Privacy Policy

Last updated: 2026-10-08

1. Data controller

The controller of your personal data is the operator of MyTheraSpace: Дигитална Планета ЕООД, UIC 208153950, БЪЛГАРИЯ, гр. София (1303), р-н Възраждане, жк. Сердика, бл. 20, ет. 12, ап. 46. Data protection contact: support@mytheraspace.com.

2. What data we collect

Account — name, email, password (stored as an irreversible hash), language, timezone.
Bookings and sessions — chosen therapist, date/time, status, payment history.
Messages — your correspondence with the therapist through the Platform.
Payments — processed by Stripe; we store only the last 4 digits and card brand, never the full number.
Video sessions — held in real time; we do not record session content.
For therapists — qualifications, verification documents (processed via Stripe Identity/KYC), payout and invoicing data, and payment details (IBAN / Revolut) if they accept payment outside the platform — see section 10.
Technical — IP address, device type, security logs.

3. Why we process it (legal bases)

Contract performance — account, bookings, payments, communication (Art. 6(1)(b) GDPR).
Legal obligations — accounting and invoicing (Art. 6(1)(c)).
Legitimate interest — security, fraud prevention (Art. 6(1)(f)).
Mental-health-related data is a special category — we process it only as necessary for the service you yourself have requested (Art. 9(2)(a) and (h) GDPR).

4. Who we share data with

Your therapist — sees your name, bookings and the messages you send them. If the therapist accepts payment by bank transfer or Revolut, their payment details are shown to you — the client with a booking they have accepted (section 10).
Stripe (payment partner, EU/US under standard contractual clauses) — payment processing and therapist verification. Stripe's policy.
Infrastructure providers — hosting and video service, bound by data processing agreements.
Public authorities — only where legally required.
We do not sell data to third parties. We show no ads.

5. How long we keep it

Account and profile — while the account is active, plus a reasonable period after closure to settle obligations.
Financial documents (invoices) — for the statutory period (up to 10 years under Bulgarian law).
Messages — while the account exists; you can request deletion.

6. Your rights (GDPR)

You have the right of access, rectification, erasure ("right to be forgotten"), restriction, portability and objection. Write to support@mytheraspace.com — we reply within 30 days. You may also lodge a complaint with the Bulgarian DPA (cpdp.bg).

7. Cookies

We use only technically necessary cookies: session (login), language (bg/en) and cookie-consent memory. No third-party advertising or tracking cookies.

8. Security

Encrypted connection (HTTPS/TLS) everywhere, hashed passwords, restricted data access, audit logs of administrative actions.

9. Minors

The Platform supports work with teenagers. For users under 18 we recommend involving a parent/guardian; for children under 14, registration and use require parental/guardian consent under Bulgarian law.

10. Therapists' payment details (IBAN / Revolut)

What we keep — when a therapist accepts payment outside the platform by bank transfer or Revolut, we store the IBAN or Revolut details (@revtag / phone) that they enter in their own profile.
Why — so the client can pay the therapist directly (contract performance, Art. 6(1)(b) GDPR). The platform does not make or process the payment itself.
Who sees them — only the client with a booking the therapist has accepted (on the booking page, in their profile and in the confirmation email). They are not shown publicly, in the directory or on the therapist's public profile.
Control — the therapist can change or remove them at any time from their profile (payment methods). When they are changed we send the therapist an email notice.
How long — while the method is saved in the profile. The therapist can delete them at any time, and they are erased on a data deletion request (section 6). Copies in emails already sent remain with their recipients.

11. Changes

Updates to this policy are announced on this page with a new last-updated date.