This policy explains what personal information My Therapy Site collects, why we collect it, who we share it with, and what rights you have. We have written it in plain language on purpose.
In short
- We are a Canadian business based in Hamilton, Ontario, and we are the controller of the information described in this policy.
- We provide this service to practices in Canada and the United States, and we do not offer it to people in the EU/EEA or the UK.
- We collect information about you as a practitioner or practice — your account details, what you tell us about your practice, and the content of the website we build for you.
- We never process information about the people you treat. Your clients' records, intake forms, appointments and payments stay with you and your booking tool, not with us.
- We do not sell your personal information, and we do not use advertising or analytics cookies.
- Our website is hosted in the United States, and we use a small number of service providers to run the service. Where your information leaves Canada, we put appropriate safeguards in place.
- You can ask us for a copy of your information, correct it, or delete it, at any time, by emailing [email protected].
1. Who we are#
My Therapy Site ("we", "us", "our") provides fully managed websites for therapy practices. We operate at https://mytherapysite.com and are based in Hamilton, Ontario, Canada.
We are the data controller for the personal information described in this policy. Our Privacy Officer is responsible for how we handle personal information, and can be reached at [email protected]. This is the address to use for any question or request about your information.
The service is offered to therapy practices in Canada and the United States. We do not offer the service to people in the European Economic Area or the United Kingdom, and we are not established there. We have not appointed a statutory Data Protection Officer, because we are not required to; privacy questions and requests go to our Privacy Officer.
2. What this policy covers#
2.1 This policy covers the personal information we handle about:
- our customers — the therapists, counsellors and practices who subscribe to us, and the people who act for them;
- visitors to our website, including people who contact us or ask about the service; and
- people we correspond with in the course of running our business.
2.2 This policy does not cover the personal information of your therapy clients. We do not process that information at all. We build and host your public marketing website; we do not provide booking, scheduling, client records, client intake forms, appointment reminders or client payments. Those stay in your own practice management or booking system.
2.3 If you are a client of a therapy practice and you have a question about your information, please contact the practice you deal with — they are responsible for it, not us.
3. What we collect#
We collect different information depending on how you interact with us.
3.1 Information you give us#
Account information — your name, email address, and a password (stored in hashed form, never as plain text). If you turn on two-factor authentication, we also store your two-factor secret and recovery codes.
Your practice and website content — when you complete our planning form, you tell us about your practice: your professional background, your approach, your services, your fees, how you like to work, your location and logistics, how you would like the website to look and feel, and how you would like to be presented. The form runs to around fifteen short sections. We use your answers to write and build your website.
Some of the fields in that form are free text, and a few invite you to share something personal about yourself if you wish. We ask you not to include information about your clients. There is more on this in section 5.
Support and correspondence — when you raise a support ticket, add a comment, or email us, we keep the messages and any files or images you attach.
Files and media — the logos, photographs and other files you send us for your website.
3.2 Information created through your use of the service#
Billing information — your subscription status, plan, currency, and transaction records. Payments are handled by Paddle (see section 6); we never receive or store your full card details. A small number of customers are invoiced directly rather than through Paddle, in which case we hold the billing arrangement and records ourselves.
Technical information — when you use our website: your IP address, browser type, and a session identifier, which we need to keep you logged in and to keep the service secure. Our servers also keep routine security and error logs.
3.3 Cookies#
We use a single essential session cookie to keep you logged in. We do not use advertising cookies, and we do not use analytics or tracking cookies.
Our website uses Cloudflare Turnstile on forms to tell humans and bots apart. Turnstile is designed to minimise tracking and does not use advertising cookies.
Because we only use essential cookies, we do not show a cookie banner. You can block or delete cookies in your browser, but the service will not work properly without the session cookie.
