Privacy Policy

• Account & billing data: therapist name, email, login credentials, country, subscription status, and billing identifiers from our payment provider (we never see full card numbers).
• Booking data: client name, email, phone (optional), session type, date, and any notes provided at booking.
• Session recordings & transcripts: only when the client has ticked the consent checkbox at booking. Audio is uploaded by the therapist after the session and processed by AI to produce a transcript and summary. These qualify as special-category (health) data under GDPR Art. 9.
• Video sessions: if a video appointment is chosen, the meeting runs over Daily. The video stream is not recorded automatically. Only the therapist's local microphone capture is recorded when consent has been given.
• Technical data: standard server logs (IP, timestamp, user agent) for security and abuse prevention. No analytics or advertising trackers.

• Explicit consent ; Art. 6(1)(a) and Art. 9(2)(a): recording, transcription, and AI summarisation of sessions, which are special-category health data. Consent is given by ticking the consent box at booking and can be withdrawn at any time, without affecting processing already carried out.
• Performance of a contract ; Art. 6(1)(b): creating and managing your account, taking bookings, delivering sessions, and processing subscription payments.
• Legal obligation ; Art. 6(1)(c): tax, invoicing and accounting records for paid subscriptions.
• Legitimate interests ; Art. 6(1)(f): security logging, fraud and abuse prevention, and keeping the service reliable. We balance these against your rights and you may object at any time.
• Health care / professional duty ; Art. 9(2)(h): where a therapist processes clinical records under professional secrecy obligations, they are the controller and rely on this basis.

We never use your personal data for advertising, profiling, or automated decision-making that produces legal effects, and we do not sell personal data.

• Account data: for as long as your account is active, plus up to 12 months after closure for dispute resolution.
• Billing and invoice records: retained for the period required by applicable tax law (typically up to 10 years). This retention is a legal obligation and cannot be shortened by a deletion request.
• Bookings and client contact details: retained while the therapist–client relationship is active, and deleted within 30 days of a valid deletion request.
• Recordings, transcripts and clinical notes: session audio is stored for 1 year from the session date and then automatically deleted; transcripts and notes are retained by your therapist for as long as their professional and national rules require (commonly 5–10 years), then deleted. The therapist decides this period, not Hoist Studio LLC.
• Consent records: kept for the lifetime of the related record plus 3 years, as proof that consent was validly obtained.
• Server and security logs: 90 days.
• Backups: encrypted backups roll off within 30 days, so deleted data can persist in backups for up to that period.

You can request deletion at any time; see Section 8.

• Lovable Cloud / Supabase ; database, authentication, and file storage (EU region).
• Stripe Payments Europe Ltd ; our payment processor for handling subscriptions, invoicing, and card payments. Card details are sent directly to Stripe and are never stored by us.
• Google (Gemini) via the Lovable AI Gateway ; used to transcribe and summarise audio. Audio is sent only for the time needed to produce the transcript and is not used to train models.
• Daily provides the secure video meeting layer.
• Professional advisers and authorities ; only where required by law.

Some sub-processors may process data outside the EU/EEA (for example, AI inference may occur on US-based infrastructure). Where this happens, transfers are protected by Standard Contractual Clauses or equivalent safeguards.

• Access (Art. 15); a copy of the personal data we hold about you and details of how it is used.
• Rectification (Art. 16); correction of inaccurate or incomplete data.
• Erasure / "right to be forgotten" (Art. 17); deletion of your data where it is no longer needed, where you withdraw consent, or where you object and there is no overriding ground. We action valid requests within 30 days; encrypted backups roll off within a further 30 days. We may keep invoices and other records we are legally required to retain, and will tell you if we do.
• Restriction (Art. 18); pause processing while a dispute about accuracy or lawfulness is resolved.
• Data portability (Art. 20); receive your data in a structured, machine-readable format, or have it sent to another provider.
• Objection (Art. 21); object to processing based on legitimate interests.
• Withdraw consent (Art. 7(3)); withdraw recording and transcription consent at any time; future sessions will not be recorded.
• Complain (Art. 77); lodge a complaint with your national data protection authority. In Serbia this is the Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs); in the EU it is the supervisory authority of the country where you live or work.

Exercising these rights is free of charge and we reply within one month (extendable by two months for complex requests, in which case we will tell you). The fastest route is the Delete my data page, or email josh@hoist-studio.com . For clinical records, contact your therapist directly; they are the controller for that content and we will forward any request we receive to them.