Privacy and data use

01

Scope of this Beta

The Beta is for testing with entirely fictional cases only. Do not enter real patient data, actual session transcripts or clinical documents, even with names and contact details replaced. Changing a name does not make a clinical story fictional.

Professionals’ account details, such as name and email, remain personal data even when test cases are synthetic. This draft covers the website and testing, not clinical use with patients.

02

Controller and contact details

Data controller: Graziano Scarascia, operating under the name “Therapoint Forma Mentis Centro di psicologia”.

Professional address: Via Giolitti 4, Tricase (LE). Italian VAT number: 04777680614. Email for enquiries and privacy requests: adminsynaris@gmail.com.

Any appointment of a data protection officer (DPO) still needs to be checked.

The in-app Privacy Center provides information and technical controls. It does not replace a complete privacy notice or a data processing agreement.

03

Data handled by the service

Account and practice: login details, email, practice membership and role support access and permissions. Account verification and recovery messages use the configured email service.

Test content: saved fictional cases, notes and appointments are managed by the backend. Some drafts and transfers between tools are temporary browser data; clearing the browser does not delete content saved on the server.

Browsing and security: delivering the website may involve IP addresses, device information and technical logs processed by infrastructure providers. The application’s AI audit uses technical metadata; it is not a comprehensive audit of every action.

04

Optional AI and external services

When you use an AI feature, the backend sends the text needed for processing to the provider. The practice’s AI policy must be active. Filters reduce identifiers but do not guarantee complete anonymisation or override the ban on real patient data.

Technical documentation identifies Vercel for the frontend, Render for the backend and database, OpenAI for AI processing and Cloudflare for domain/DNS services. The email service and any external feedback tools must be added to the inventory. Contractual recipients, roles, locations and safeguards for any transfers outside the EEA must be verified before publication. Exclusive European storage and zero provider retention are not claimed.

05

Purposes, legal bases and retention

This draft distinguishes account and participation management, delivery of requested features, security and feedback handling. The controller must confirm each purpose’s legal basis, mandatory and optional data, and the consequences of not providing them. Simply browsing the site is not treated as blanket consent.

Retention periods for accounts, test content, AI sessions, logs, feedback and backups are not yet approved in this notice. The code does not provide universal automatic deletion: retention controls require configuration and administrative action. Deletion from the active database does not immediately remove backup copies. Actual periods and criteria must be approved and included before this page is released.

06

Cookies and browser storage

Signing in uses authentication cookies. The browser may store preferences such as theme and language and temporary working data. Closing a tab is not a complete procedure for deleting an account or saved content.

These new information pages add no collection forms, advertising or analytics tools. Hosting-platform behaviour must also be checked before publication: cookie and tracking inventories, durations and purposes must match the deployed website. No consent banner is presented without effective controls behind it.

07

Rights and requests

Where applicable under the GDPR, you may request access, rectification, erasure, restriction and portability, object to processing and withdraw consent without affecting earlier lawful processing. You may complain to the Italian Garante or the competent supervisory authority. To contact the controller about these requests, write to adminsynaris@gmail.com.

Do not send clinical documents, passwords or patient data to explain a problem. Technical practice export and deletion controls do not replace handling requests concerning the professional’s own personal data.