Think Therapy — Privacy Policy

Effective date: 26 August 2026

Think Therapy ("the Service", "we", "us") is a counselling and psychotherapy practice-management and directory web application. Think Therapy is a trading name of Coherence Technical Services Ltd (registered in England and Wales, company number 15030198), 247 Charlton Road, London N9 8HH, United Kingdom. We are the data controller for the personal data described in this policy except where we act as a processor on behalf of a practitioner (see "Practitioners, clients and our role").

Questions, requests or complaints: support@thinktherapy.uk.

1. Summary

• We collect the information you give us when you create an account, set up a practitioner profile, manage clients and appointments, or book with a practitioner.
• If you choose to sign in with Google or connect your Google Calendar, we access a limited set of Google account data with your explicit consent.
• We use this data only to operate the Service — never to sell it, and never for advertising.
• Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements (see Section 5).

2. Who this policy covers

The Service has two kinds of user:

• Practitioners (and their colleagues): counsellors, psychotherapists and practice staff who manage a workspace, profile, availability and clients.
• Clients / prospective clients: people who browse the public directory, view a practitioner's profile, or request/book an appointment.

Practitioners, clients and our role

For a practitioner's own account and practice data, we are the data controller. For the clinical/client records a practitioner keeps within their workspace, the practitioner is the data controller and we act as their data processor, handling that data under their instructions and our terms. We provide the tools; the practitioner decides how they use them with their clients.

3. Information we collect

You give us: - Account details — name, email address, password (stored only as a salted hash), and authentication tokens. - Practitioner profile — display name, photo, biography, modalities, areas covered, qualifications and supporting documents, session types and fees, practice (room) addresses, and public-page settings. - Practice operations — clients' contact details, appointments, bookings, availability, cancellation policies and related notes you enter. - Booking requests — when someone books or enquires via a public page: their name, email, phone, optional address and message.

Billing information. If you subscribe to a paid plan, our payment provider (Stripe) collects and holds your payment-card details. We never receive or store your full card number. We hold only the billing metadata we need to run your subscription — plan and tier, subscription status, billing cycle dates, any discount applied, and a Stripe customer reference.

Collected automatically: - Basic technical data needed to run the app securely (e.g. session/auth tokens, and standard server logs such as IP address and request metadata). - Local browser storage for app state (e.g. your saved directory shortlist and active session) — not advertising cookies.

From Google, only with your consent — see Section 5.

Special-category data. Information about a person's mental health is sensitive ("special category") personal data under UK GDPR. Where the Service is used to record such information, it is processed on the lawful bases set out in Section 7.

4. How we use information

• To create and secure your account and authenticate you.
• To operate the practitioner directory, public profiles and booking pages.
• To manage appointments, availability, room bookings and client records on behalf of practitioners.
• To send transactional emails (e.g. verification, booking confirmations, reschedules, cancellations).
• To take payment for subscriptions and manage billing.
• To synchronise appointments with your Google Calendar, if you connect it.
• To keep the Service secure, debug problems, and meet legal/regulatory obligations (including clinical-record retention expectations for practitioners).

We do not sell personal data, and we do not use it for advertising or to train generalised AI/ML models.

5. Google account data (sign-in and Calendar)

If you choose to use Google, we request only the following, and only with the consent you give on Google's screen:

Sign in with Google — scopes openid, email, profile. We use your Google email, name and profile picture solely to create or sign you into your Think Therapy account and to show you which account you used. We do not receive your Google password.

Connect Google Calendar — scopes openid, email, https://www.googleapis.com/auth/calendar.events, and https://www.googleapis.com/auth/calendar.calendarlist.readonly. With your consent we: - read your list of calendars only so you can choose which calendar to sync to (calendar.calendarlist.readonly); and - create, update and delete the appointment events that Think Therapy itself manages on that calendar (calendar.events), so your practice schedule and your Google Calendar stay in step.

We deliberately do not request access to read the content of your other calendar events, and we do not request the broader full-calendar scope.

Limited Use

Think Therapy's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained through Google sign-in and Google Calendar scopes is used only to provide and improve the user-facing features described above; is not transferred to or sold to third parties except as necessary to provide the Service, for security, or to comply with applicable law; is not used for advertising; and is not used to train generalised/standalone AI or ML models. Humans do not read this data except with your explicit consent, to comply with law, or where necessary for security (e.g. investigating abuse).

