Privacy Policy

TheraSynced ("Platform", "we", "us") is operated by TheraSynced, a company established in Ireland. The Platform is a digital marketplace connecting clients with independent wellness and therapy professionals.

The Platform provides technical infrastructure only. It does not provide healthcare services, therapy, medical advice, diagnosis, or treatment of any kind.

For the purposes of the General Data Protection Regulation (GDPR):

• We act as a Data Controller for account management, bookings, payments, platform security, and compliance.
• We act as a Data Processor for in-platform communications on behalf of freelancers.
• Freelancers act as independent Data Controllers for any health or clinical data exchanged with clients.
• Nothing in this policy creates a joint controller relationship between TheraSynced and freelancers.

Account Data

Name, email address, password hash, and account role (client or freelancer).

Booking & Payment Data

Session booking records, service type, session date and location, and booking status. All payments are processed by Stripe, Inc., a PCI DSS Level 1 certified processor. Card details are collected directly by Stripe and never transmitted to or stored on our servers. We only receive a tokenised reference, last four digits, card brand, expiry date, and transaction status.

Legal basis: Article 6(1)(b) GDPR (performance of a contract) · Article 6(1)(c) GDPR (legal obligation)

Platform Usage & Security Data

Login timestamps, device and browser metadata, IP address, audit logs, and fraud prevention signals.

In-Platform Communications

Messages exchanged between clients and freelancers via the Platform.

Special Category (Health) Data

Communications may contain health-related information where users choose to share it. The Platform processes this solely as a data processor on behalf of freelancers and does not access, analyse, profile, or use message content for any commercial purpose.

Legal basis: Article 9(2)(a) GDPR (explicit consent) · Article 6(1)(b) GDPR (performance of a contract)

Before accessing in-platform messaging, users must provide explicit consent to the processing of any health-related data they share. Consent is recorded with a timestamp and account identifier.

Users may withdraw consent at any time through account settings. Withdrawal disables in-platform messaging but does not affect the lawfulness of prior processing.

• Account and booking records are retained for up to 7 years in accordance with Irish legal obligations.
• In-platform communications are retained for 24 months by default, unless a longer period is required for dispute resolution or legal compliance.
• Platform security and audit logs are retained for up to 24 months.

• Freelancers: as independent data controllers for health and therapeutic data exchanged during bookings and messaging.
• Stripe, Inc.: payment processing and fraud prevention. PCI DSS Level 1 certified and GDPR-compliant. stripe.com/privacy
• Infrastructure providers: GDPR-compliant providers for hosting, security, email, and file storage.
• Regulators or authorities: where legally required by Irish or EU law.

Personal data is never sold, shared for advertising, or used for behavioural profiling.

Where personal data is processed outside the European Economic Area, appropriate safeguards such as Standard Contractual Clauses are in place.

Under GDPR you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data (right to be forgotten)
• Restrict or object to processing
• Request data portability
• Withdraw consent at any time
• Lodge a complaint with the Irish Data Protection Commission

For privacy queries or to exercise your rights: