WE AREPSYCHO
ES·en
HomeProgramsResourcesWho We ArePricingBlog
Already a Psycho (Sign In)Book Now

PSYCHO PRIVACY POLICY

Last updated: August 2, 2026

1. INTRODUCTION

We Are Psycho, S.L. (hereinafter "Psycho", "we", "us" or "our"), with registered office at C. Lepant, 270, 08013 Barcelona, registered in the Barcelona Commercial Registry with Tax ID B21836408, and email address info@wearepsycho.com, as the data controller, is committed to protecting and respecting your privacy.

This Privacy Policy sets out the basis on which we process any personal data we collect from you or that you provide to us through our online therapy platform. Please read this document carefully to understand our practices regarding your personal data and how we will treat it.

2. LEGAL FRAMEWORK

Our Privacy Policy has been designed in accordance with:

  • The General Data Protection Regulation (EU) 2016/679 (GDPR)
  • Organic Law 3/2018, of December 5, on Personal Data Protection and guarantee of digital rights (LOPDGDD)
  • Law 41/2002, of November 14, regulating patient autonomy and rights and obligations regarding clinical information and documentation
  • The Code of Ethics of the General Council of Official Colleges of Psychologists
  • Other applicable regulations on data protection and healthcare

3. INFORMATION WE COLLECT

3.1 Personal Data

Identification and Contact Data

  • Full name
  • Email address
  • Date of birth (when you provide it, for example when managing a minor's account)
  • Region and language preference
  • Image and voice during video calls (transmitted in real time and never recorded or stored)

Health Data

  • The reason for consultation and concerns you share when registering
  • Clinical notes written by your professional (stored encrypted)
  • Session summaries generated to support your professional (subject to the same restricted access as your clinical notes)
  • Temporary session transcripts, only if you have given your explicit consent (see section 6.5)
  • Appointment history

Financial and Billing Data

  • Your card details are processed directly by our payment provider; Psycho does not store card numbers
  • Transaction history
  • Data necessary for invoice issuance

Account Data

  • Login credentials, managed by our identity provider
  • Configuration preferences (language, timezone, theme)

Professionals' Data

If you are a psychology professional at Psycho, we also process:

  • Professional registration or licensing data
  • Fiscal and banking data needed to settle your fees (tax ID, fiscal address, bank account)
  • Your public profile (photo, biography, presentation video)
  • If you connect your Google Calendar: your busy periods and your list of calendars (see section 9.2)

3.2 Usage and Technical Data

  • IP address
  • Browser type, operating system and device
  • Access date and time
  • Pages visited and features used

4. HOW WE COLLECT YOUR DATA

We collect your personal data through:

  • Direct registration: When you register on our platform and create an account.
  • Forms: When completing questionnaires or contact and admission forms.
  • Therapy sessions: During psychological consultations through our platform.
  • Communications: Through emails or messages on the platform.
  • Platform usage: Through cookies and similar technologies, according to your consent preferences.
  • Payments: When you make transactions through our platform.

5. LEGAL BASIS FOR PROCESSING

We process your personal data based on the following legal grounds:

  • Contract execution: Processing is necessary for the execution of the therapeutic services contract to which you are a party.
  • Explicit consent: For processing health data and other sensitive data, we request your explicit consent. You can withdraw it at any time.
  • Legal obligations: To comply with healthcare, tax, and other legal obligations.
  • Legitimate interest: To improve our services, ensure platform security, and prevent fraud, provided this interest does not override your fundamental rights.
  • Vital interest: In exceptional situations where processing is necessary to protect vital interests of the data subject or another natural person (e.g., vital risk situations).

6. PURPOSES OF PROCESSING

We use your personal data to:

6.1 Provision of Therapeutic Services

  • Facilitate online psychological therapy sessions
  • Help you find the right professional according to your preferences
  • Monitor your therapeutic process
  • Maintain an updated clinical history

6.2 Administrative Management

  • Manage your account and profile
  • Schedule and remind appointments
  • Process payments and issue invoices
  • Respond to your queries and requests

6.3 Service Improvement

  • Analyze and improve the quality and effectiveness of our services
  • Conduct anonymized statistical studies
  • Resolve technical issues

6.4 Security and Legal Compliance

  • Protect platform security
  • Prevent fraudulent activities
  • Comply with legal obligations and judicial requirements

6.5 Tools that Support Your Professional

  • Session transcription (only with your consent). If you accept, the audio of your sessions is automatically transcribed in real time to help your professional with their clinical notes. Audio is never stored. The transcript is kept briefly to generate a session summary and is then automatically deleted. The summary is stored with your clinical notes and is accessible only to the professionals involved in your care and to Psycho's clinical director as part of their supervisory role, always under the duty of confidentiality. You can withdraw this consent at any time from your account, without affecting your access to therapy.
  • Summaries and session preparation. To generate these summaries and help the professional prepare their sessions, we use artificial intelligence providers (see section 9.1), which process this data solely to provide this service to us.

7. DATA RETENTION

We retain your personal data for the time strictly necessary to fulfill the purposes for which it was collected, including compliance with legal, accounting, or reporting requirements.

Specific retention periods:

  • Health data and clinical documentation: At least 5 years from the discharge date of each care process, in accordance with Law 41/2002 (some autonomous communities may establish longer periods).
  • Session transcripts: Automatically deleted once the session summary has been generated and, in any case, within 24 hours after the session. Audio is never stored.
  • Billing data: 6 years, according to tax and commercial legislation.
  • User and account data: As long as you maintain an active account on our platform and don't request its deletion.

Once these periods have elapsed, your data will be securely deleted or anonymized, unless there is a legal obligation to retain it for longer.