Disconnecting

You can disconnect Google Calendar at any time from your profile settings, and you can revoke Think Therapy's access from your Google Account at myaccount.google.com/permissions. Revoking access stops further synchronisation; events already written to your calendar remain unless you delete them.

6. How we share information

We share personal data only with:

• Service providers (sub-processors) who help us run the Service, under contract and only as needed:

  Provider	Purpose	Where
  Hetzner Online GmbH	Cloud hosting, servers and file storage	Germany / Finland (EU)
  Google LLC	Sign-in and Calendar sync, where you enable them	US, with UK/EU safeguards
  Stripe Payments Europe Ltd	Subscription payments and billing	Ireland (EU), with US parent
  ActiveCampaign, LLC (Postmark)	Sending transactional email	US
  HERE Global B.V.	Geocoding practice addresses for the directory's location search	Netherlands (EU)

• Other users, as you direct — e.g. a published practitioner profile and practice location are shown publicly in the directory; a booking request is shared with the practitioner you book.

• Authorities or third parties where required by law, or to protect the rights, safety and security of users and the Service.

We do not sell personal data.

7. Legal bases (UK GDPR / EU GDPR)

• Contract — to provide the Service to you and your workspace, and to take payment for it.
• Consent — for Google sign-in/Calendar access, and for optional features; you may withdraw consent at any time.
• Legitimate interests — to secure the Service, prevent abuse, and operate the public directory.
• Legal obligation — to meet our legal and regulatory duties.
• Special-category data (mental-health information recorded by practitioners) is processed under Article 9 conditions — typically the provision of health/social-care services and/or explicit consent — with the practitioner as controller and us as processor.

8. Retention

• Account and profile data: kept while your account is active and for a reasonable period afterwards, then deleted or anonymised.
• Clinical/client records held by practitioners: retained under the practitioner's instructions and professional obligations (UK regulators generally expect clinical records to be kept for around 7 years).
• Billing records: kept for as long as required by tax and accounting law (generally six years in the UK).
• Google data: tokens and synced-event references are kept only while your Google connection is active; revoking access ends their use.
• Server logs: kept for a limited period for security and debugging.

9. International transfers

Our servers and primary data storage are located in the EU (Hetzner, in Germany and Finland). Some of our sub-processors are established outside the UK/EU, or may route data through countries outside it:

• Google LLC and ActiveCampaign, LLC (Postmark) are US companies.
• Stripe Payments Europe Ltd is established in Ireland, with a US parent company that may process some data.

Where personal data is transferred outside the UK or EEA, we rely on appropriate safeguards — the UK Government's adequacy regulations and the UK Extension to the EU–US Data Privacy Framework where applicable, and otherwise the International Data Transfer Agreement or Standard Contractual Clauses, together with any additional measures required.

10. Security

We protect data with measures appropriate to its sensitivity, including encrypted transport (HTTPS/TLS), hashed passwords, access controls and role-based permissions, and isolation of workspace data. No system is perfectly secure, but we work to protect your information and to respond promptly to any incident.

11. Your rights

Subject to applicable law, you may request access to, correction of, deletion of, or a copy of your personal data, and you may object to or restrict certain processing. To exercise these rights, contact support@thinktherapy.uk. If your data is held by a practitioner as controller (client/clinical records), we will direct your request to them where appropriate.

You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk. Coherence Technical Services Ltd is registered with the ICO under registration number {{ICO_REG_NUMBER}}.

12. Children

The Service is intended for practitioners and adult clients. It is not directed at children, and we do not knowingly create accounts for children. Where a practitioner provides therapy to a young person, that relationship and any consent are managed by the practitioner as controller.

13. Changes to this policy

We may update this policy. If we change how we use Google user data, we will notify affected users and obtain consent to the updated terms before using Google data in any new way. Material changes will be notified in-app or by email.

14. Contact

Coherence Technical Services Ltd (trading as Think Therapy) Company number 15030198 (England and Wales) 247 Charlton Road, London N9 8HH, United Kingdom Email: support@thinktherapy.uk