4. Why we use your information, and on what basis#
We only use your information for the purposes set out below, and only where we have a proper basis for doing so.
| What we do | Why | Our basis |
|---|---|---|
| Create and manage your account | To provide the service you have asked for | Performance of a contract |
| Build, host and maintain your website using the content you provide | To provide the service | Performance of a contract |
| Take payments and manage your subscription | To provide the service | Performance of a contract |
| Send service messages (onboarding, invoices, security, changes to the service) | To run the service | Performance of a contract |
| Provide support and answer your questions | To run the service | Performance of a contract |
| Protect the service against spam, abuse, fraud and attacks | To keep the service secure and available | Legitimate interests (security and fraud prevention) |
| Monitor errors, uptime and performance | To keep the service reliable | Legitimate interests (service reliability) |
| Keep records for tax, accounting and legal claims | To meet our legal duties and defend claims | Legal obligation; legitimate interests (legal claims) |
Where we rely on legitimate interests, our interests are keeping the service secure, available and reliable, and protecting ourselves against unlawful use and legal claims. We have balanced those interests against your rights. You can ask us for more information, and you can object — see section 10.
We do not currently send marketing email. Every email we send is about your account or the service. If that ever changes, we will ask for your consent first, and section 11 explains how that would work.
We do not make decisions about you based solely on automated processing that would have a legal or similarly significant effect on you.
5. Personal information that is more sensitive#
A few of the fields in our planning form are free text, and it is possible for you to write something sensitive in them — for example, something about your own health, background or beliefs. We do not ask you for this information, and you do not have to provide it.
5.1 If you choose to share sensitive information about yourself, we will only use it to build and present your website, and we rely on your explicit consent. You can withdraw that consent at any time by contacting us — but if you do, we may need to remove that content from your website.
5.2 We do not use free-text answers about you for any other purpose, and we do not use them for advertising or profiling.
5.3 Please do not send us information about your clients. We do not need it, we do not want it, and we do not build your website from it. If you send it to us by mistake, tell us at [email protected] and we will remove it. This matters because your clients' health information is subject to special legal protection, and the right place for it is your own practice management system — not a marketing website.
6. Who we share your information with#
We do not sell your personal information, and we do not share it for advertising. We share it only with the service providers we need to run the service, and only as described here. These providers are bound by contract to protect it and to use it only for the purposes we have set out.
| Provider | What they do for us | Where they process it |
|---|---|---|
| Paddle — our merchant of record | Handling payment, invoicing and sales tax for subscriptions | United Kingdom, Ireland, Canada and United States |
| Amazon Web Services (AWS) | Hosting our application and storing data | United States (US East) |
| Cloudflare | DNS, network protection, and form bot protection (Turnstile) | Global network, including the United States and Europe |
| Mailgun (Sinch) | Sending our emails to you | United States and European Union |
| Bunny Fonts (bunny.net) | Serving the fonts used on our website | European Union (Slovenia) |
| Flare (Spatie) | Error monitoring, so we can find and fix faults | European Union, with storage hosted in the United States |
Paddle is not simply acting on our instructions. As our merchant of record it is a separate controller for your payment information, with its own contract and privacy notice at https://www.paddle.com/legal/privacy. If you have a question about a payment, Paddle is the right place to ask.
We may also disclose information if we are required to by law, to enforce our Terms of Service, or to protect the rights, safety or property of us or others. If we ever sell or reorganise the business, information may transfer as part of that, and we would tell you.
7. Where your information is stored and transferred#
7.1 We are based in Canada, and our application and data are hosted in the United States. Several of the providers listed in section 6 are outside Canada.
7.2 When we send personal information to a provider outside Canada, we remain responsible for it. We choose providers that offer a comparable level of protection, and we put contractual safeguards in place so that your information is protected to a standard comparable to Canadian privacy law.
7.3 If you are in Quebec, we carry out a privacy impact assessment before communicating your information outside Quebec and put a written agreement in place with the recipient, as Quebec law requires.
