The controller responsible for your personal data is:

For questions about data protection, please contact us at [email protected].

2.1 Account information

• Personal identifiers: name, email address, phone number
• Profile information: display name, date of birth, timezone, profile picture
• Authentication: password (encrypted), sign-in times
• Account type: whether you are registered as a client or a therapist

2.2 Professional information (therapists)

• Professional qualifications and licences
• Biography and areas of specialisation
• Hourly rate and availability
• Languages spoken
• Years of experience

2.3 Session and health data (clients)

• Booking information and session history
• Therapeutic concerns and goals (as declared by you)
• Session notes (where enabled by the therapist)
• Messages between clients and therapists

2.4 Payment information

• Payment method details (processed by Stripe and not stored by us)
• Transaction history and amounts
• Billing address
• Tax/VAT identification number (where applicable)

2.5 Technical data

• IP address and location data
• Browser type and version
• Device information
• Cookies and similar technologies
• Usage analytics and interaction patterns

We process your data on the following legal bases (Article 6 GDPR):

• Performance of a contract (Art. 6(1)(b)): processing necessary to provide the therapy marketplace, bookings and payments.
• Consent (Art. 6(1)(a) and Art. 9(2)(a)): processing of health-related data, marketing communications and optional features.
• Legal obligation (Art. 6(1)(c)): compliance with tax law, retention of financial records and regulatory requirements.
• Legitimate interests (Art. 6(1)(f)): fraud prevention, security, platform improvement and analytics.

Special category health data, Article 9 GDPR

• Health-related data (session notes, therapeutic goals, mental-health concerns) is a special category under Article 9 GDPR and is subject to stricter protection.
• We process this data exclusively on the basis of Article 9(2)(a), that is your explicit consent, given freely, specifically, on an informed basis and unambiguously.
• This consent is obtained through a separate checkbox at registration, before any such processing takes place.
• You may withdraw your consent at any time by emailing [email protected]. Withdrawing consent may limit your ability to use certain features of the platform.
• Health data is never shared with third parties except as described in section 5 of this policy.

• Providing the service: facilitating bookings, sessions and communication
• Payment processing: handling payments, refunds and invoicing
• Account management: authentication, profile updates, settings
• Communication: booking confirmations, reminders, support messages
• Platform improvement: analytics, debugging, feature development
• Compliance: legal requirements, tax reporting, fraud prevention
• Marketing: newsletters and promotional emails (with your consent)

We share your data only with the following categories of recipient:

5.1 Essential service providers

5.2 Legal requirements

We may disclose your data where required by law, court order or a regulatory authority.

5.3 Business transfer

In the event of a merger, acquisition or sale of assets, your data may be transferred to the new entity (you will be notified in advance).

Your data is primarily stored and processed within the European Economic Area (EEA). Where we transfer data outside the EEA, we ensure an adequate level of protection through:

• Standard Contractual Clauses (SCC): data transfer agreements approved by the European Union
• Adequacy decisions: countries the EU has recognised as providing adequate protection
• Appropriate safeguards: technical and organisational security measures

We retain your data for different periods depending on the type of data and legal requirements:

You have the following rights in relation to your personal data:

• Right of access: request a copy of all data we hold about you
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure: request deletion of your data (the "right to be forgotten")
• Right to data portability: receive your data in a machine-readable format
• Right to restriction of processing: limit how we use your data
• Right to object: object to processing for specified purposes
• Right to withdraw consent: withdraw consent at any time
• Right to lodge a complaint: complain to a supervisory authority

How to exercise your rights

• Go to your account settings to export or delete your data
• Email us at [email protected]
• We will respond within 30 days (or 3 months for complex requests)

We apply industry-standard security measures to protect your data:

• Encryption: TLS/SSL for data in transit and AES-256 for data at rest
• Access control: role-based access, multi-factor authentication
• Security audits: regular penetration testing and vulnerability scanning
• Staff training: GDPR and data protection training for all staff
• Incident response: data breach notification protocol within 72 hours
• Secure hosting: servers located in the European Union with ISO 27001 certification

Our services are not intended for people under 16. We do not knowingly collect personal data from children under 16. If we become aware that a child under 16 has provided us with personal data, we will delete it immediately.

If you are a parent or guardian and believe your child has provided personal data, please contact us at [email protected].

We use cookies and similar technologies. For details, please see our Cookie Policy.

11.1 Microsoft Clarity

We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website through behavioural metrics, heatmaps and session replay, in order to improve our products and services. Website usage data is collected using first- and third-party cookies and other tracking technologies. We also use this information for site optimisation, security and fraud-prevention purposes, and advertising.

For more information about how Microsoft collects and uses your data, see the Microsoft Privacy Statement.

11.2 Google Analytics

We use Google Analytics to analyse website traffic and usage patterns. It collects information about how visitors use our site, including pages visited, time spent on pages and referral sources.

For more information about how Google collects and uses your data, see the Google Privacy Policy.

We may update this privacy policy from time to time. Material changes will be announced by email or by a prominent notice on our platform. Continued use of our services after changes take effect constitutes acceptance of the updated policy.

You have the right to lodge a complaint with the Austrian data protection authority:

For any privacy-related question, or to exercise your rights, contact us: