TherapyTherapyPropela Therapy processes two very different kinds of personal data: data about practices and their staff (where we are the controller) and client/patient data inside a practice's account (where the practice is the controller and we are a processor under Art. 28 GDPR). This policy covers both.
Everything a practice stores about its clients — contact details, appointments, session recordings, transcripts, notes, treatment plans, questionnaire answers, messages, and documents. We process this data exclusively on the practice's instructions, under a Data Processing Agreement available to every customer.
Production data is stored in the EU (Frankfurt) with our hosting and database sub-processors. Session recordings and secure messages are encrypted at rest with keys we manage separately from the database. AI processing (transcription and note drafting) is performed by our AI sub-processors under agreements that prohibit training on your data.
Practice owners can export or erase any client's data (or the entire practice) from the app at any time. Individuals can direct access, rectification, and erasure requests to their practice — or to us at felipedafig@gmail.com and we will assist the practice in responding within the GDPR's timelines.
Account data is kept while the subscription is active and deleted within 30 days of account deletion. Client data is retained according to the practice's own clinical retention obligations and removed immediately when the practice erases it.
Propela · felipedafig@gmail.com. You may also lodge a complaint with your supervisory authority (in the Netherlands: Autoriteit Persoonsgegevens).