Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. General Information on Data Processing

Protecting your personal data is of particular importance to us. We process personal data exclusively in accordance with the applicable data protection laws, in particular the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

This Privacy Policy informs you about which personal data we process when you use our website and app, for which purposes such processing takes place, and which rights you have as a data subject.

2a. Use Restricted to Adults Only

The use of our platform and the services offered is restricted exclusively to adults. Persons under the age of 18 are not permitted to use the platform.

We do not knowingly process any personal data of minors. If we become aware that personal data of a minor has been processed, such data will be deleted without undue delay and the respective user account will be blocked.

3. Categories of Personal Data Processed

Depending on the type and scope of use, we process in particular the following categories of personal data:

Payments are processed exclusively through external certified payment service providers. ThePsy does not have access to complete payment data, such as credit card or bank account numbers, but only to billing-related information.

4. Purposes and Legal Bases of Processing

5. Therapeutic Services and Allocation of Roles

ThePsy provides a technical platform through which users can connect with independently practicing therapists.

• ThePsy is the controller for the processing of personal data related to the operation of the platform.
• Therapists process personal data independently within the scope of their professional activity and are subject to the applicable professional regulations as well as legal confidentiality obligations, for example Section 203 of the German Criminal Code.

Access to therapy-related content is granted only to the assigned therapist and, where necessary, to authorized professionals to the extent required.

6. Confidentiality and Professional Secrecy

All therapeutic content is subject to statutory confidentiality obligations where the professionals involved belong to professions that are legally bound by such obligations. In addition, all therapists are contractually obliged to maintain confidentiality.

This obligation applies regardless of the type of communication used, including chat, audio, or video, and continues to apply even after the end of therapeutic care.

7. Disclosure of Data

Personal data is disclosed only:

• with your explicit consent,
• for the performance of the contractual relationship, or
• on the basis of legal obligations.

Recipients may include in particular:

• Hosting and IT service providers
• Payment service providers
• Providers of communication and video services

All service providers engaged by us are contractually bound to comply with applicable data protection requirements.

8. Transfer of Data to Third Countries

If personal data is transferred to countries outside the European Union or the European Economic Area, this will take place only in compliance with the requirements of Art. 44 et seq. GDPR, in particular on the basis of:

• EU Standard Contractual Clauses, or
• an adequacy decision of the European Commission.

9. Storage Period

Personal data is stored only for as long as necessary for the respective processing purposes or as required by statutory retention obligations.

Health data is deleted or anonymized in a data protection compliant manner after the end of therapeutic care and once statutory retention periods have expired.

10. Rights of Data Subjects

You have the right at any time to:

• obtain information about your stored data (Art. 15 GDPR),
• request rectification of inaccurate data (Art. 16 GDPR),
• request erasure (Art. 17 GDPR),
• request restriction of processing (Art. 18 GDPR),
• receive your data in a portable format (Art. 20 GDPR),
• lodge a complaint with a supervisory authority (Art. 77 GDPR).

11. Withdrawal of Consent

You may withdraw any data protection consent you have given at any time with effect for the future. Such withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Contractual provisions regarding the cancellation of paid services remain unaffected and are governed by the applicable Terms and Conditions.

If consent to the processing of health data is withdrawn, further therapeutic support via the platform will no longer be possible.

12. Data Security

We implement appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorized access, or unlawful disclosure. These measures include, in particular, encryption, access restrictions, and role-based authorization concepts.

13. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy in the event of legal, technical, or organizational changes. The current version is available at any time on our website and in our app.

14. Contact