Privacy policy
Last updated 5 October 2026. Questions: hello@usesessio.com
1. Who we are and what this policy covers
Sessio is practice software for psychologists and therapists, run from Warsaw, Poland. This policy explains how personal data is handled on usesessio.com, app.usesessio.com and in emails we send.
There are two different roles, and it matters which one applies to you:
- For therapists who use Sessio, visitors to our website and people who join our waitlist or webinars, Sessio is the data controller.
- For clients of a therapist (people who book sessions), the therapist is the controller. Sessio processes that data only on the therapist's behalf and on their instructions, under a data processing agreement (Art. 28 GDPR). Questions about your therapy data should go to your therapist first; we will help them answer.
2. What data we process, why, and on what legal basis
Website visitors
Technical data needed to deliver pages (IP address, browser, requested page) in short-lived server logs. No analytics or advertising trackers.
Legitimate interest in running a secure website (Art. 6(1)(f))
Waitlist and webinar sign-ups
Email address and which form you used.
Your consent (Art. 6(1)(a)); withdraw any time
Therapists (account holders)
Name, email, sign-in details, practice details (title, city, bio, photo, address, prices, hours, languages), Stripe account status, subscription and support messages.
Performing our contract with you (Art. 6(1)(b)); legal obligations such as accounting (Art. 6(1)(c))
Clients of therapists (processed for the therapist)
Name, email, optional phone and note, bookings, payment status, accepted agreement version, messages, the records the therapist writes, and the identification data the Psychologist Act requires in documentation (date of birth, PESEL or ID document number, address; a legal guardian's details for minors). Clients can enter these themselves in their account.
The therapist's legal basis as controller; health data under Art. 9(2)(h) GDPR
Everyone who writes to us
Your message and contact details.
Legitimate interest in answering you (Art. 6(1)(f))
3. What we never do
- We never record therapy sessions. Video, audio and in-session chat travel directly between the two participants' browsers, encrypted, and are not stored anywhere.
- We never upload voice memos. They are transcribed in the therapist's browser and discarded.
- We never sell personal data, never use it for advertising, and never use clients' records to train AI models.
- Our AI never diagnoses or recommends treatment. Before a therapist's dictation is sent for formatting, names and contact details are replaced on their device. The booking assistant receives only the text a client types, never their name or email.
4. Who processes data for us
We use a small number of providers, each under a data processing agreement. Data is stored in the European Union.
Supabase (database, sign-in)
Stores accounts, bookings, messages and records.
EU — Ireland
Vercel (hosting)
Serves the website and app; runs server code.
EU — Dublin region
Stripe (payments)
Processes client payments directly into the therapist's own account. Card and bank details are entered only on Stripe's pages.
EU entity; Stripe's own privacy policy applies to payment data
Resend (email)
Sends booking confirmations, reminders and replies.
Sends from the EU (Ireland) region
Anthropic (AI formatting)
Formats a therapist's de-identified dictation into a draft record, when the therapist uses that feature.
Provider in the USA, under Standard Contractual Clauses; inputs are not used to train models
Anthropic (booking assistant)
Answers practical questions typed on a therapist's booking page or in the client portal — prices, free times, how sessions work. Only the message text and the therapist's public page details are sent; never the client's name or email.
Provider in the USA, under Standard Contractual Clauses; inputs are not used to train models
Google (sign-in, connection setup)
“Continue with Google” sign-in, and public STUN servers that help two browsers find a direct route for video.
Google sign-in sees your Google account email; STUN servers see only network addresses
5. How long we keep data
- Waitlist and webinar sign-ups: until you unsubscribe or ask us to delete them, and at most 24 months after our last contact.
- Therapist accounts: while the account is active. After closing, we delete practice data within 30 days, except what accounting law requires us to keep (usually 5 years).
- Clients' records: as the therapist instructs. The Psychologist Act requires records to be kept for 5 years from the end of the year in which services ended; after that they can be destroyed with a protocol.
- Server logs: a few days to a few weeks, for security and debugging.
6. Your rights
Under the GDPR you can ask us to:
- give you access to your data and a copy of it;
- correct inaccurate data, or complete incomplete data;
- delete your data, or restrict how we use it;
- move your data to another service in a common format;
- stop processing based on our legitimate interest;
- withdraw consent you gave, at any time, without affecting earlier processing.
7. How to use your rights or complain
Write to hello@usesessio.com. We answer within one month. If you are a therapist's client, we'll pass your request to your therapist, who decides as controller, and help them answer.
You can also complain to the Polish data protection authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.
9. Security
- Encryption in transit (HTTPS) everywhere and encryption at rest for stored data.
- Row-level security in the database: each therapist can reach only their own practice; each client only their own sessions and messages.
- Video rooms open only for the signed-in therapist or the client's secret link, are locked to those two people, and close when a session is cancelled.
- Access to production systems is limited to the people who run Sessio.
10. Children
Sessio's accounts are for adults. Sessions with anyone under 18 are booked by a legal guardian, as the therapist's agreement requires.
11. Changes to this policy
If we change how we handle data, we'll update this page and the date at the top. Significant changes are emailed to therapists before they take effect.