Privacy Policy

1. Who this policy covers and who is responsible

This Privacy Policy explains how meetNheal (“we”, “us”) handles personal information in the meetNheal service (the “Service”): the website and application used by independent practitioners such as psychotherapists, counselors and coaches (“Practitioners”) to run their practice, and by the people who book and attend sessions with them (“Clients”). It is part of our Terms of Service.

The Service involves two different roles, and who answers to you depends on which one applies:

• Information about the people who use the Service itself: Practitioner accounts and profiles, client-area accounts, visitors to the website, and anyone who contacts us. For this we decide why and how the information is used. In privacy-law terms we are the “controller” or “business”.
• Information a Practitioner keeps about their Clients: contact details, booking answers, appointments, session notes, files, recordings and transcripts. The Practitioner decides what to collect and why; the Practitioner is the party responsible to the Client for it and, if the law applies to them, is the “covered entity”, “controller” or “business”. We process this information only on the Practitioner’s behalf and instructions, to provide the Service to them, as their “processor” or “service provider”. We do not use it for our own purposes, advertising or sale.

This is why a request about a Client record (to see it, correct it or delete it) is normally answered by the Practitioner who holds it. We will help the Practitioner respond, and we will forward a request to the right Practitioner if you tell us who it is.

2. HIPAA and health information

Session notes, intake answers and recordings can contain information about a person’s mental or physical health. Whether the federal Health Insurance Portability and Accountability Act (HIPAA) applies to a Practitioner depends on that Practitioner’s own circumstances, for example whether they conduct certain electronic transactions, such as billing health insurers.

A Practitioner who is a HIPAA covered entity (or a business associate of one) generally needs a signed BAA with a vendor that stores or handles protected health information on their behalf. Because we do not offer a BAA, such a Practitioner should not enter protected health information into the Service unless HIPAA, and their own compliance advisers, allow it; that decision and the responsibility for it are theirs. If we begin to offer a BAA, we will say so here, and it will apply only to customers who sign it.

We protect the information we host with the safeguards described under “How we protect information”. Those safeguards are not a substitute for a Practitioner’s own compliance with HIPAA, state health-privacy law, or their professional ethics rules, and they are not a promise of HIPAA compliance.

3. Information we collect

The table lists what we collect and process, where it comes from, and what it is used for. We collect only what the Service needs. We do not create profiles of people or infer characteristics about them, we do not collect precise geolocation from devices, and we do not run advertising or analytics trackers.

Sensitive personal information

Under California law, health information and account log-in credentials are “sensitive personal information”. We use them only to provide the Service you or your Practitioner asked for, to keep it secure, and to meet legal obligations. We do not use sensitive personal information to infer characteristics about you, and we do not use or disclose it for any purpose that would give you a right to limit it.

4. How we use information

• To provide, operate and maintain the Service: accounts, booking pages, scheduling, reminders, client records, video sessions, payment status.
• To send service messages: booking confirmations, reminders, security notices, and notices about changes to the Service or our policies.
• To keep the Service secure, prevent fraud and abuse, rate-limit requests, and investigate incidents.
• To respond to you and to requests to exercise your privacy rights.
• To comply with the law and to establish, exercise or defend legal claims.
• To improve reliability and fix defects, using logs and aggregate technical measurements and not the contents of client records.

We do not sell personal information. We do not share it for cross-context behavioral advertising. We have not sold or shared personal information in the preceding twelve months. We do not show ads. We do not use the contents of Client records, notes, recordings or transcripts to train models or to market anything.

5. Who receives information

We disclose information only to the service providers and parties below, and only the information each needs. The Service runs on infrastructure that we operate ourselves: the application servers, databases and the stored files (including session recordings) are on our own servers, and video sessions run on video software that we host. We do not use a third-party cloud storage provider or a third-party video provider.

We also disclose information:

• to the Practitioner whose Client you are, and to the Clients and Practitioners who take part in a session or booking with you;
• when the law requires it, in response to valid legal process, or to protect the rights, safety or property of people or the Service;
• to a successor, if the Service is merged, acquired or sold, with notice to you and subject to this policy;
• with your direction or consent.