8. SECURITY MEASURES

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

  • TLS encryption for all communications with our platform, including video calls
  • Additional encryption of stored clinical notes and session summaries
  • Primary database hosted in the European Union
  • Strict role-based access controls
  • Regular backups
  • Continuous review of our security measures and a security incident response plan

9. DATA SHARING

We do not sell or rent your personal data. We only share it in the following circumstances:

9.1 Service Providers

We work with a small number of providers that help us operate the platform. Each one processes only the data necessary to perform its function, under data processing agreements with confidentiality obligations:

  • Clerk — identity and access management (sign-in)
  • Convex — application database (hosted in the European Union)
  • Vercel — web hosting
  • Stripe — payment processing
  • Postmark — transactional email delivery
  • Daily.co — video call infrastructure
  • Deepgram — session transcription (through Daily.co and only with your consent)
  • Ollama Cloud — generation of session summaries and AI-based tools that support the professional
  • PostHog — product analytics (hosted in the European Union)
  • Sentry — technical error monitoring
  • Cloudflare — video content delivery (presentation videos and resources)
  • Google — calendar integration for professionals (see 9.2) and, only if you accept marketing cookies, advertising measurement

9.2 Google Calendar Integration (Professionals)

Professionals can voluntarily connect their Google Calendar so that their availability on Psycho reflects their personal schedule. This integration is read-only and limited: we only check busy periods and the list of calendars; we never read the content of events (titles, descriptions or attendees). The professional can disconnect it at any time and, when they do, we revoke and delete the access permissions.

9.3 Legal Obligations

We may disclose your data when required by law, judicial process, or government request, including:

  • In response to a court or administrative order
  • To comply with legal or regulatory requirements
  • To protect our legal rights

9.4 Special Situations in the Therapeutic Context

In exceptional circumstances, we may share limited information:

  • In case of imminent risk of serious harm to you or third parties
  • With other health professionals involved in your treatment, always with your prior consent
  • With legal guardians in case of minors, respecting the principle of the best interest of the minor

9.5 International Transfers

Our primary database and analytics are hosted in the European Union. Some of the providers listed in section 9.1 are established in the United States or may process data outside the European Economic Area. When this happens, the transfer relies on valid safeguards under the GDPR:

  • European Commission adequacy decisions, including the EU–US Data Privacy Framework for certified providers
  • Standard contractual clauses approved by the European Commission
  • Minimization of shared data: each provider receives only what is necessary for its function

10. YOUR RIGHTS

Under data protection regulations, you have the following rights:

10.1 Data Protection Rights

  • Access: Right to obtain confirmation about whether we are processing your personal data and, if so, access it.
  • Rectification: Right to request correction of inaccurate or incomplete data.
  • Erasure ("right to be forgotten"): Right to request deletion of your personal data in certain circumstances.
  • Restriction of processing: Right to request restriction of processing your data in certain circumstances.
  • Object: Right to object to processing of your data for reasons related to your particular situation.
  • Portability: Right to receive your data in a structured, commonly used and machine-readable format, and to transmit it to another controller.

10.2 Specific Rights in Healthcare

  • Right to confidentiality of your health data
  • Right to be informed about your psychological health status
  • Right to receive a clinical report if requested
  • Right to designate persons linked to you for family or factual reasons to receive information about your health (requires express authorization)

10.3 How to Exercise Your Rights

You can exercise your rights by sending a request to:

  • Email: dpd@wearepsycho.com

To protect your privacy, we may request additional information to verify your identity before processing your request.

We will respond to your request within a maximum period of one month, which may be extended by two more months in cases of special complexity, informing you of such extension.

10.4 Right to File a Complaint

If you consider that the processing of your personal data infringes data protection regulations, you have the right to file a complaint with:

  • Our data protection contact: dpd@wearepsycho.com
  • The Spanish Data Protection Agency (www.aepd.es)

11. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar technologies according to the preferences you express in the consent banner. For more information, please see our Cookie Policy.

12. MINORS

Our platform may offer services to minors (under 18 years of age) only under the following conditions, in accordance with current Spanish legislation:

  • For minors under 14 years of age: Only with the express and verifiable consent of parents or legal guardians, as established in article 7.1 of Organic Law 3/2018 on Personal Data Protection and guarantee of digital rights (LOPDGDD).

  • For minors between 14 and 18 years of age: They may consent to the processing of their personal data on their own, in accordance with article 7.1 of the LOPDGDD. Contracting the service, however, remains with their parents or legal guardians, as established in our Terms and Conditions. In the therapeutic context we also encourage the participation of parents or guardians when beneficial for the treatment, following the guidelines of Law 41/2002 regulating patient autonomy.

The professional will assess in each case the maturity of the minor between 14-18 years of age and, in exceptional situations of serious health risk, may require the additional consent of parents or legal guardians, in accordance with the best interest of the minor enshrined in Organic Law 1/1996 on the Legal Protection of Minors.

We apply additional protections for minors' data and always respect the best interest of the minor, as required by Spanish and European data protection regulations.

13. DATA PROTECTION CONTACT

We have set up a dedicated point of contact for any matter related to the protection of your data:

  • Email: dpd@wearepsycho.com

14. CHANGES TO OUR PRIVACY POLICY

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date at the top of this policy and, in case of significant changes, we will notify you through a prominent notice on our platform or via email before the changes take effect.

We encourage you to periodically review this Privacy Policy to be informed about how we protect your data.

15. CONTACT

If you have questions or comments about this Privacy Policy or about how we treat your personal data, please contact us:

  • Company name: We Are Psycho, S.L.
  • Email: info@wearepsycho.com

By using our platform, you confirm that you have read and understood this Privacy Policy and our Terms and Conditions.