Privacy policy for psychotherapists

Who is responsible for whose data#

1. The platform Psychotherapy Partners (PP, https://psychotherapy.partners) is operated by Handel i Usługi Kamil Durkiewicz, ul. Bacciarellego 54 BB / 12, 51-649 Wrocław, Poland, tax identification number (NIP) 8951851925. The operator is the controller of your personal data as described in this policy. Contact: privacy@psychotherapy.partners. The competent supervisory authority is the Polish one, the President of the Personal Data Protection Office (UODO).
2. You are a natural person even when you invoice through your own company: your name, your photo, your descriptions, your schedule and your billing identity (a sole trader's legal name and tax number included) are personal data, and this policy covers them.
3. PP and you are separate, independent controllers. PP controls the data the platform needs to work: your account, your public profile and its place in the search, the bookings and the payment status of each meeting, your occupancy and commission, the closed months and PP's charges, ratings and comments, the chat and the online meetings, the e-mails, and your specialty declarations.
4. You are the controller of your clients' data that you receive in order to work with them and to get paid, and of everything you keep outside the platform. Your obligations as a controller are set out in the terms and conditions for psychotherapists. PP is not your processor and does not act on your instructions; you are not PP's processor either.
5. A person at PP sees your data through the administration panel only where invoicing the commission needs it: PP's charges to you, with their aggregate figures, and your billing identity. Nobody at PP can read the content of your messages.

What we process and why#

Legal bases in short#

1. The contract (Article 6(1)(b) of the GDPR): your profile, your schedule, your products, the bookings, the ratings and the commission are how PP provides its service to you.
2. Legal obligations (Article 6(1)(c)): your billing identity on PP's invoices, and the retention of PP's charges and invoices for the period Polish tax and accounting law requires.
3. PP's legitimate interest (Article 6(1)(f)): keeping the specialty declarations as evidence, keeping the site secure, measuring its use, and the call-quality survey you may answer after an online meeting. You may object to processing on this basis; we will then stop unless we have compelling grounds to continue, such as an ongoing claim.
4. Your occupancy and commission rate are computed automatically from the bookings and the slots you published, and when a month closes a meeting whose payment you have left unmarked counts as paid, by the rules stated in the terms. Every figure, and the meetings behind it, is shown to you on your finances page. You can raise any figure you believe is wrong at contact@psychotherapy.partners.

What is public#

1. Your public profile shows: your name, photo, approach, specialties, languages, short and long descriptions, images with captions, the embedded video, your products with their prices and the practice address of every in-person product, your availability, your age if you disclosed your year of birth, how long you have been on PP, your averages and the number of ratings, the comments you have chosen to show, and your responses signed with your name. Search engines may index it.
2. Never public: your e-mail address, your sex as such (it is a search filter, not a displayed field), your year of birth (only the derived age), your bank accounts, your billing identity, your occupancy, your commission rate, your clients' payments and PP's charges, the authors of comments, and the content of your chats.
3. Your clients see, in the payment instructions of each of their meetings, your bank account for its currency: the account holder, the bank and the IBAN or the other transfer details. They never see your billing identity, and they see your phone number nowhere: PP never asks you for one.

The chat#

1. The chat is a messaging service between you and each client who has booked you, provided by PP. It is not clinical documentation; keep your notes outside the platform, as your own controller.
2. Messages are stored on PP's servers, because that is how they are delivered and how the history is shown to both of you. They are encrypted in transit, but not end to end.
3. Nobody at PP reads the messages. There is no administrative view of message content, and access to the underlying database is limited to technical maintenance and is logged.
4. The e-mail about new messages carries only their number. When either you or the client deletes their account, the conversation is deleted for both.

Online meetings#

1. Online meetings use WebRTC. The two browsers connect directly (peer to peer) with the help of Cloudflare's STUN servers and fall back to a relay through Cloudflare's TURN servers when a direct connection is not possible. Both are used under PP's own Cloudflare account and data processing agreement.
2. The audio and the video are encrypted end to end (DTLS-SRTP); the relay cannot decrypt them and Cloudflare sees only IP addresses and connection times.
3. In a direct connection, each browser learns the other party's IP address. If you would rather not disclose yours to a client, use a VPN.
4. Cloudflare, Inc. is a US company; the transfer relies on its certification under the EU–US Data Privacy Framework, with the standard contractual clauses of its data processing agreement as a fallback.
5. After a call, the video room offers a short, optional survey of the call's quality. If you answer it, your answer is stored with the technical summary of the connection listed above. It contains nothing of what was said or shown; only PP uses it, to improve the calls, and your client never sees it.