If we add a provider that receives personal information, for example another messaging channel, we will update this list before the provider begins to receive it.

6. Google user data

A Practitioner may connect their Google Calendar to the Service. If they do, Google asks them to approve these permissions, and we use them only for the purposes below:

• View calendars (calendar.readonly): to read the times when the Practitioner is busy, so that Clients cannot book over them. We store the busy time intervals, not event titles, descriptions or attendees.
• Manage events (calendar.events): to create, update and remove an entry on the Practitioner’s calendar for each booked appointment. The entry contains the time and an internal booking reference, and not the Client’s name or contact details.

meetNheal’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data only to provide and improve the calendar features the Practitioner requested; we do not transfer it to others except as needed to provide those features, to comply with law, or as part of a merger or sale with notice; we do not use it for advertising, including retargeting or interest-based ads; we do not sell it; and no person at meetNheal reads it unless the Practitioner asks us to, it is needed for security or to investigate abuse, the law requires it, or it is aggregated and de-identified for internal operations.

A Practitioner can disconnect Google Calendar at any time in the Service’s settings, and can also revoke access at myaccount.google.com/permissions. Disconnecting stops any further reading from, or writing to, the calendar.

7. Where information is processed

The Service’s servers are located in the Russian Federation, so personal information of users in the United States is transferred to, stored in and processed in Russia. Some providers listed above process information in the United States (OpenAI, Google) or in Russia (Rusender, YooKassa, Yandex). By using the Service you understand that your information will be transferred to and processed in those countries, whose data-protection laws may differ from those where you live, and which may allow public authorities to obtain access to information in circumstances their law provides for.

We do not control a Practitioner’s decisions about where and how they use the Service. A Practitioner who is subject to a law that restricts storing or transferring client information outside the United States must take that into account.

8. How long we keep information

When a Practitioner deletes a client record or their account, some items (for example session notes, transcripts, payment records and consent records) may be kept for a limited time in detached, encrypted or de-identified form where the law, a Practitioner’s record-keeping duties, fraud prevention or the defense of legal claims calls for it. We keep information for no longer than the purpose or the law needs.

9. Your choices and rights

• Practitioners can export the data of their account as a file, correct their profile, take their profile off public view, disconnect a calendar or payment account, and request deletion of their account, all in the Service’s settings.
• Clients can ask their Practitioner to show, correct or delete what the Practitioner holds about them. A Client who has a verified client-area account can also ask us for a copy of the data that account links to, or to delete the account.
• Consent. Where we rely on your consent (for example to a session recording or to an optional newsletter from a Practitioner), you can decline it, and you can withdraw it at any time; the booking form’s optional checkbox is unchecked by default. Withdrawing does not affect what was done before.
• Email. We send service messages (confirmations, reminders, security notices). We do not send our own marketing email.
• Do Not Track and Global Privacy Control. We do not track you across sites and do not sell or share personal information, so there is nothing for these signals to switch off, and we treat a Global Privacy Control signal as an opt-out request where one applies.

Our dedicated email address for privacy requests has not been published yet. It will be listed here and in the operator details of the Terms of Service as soon as it is, and requests can be submitted from that point.

We may need to confirm that a request really comes from you before we act on it, for example by asking you to reply from the email address registered to the account. We will not discriminate against you for exercising a privacy right.

10. California residents (CCPA/CPRA)

This section applies to residents of California, and supplements the rest of this policy, to the extent the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the “CCPA”) applies. The tables above are our notice at collection: they list the categories of personal information we collect, their sources, why we collect them, and the categories of recipients. Sections on retention say how long we keep each category.

Your rights

• Know and access the categories and specific pieces of personal information we hold about you, the sources, the purposes, and the categories of recipients.
• Delete personal information we collected from you, subject to exceptions the law allows.
• Correct inaccurate personal information.
• Opt out of sale or sharing, and limit the use of sensitive personal information. We do not sell or share personal information and we use sensitive personal information only for the purposes the CCPA permits without a right to limit, so there is nothing to opt out of.
• Non-discrimination: we will not deny you the Service, charge you different prices, or give you a different quality of service for exercising these rights.

