricted international transfer.
2. Processors act only on PP's instructions, each under a data processing agreement (Article 28), and each is either established in the EU/EEA and hosts the data there, or relies on an adequacy decision or the Data Privacy Framework. They are, by category: the hosting and database provider; the e-mail delivery provider, which sees the content of the e-mails it sends, such as payment instructions and reminders, refund notices and cancellation notes; Cloudflare, for the STUN and TURN servers of the video calls; the map tiles and geocoding provider, which serves the map of a therapist's in-person address and therefore sees your IP address when a map loads; the error monitoring service, which receives technical error reports without message content; and the analytics tool, which processes aggregate, cookieless statistics. We send the current list of processors, with their countries, on request to privacy@psychotherapy.partners.
3. YouTube (Google) is a separate controller of the video a therapist may embed on their profile. The video is served from youtube-nocookie.com and is loaded only after you click its placeholder; until then nothing is sent to Google. From the click, Google's privacy policy applies.
4. Public authorities receive data only where the law obliges us.
5. We never sell personal data and show no advertising.

Cookies, local storage and analytics#

1. PP uses only essential cookies: the session cookie that keeps you signed in and, only when you choose a language in the header, a cookie that remembers the choice. There are no advertising or social-media pixels anywhere on the site.
2. Visits are measured with privacy-friendly, cookieless analytics that produce aggregate statistics and cannot identify you. That is why the site shows no consent banner.
3. A few preferences, such as a dismissed time-zone warning, are kept in your browser's local storage and never leave it.
4. The exchange rates used by the price filter come from the National Bank of Poland (NBP). The daily snapshot is a server-to-server request that carries no personal data; your browser never contacts NBP.

How long we keep data#

Your rights#

1. You have the right to access your data, to have it corrected or erased, to restrict its processing, to receive it in a portable form, to object to processing based on our legitimate interest, and to withdraw your consent at any time.
2. Much of this is self-service: your name, e-mail address, password, time zone and phone number are in Account settings, your optional e-mails in Notification settings, your ratings on the therapists' pages, and deleting the account is how you withdraw your consent and erase your data.
3. For everything else, write to privacy@psychotherapy.partners. We answer within one month; for an unusually complex request we may need up to two more months and will tell you so.
4. Requests concerning the records a therapist keeps as their own controller, such as their notes, are handled by that therapist.
5. You may lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, https://uodo.gov.pl, or with the authority of the country where you live.

Security#

1. All traffic to PP is encrypted (TLS). Passwords are stored only as hashes; one-time codes are six digits, valid for ten minutes and five attempts. Sessions expire after 30 days.
2. Access to production data is limited to the operator's technical maintenance and is logged. Payment never passes through PP, so PP holds no card or payment data; it records only whether each meeting has been paid for, as the therapist marks it.
3. The audio and video of online meetings are encrypted end to end and never stored.
4. Should a breach of your data occur, we notify the supervisory authority within 72 hours where the GDPR requires it, and you directly where the risk to you is high.

Change of operator#

1. Once the platform has grown, a new Polish limited liability company (spółka z ograniczoną odpowiedzialnością) will take over the website and become the controller of your data in the sole trader's place. This policy anticipates the change from the start.
2. You will be informed by e-mail in advance. The purposes, legal bases, recipients and retention periods described here do not change with the operator, and you may delete your account before the change if you do not wish to continue.

Changes to this policy and contact#

1. We update this policy when the platform or the law changes. Each version carries its date at the top, and substantial changes are announced by e-mail before they take effect.
2. Questions about your data: privacy@psychotherapy.partners. Everything else about the platform: contact@psychotherapy.partners. The rules for using PP are in the terms and conditions for clients.