Calendar subscription#

1. It is optional and off until you turn it on. In Account settings you can make a secret link that a calendar app of your choice subscribes to — Google Calendar, Apple Calendar, Outlook or any other — so that your booked meetings appear in your own calendar.
2. What the link shows: each of your meetings that has not been cancelled, from the first day of the previous month to the end of the next one, with the name of the service, its start and end, and where it takes place: the link to the online meeting room or the address of your practice. It never shows a client's name, identifier or e-mail address, nor cancellation notes, prices or payments. The room's link opens the room only to you and to your client, each signed in.
3. Your calendar provider receives this data because you choose it. It fetches the link from PP's server and keeps a copy on its own servers, refreshing it on its own schedule. It is your provider, under your own agreement with it, and not PP's processor: you are the controller of the copy it keeps, as of everything else you keep outside the platform (who is responsible for whose data). Its own terms and privacy policy apply; Google, Apple and Microsoft are US companies.
4. Anyone who has the link can see when and where your meetings take place, so keep it to yourself. PP stores only a fingerprint of the link and the date it was made, which is why the link is shown to you only once. Making a new link or turning the subscription off stops the old link at once; a calendar that has already copied your meetings drops them at its next refresh, or keeps its last copy, depending on the app.

Who receives your data#

1. Visitors and clients see your public profile as described above. Your clients additionally receive your bank account for each meeting's currency in its payment instructions, and your cancellation notes and messages in the chat.
2. Processors act only on PP's instructions, each under a data processing agreement (Article 28), and each is either established in the EU/EEA and hosts the data there, or relies on an adequacy decision or the Data Privacy Framework. By category: the hosting and database provider; the e-mail delivery provider, which sees the content of the e-mails it sends, such as payment and refund notices, the warning about unmarked payments and PP's charges; Cloudflare, for the STUN and TURN servers; the map tiles and geocoding provider, which resolves the practice addresses you enter and serves their maps; the error monitoring service; and the analytics tool. We send the current list, with countries, on request to privacy@psychotherapy.partners.
3. PP's accountant and tax advisers receive PP's charges and invoices, which carry a month's aggregate figures only, never a client or a single meeting: PP's accounting records therefore contain your billing identity but no client's health data.
4. YouTube (Google) is a separate controller of the video you embed; it is loaded from youtube-nocookie.com only after a visitor clicks its placeholder.
5. Your calendar provider, if you turn the calendar subscription on: your meetings' times, services and places as described above, received at your choice, as your own provider.
6. Public authorities receive data only where the law obliges us. We never sell personal data.

Cookies, local storage and analytics#

1. PP uses only essential cookies: the session cookie and, only when you choose a language, the cookie remembering the choice. There are no advertising or social-media pixels.
2. Visits are measured with cookieless analytics producing aggregate statistics; the site therefore shows no consent banner. Preferences such as a dismissed warning are kept in your browser's local storage and never leave it.
3. The exchange rates used by the visitors' price filter come from the National Bank of Poland through a server-to-server request that carries no personal data.

How long we keep data#

Your rights#

1. You have the right to access your data, to have it corrected or erased, to restrict its processing, to receive it in a portable form, and to object to processing based on our legitimate interest.
2. Most of it is self-service: everything on your profile is yours to edit or remove on the edit-profile pages; your e-mail address, password, time zone, billing identity and calendar subscription are in Account settings; your optional e-mails in Notification settings; deleting the account is in Account settings too, subject to the money-and-meetings guard described in the terms.
3. For everything else, write to privacy@psychotherapy.partners. We answer within one month; for an unusually complex request we may need up to two more months and will tell you so. Data we must keep by law (PP's charges) or as evidence (the specialty declarations) is kept for the periods above even after an erasure request; we will explain what stays and why.
4. You may lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, https://uodo.gov.pl, or with the authority of the country where you live.

Security#

1. All traffic to PP is encrypted (TLS). Passwords are stored only as hashes; one-time codes are six digits, valid for ten minutes and five attempts. Sessions expire after 30 days.
2. Access to production data is limited to the operator's technical maintenance and is logged. Payment never passes through PP, so PP holds no card or payment data beyond the bank account numbers you give for your clients' transfers.
3. Tell us at privacy@psychotherapy.partners without delay if you suspect that your account has been compromised. Should a breach of your data occur on our side, we notify the supervisory authority within 72 hours where the GDPR requires it, and you directly where the risk to you is high.

Change of operator#

1. Once the platform has grown, a new Polish limited liability company (spółka z ograniczoną odpowiedzialnością) will take over the website and become the controller of your data in the sole trader's place. This policy anticipates the change from the start.
2. You will be informed by e-mail in advance. The purposes, legal bases, recipients and retention periods described here do not change with the operator; PP's invoices from then on are issued by the new operator.

Changes to this policy and contact#

1. We update this policy when the platform or the law changes. Each version carries its date at the top, and substantial changes are announced by e-mail before they take effect.
2. Questions about your data: privacy@psychotherapy.partners. Everything else: contact@psychotherapy.partners. The rules of the partnership are in the terms and conditions for psychotherapists.