7.4 You can ask us for more information about the safeguards we use, and we will provide a copy.
8. How long we keep it#
We keep personal information only as long as we need it. Here is what we do in practice.
| What | How long we keep it |
|---|---|
| Account information (name, email, password, two-factor details) | While your account is open, and deleted when you close your account |
| Your planning form answers, website content and uploaded files | While your account is open, and deleted when you close your account or ask us to delete the website — unless the website has another owner, in which case it stays with the website |
| Support tickets, comments and attachments | While your account is open, and deleted when you close your account or delete the website |
| Billing and transaction records | Kept for up to 7 years, as tax and accounting law requires |
| Server and security logs | Kept for up to 90 days |
| Error reports | Kept only as long as we need them to investigate and fix faults |
When you close your account, we delete your account record and the content that belongs to you, except for records we are required to keep (for example for tax) and except for residual copies held by our service providers until their own retention cycles clear them.
If you would like us to delete particular content while your account is still open, just ask at [email protected].
9. How we protect your information#
We take reasonable steps to keep your information safe, including:
- encrypting data in transit using HTTPS;
- hashing passwords, so we never store them in readable form;
- offering two-factor authentication on your account;
- restricting staff access to personal information to those who need it;
- storing uploaded files on private storage that is not publicly accessible, and serving downloads only to the account they belong to; and
- monitoring for errors, abuse and attacks.
No system is perfectly secure, and we cannot promise absolute security. If a breach ever puts you at risk, we will contact you and the relevant authorities as the law requires (see section 12).
10. Your rights#
You have the right to:
- be informed about how we use your information (this policy);
- access a copy of your information;
- correct information that is inaccurate or incomplete;
- delete your information, in the circumstances the law allows;
- restrict how we use it, or object to certain uses;
- withdraw consent at any time where we rely on consent, without affecting what we did before; and
- complain to a privacy regulator.
To exercise any of these, email [email protected]. We will respond within the time the law allows — normally within one month — and we may ask you to verify your identity first. It is free.
To help you move to another provider, we will provide a copy of your content on request in a reasonable, commonly used format.
If you are in Quebec, you also have the right to ask us to cease disseminating your information, or to de-index it, in the circumstances the law sets out.
If you are unhappy with our response, you can complain to:
- in Canada, the Office of the Privacy Commissioner of Canada (priv.gc.ca); or
- in Quebec, the Commission d'accès à l'information du Québec (cai.gc.ca).
11. Emails from us#
Every email we send is about your account or the service — for example onboarding, security, invoice, ticket and service-change messages. These are part of the service and we do not require separate consent to send them.
We do not currently send marketing or newsletter email. If we ever do, we will ask for your consent first, and every marketing email would include a way to unsubscribe that costs nothing and is honoured without delay.
12. If something goes wrong#
If we become aware of a breach of security safeguards involving your personal information, we will take steps to contain it and reduce the risk. Where the law requires, we will report it to the relevant regulator and notify you — for example, where there is a real risk of significant harm in Canada, or a risk of serious injury in Quebec.
13. Children#
Our service is for practitioners and practices, and is not intended for anyone under 18. We do not knowingly collect personal information from children. As explained above, we do not process the personal information of your clients, including any who are children.
14. Automated decisions#
We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you.
15. United States#
15.1 We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
15.2 We are a small Canadian business. The comprehensive privacy laws in US states such as California, Virginia, Colorado, Connecticut, Texas and Oregon apply to businesses above certain size or volume thresholds, and we do not believe we currently exceed them. Even so, we honour requests to access, correct and delete personal information from anyone who asks, and we do not discriminate against you for making a request.
15.3 If your practice is in Washington State and you would like to know how we treat sensitive information, contact us at [email protected] — the answer is in section 5: we ask you not to send us sensitive information, and we may refuse to publish content that includes your clients' information.
15.4 If you are a therapy client, your information is not held by us. Please contact your therapist.
16. Changes to this policy#
We may update this policy from time to time. If we make a material change, we will post the updated version here with a new date, and where the change is significant we will tell you directly.
17. Contact us#
Questions, requests and complaints can be sent to our Privacy Officer at [email protected].
We would like to resolve any concern you have before you take it further. Please contact us first.
See also our Terms of Service.