Disclosures in the past twelve months

In the preceding twelve months we collected the categories listed in “Information we collect”. We disclosed identifiers, commercial information, internet activity and, where a Practitioner uses the features, audio information and health information to the service providers listed under “Who receives information”, for the business purposes of providing the Service, security, and fulfilling the Practitioner’s instructions. We did not sell personal information and did not share it for cross-context behavioral advertising, and we have no actual knowledge of selling or sharing the personal information of anyone under 16.

How to make a request

Use the contact in the section “Contact and operator details” below. You may use an authorized agent; we may ask for proof of the agent’s authority and ask you to verify your identity directly. We respond within 45 days and may extend once by a further 45 days with notice. There is no charge for a reasonable request. Where the information is held for a Practitioner (a Client record), we act as their service provider and will direct or help you to make the request to the Practitioner.

California’s “Shine the Light” law (Civil Code §1798.83) lets California residents ask which personal information a business disclosed to third parties for their direct marketing. We make no such disclosures.

11. Residents of other U.S. states

Depending on where you live (for example Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states with comprehensive privacy laws), you may have the right to confirm whether we process your personal information and to access it; to correct inaccuracies; to delete it; to obtain a portable copy; and to opt out of targeted advertising, sale of personal data, and profiling that has significant effects. We do none of those last three. To exercise a right, use the contact below.

We respond within the period your state’s law sets, generally 45 days, and may extend it as the law allows. If we decline to act on your request you may appeal by replying to our decision and asking us to reconsider; we will answer the appeal in writing, within the period your state’s law sets, and explain the reason if we uphold our decision. If you are still not satisfied you may contact your state attorney general.

Consumer health data

Some states (for example Washington, under its My Health My Data Act, and Nevada) have rules on “consumer health data”. To the extent that law applies to information in the Service: we collect and use health-related information only to provide the Service you or your Practitioner requested; we do not sell it and do not share it with anyone for advertising; the only recipients are the service providers needed to run the Service and listed in this policy; and you can ask us to access or delete it, and withdraw consent, using the contact below.

12. Children

The Service is not directed to children under 13, and accounts are for people 18 and older. We do not knowingly collect personal information directly from a child under 13. If we learn that a child under 13 has created an account or sent us personal information, we will delete it. If you believe this has happened, contact us using the details below.

A Practitioner who works with a minor, with the consent of a parent or guardian, may record information about that minor in their client record. That record is the Practitioner’s: the Practitioner is responsible for obtaining any parental consent the law requires (including verifiable parental consent where the Children’s Online Privacy Protection Act applies to them), and we process it only on the Practitioner’s behalf.

13. How we protect information

• Connections to the Service are encrypted in transit with HTTPS.
• Passwords are stored only as one-way hashes.
• Session notes, transcripts, Clients’ contact details and booking-form answers are encrypted at rest in the database, and uploaded files and recordings are kept in storage that is not publicly accessible and is served only to signed-in, authorized users.
• Access is limited by role: a Practitioner sees only their own Clients, and a Client sees only their own bookings. Access to client records and sign-in events are written to an audit log.
• Requests are rate-limited, and the booking and sign-in forms use bot protection.

No system is perfectly secure. If a security incident affects your personal information we will notify you and the authorities as the law requires.

14. Cookies and similar technologies

We use only the cookies and browser storage that the Service needs to work. We do not use advertising, analytics or tracking cookies, and we do not load third-party advertising or analytics scripts.

The booking and sign-in forms load a bot-protection script from Yandex SmartCaptcha. That script is run by Yandex, and may collect technical data about your browser and how you interact with the check, and set its own storage, under Yandex’s own terms. You can block cookies in your browser settings, but sign-in and booking will not work without the ones listed above.

15. Changes to this policy

We will post any updated version here with a new “Last updated” date. For material changes we will notify account holders by email or in the Service before they take effect, and where the law requires your consent to a new use, we will ask for it first. We keep earlier versions and will give you one on request.

16. Contact and operator details

Our dedicated email address for privacy questions and requests has not been published yet. It will be listed here and in the operator details of the Terms of Service as soon as it is, and requests can be submitted from that point.