Privacy Policy
Last updated: 24 September 2026
This Privacy Policy is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR). It describes how Therapsy STP S.r.l. processes the personal data of users of the website https://therapsy.it/ and of the Clients who use the Therapsy services through the Platform. It should be read together with the Terms and Conditions, the Informed Consent signed by Clients and the Cookie Policy.
Therapsy STP S.r.l. is a professional company (società tra professionisti) registered with the Order of Psychologists of Lombardy (Reg. No. 30221). It provides psychological services (psychological support and psychotherapy) through the psychologists and psychotherapists of its network and, where appropriate, refers Clients to psychiatrists, who provide psychiatric consultations independently.
Data Controller
The Data Controller is Therapsy STP S.r.l., Via Giovanni Battista Boeri 11, 20141 Milan, Italy – VAT and Tax Code 14203210969 – REA MI2765995 – certified email therapsy@pec.it – email privacy@therapsy.it.
The psychologists and psychotherapists who provide the Services process personal data, including health data, on behalf of Therapsy, as data processors under Article 28 GDPR, and are bound by professional secrecy. Psychiatrists to whom Clients are referred provide psychiatric consultations in their own name, invoice the Client directly and act as independent data controllers for the related data. Therapsy processes, as data controller, the data needed for the referral, the follow-up contacts and the clinical case discussion with the Psychiatrist described in the Terms and Conditions, including health data exchanged with the Psychiatrist.
Categories of Personal Data processed
a) Identification and contact data: first name, last name, email address, phone number, address, date and place of birth, tax code, account access credentials.
b) Data of parents or guardians, for Clients who are minors.
c) Health data: the difficulties described by the User in the contact form and in the preliminary exchange; data relating to the sessions (dates, attendance, therapeutic path); clinical records kept by the Therapist; reports and documents requested by the Client.
d) Payment and billing data. Payment card details are held by the payment provider and are not stored by Therapsy.
e) Communications with Therapsy and with the Therapist, through the Platform messaging, email or WhatsApp.
f) Usage and technical data: browsing data, IP addresses, access logs, device and browser information.
Methods of Processing Personal Data
Personal data are processed in accordance with the principles of lawfulness, fairness, transparency and minimisation, by means of IT and telematic tools, with logic strictly related to the purposes indicated in this notice. The Data Controller adopts appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including access controls, authentication systems and security protocols. Access to the data is permitted exclusively to persons authorised by the Data Controller, previously instructed and bound by confidentiality. Health data are accessed only by the Therapist, by the Clinical Direction and by the persons strictly necessary for the provision of the Services.
Purposes of Processing, Legal Basis and Retention
1) Responding to requests, preliminary orientation and matching
Data provided through the contact form, by email, by telephone or via WhatsApp are processed to respond to the User’s requests, to understand their needs and to match them with the most suitable Therapist.
Legal basis: pre-contractual measures taken at the User’s request (Art. 6(1)(b) GDPR) and, for information concerning health, the User’s explicit consent (Art. 9(2)(a) GDPR).
Retention: for the time necessary to manage the request and, if no therapeutic path is started, for 12 months from the last contact, unless the User withdraws consent earlier.
2) Provision of the Services
Data are processed to provide the psychological services, organise sessions, manage the Platform, messaging and documents, and keep the clinical records.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and, for health data, the provision of health care by professionals bound by professional secrecy (Art. 9(2)(h) and 9(3) GDPR).
Retention: account data for the duration of the relationship; clinical records for at least five years after the end of the professional relationship (Art. 17 of the Code of Ethics of Italian Psychologists).
3) Referral to psychiatrists and follow-up
Where the Client is referred to a Psychiatrist, data are processed to identify the most suitable Psychiatrist, prepare the referral, keep in touch with the Client during the psychiatric path and discuss the Client’s situation with the Psychiatrist.
Legal basis: for health data, the provision of health care by professionals bound by professional secrecy (Art. 9(2)(h) and 9(3) GDPR and Art. 2-septies of Legislative Decree No. 196/2003), with the Client’s agreement to the referral and to the exchange of information with the Psychiatrist, which may be withdrawn at any time; for the other data, the steps taken at the Client’s request (Art. 6(1)(b) GDPR).
Retention: at least five years after the last contact (Art. 17 of the Code of Ethics of Italian Psychologists).
4) Clients who are minors
For minors, the Services require the consent of both parents exercising parental responsibility (or of the sole parent exercising it, or of the guardian). Information about the minor’s care is communicated to the persons holding parental responsibility.
Legal basis: Art. 6(1)(b) and (c) GDPR and Art. 9(2)(h) GDPR, in accordance with the rules on parental responsibility (Articles 316 and 337-ter of the Italian Civil Code) and on consent to health care of minors (Article 3 of Law No. 219/2017).
5) Billing, tax and legal obligations
Data are processed to issue receipts and invoices, manage payments and comply with legal, administrative and tax obligations. Invoice data are sent to the Sistema Tessera Sanitaria (Ministry of Economy and Finance), which makes them available to the Italian Revenue Agency, in accordance with the choice expressed by the Client at registration.
Legal basis: legal obligation (Art. 6(1)(c) GDPR).
Retention: 10 years, as required by tax and accounting rules.
6) Newsletter
With the User’s consent, name and email address are processed to send newsletters with information, resources and updates on Therapsy’s services. Interactions with the emails (opening, clicks) may be recorded.
Legal basis: consent (Art. 6(1)(a) GDPR), which may be withdrawn at any time through the unsubscribe link in each email or by writing to privacy@therapsy.it.
Retention: until consent is withdrawn.
7) Statistics and marketing on the website
Usage data are processed to analyse the use of the website and, with the User’s consent, to measure and personalise advertising, as described in the Cookie Policy and in the section “Tools used” below.
Legal basis: consent (Art. 6(1)(a) GDPR) given through the cookie banner; legitimate interest (Art. 6(1)(f) GDPR) for anonymous and aggregated statistics.
Retention: until consent is withdrawn or for the period set for each tool.
8) Defence of rights
Data may be processed to establish, exercise or defend a right in legal proceedings.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR) and, for health data, Art. 9(2)(f) GDPR.
Retention: for the duration of the proceedings and the related limitation periods.
Recipients of the Data
Personal data may be processed, within the limits of the purposes indicated above, by:
a) the Therapists, as data processors, and the Clinical Direction of Therapsy;
b) persons authorised by the Data Controller (administrative and technical staff), bound by confidentiality;
c) psychiatrists to whom the Client is referred with their agreement, as independent data controllers;
d) for Clients who are minors, the persons holding parental responsibility;
e) service providers acting on behalf of Therapsy, including: IONOS SE (website hosting); Elementor Ltd (website contact forms); Wise.live (Wise Leap Technologies), which provides the Platform used for registration, informed consent, bookings, messaging and online sessions; Zoom Video Communications, Inc. (video sessions integrated into the Platform); Stripe (payments; Stripe also acts as an independent data controller for the data required by payment and anti-fraud regulations); Google (email and productivity tools); Make (automation of administrative processes); ActiveCampaign, LLC (CRM, service emails and newsletter); WhatsApp (messaging); CookieYes (cookie consent management); Infinity (Infinity Innovations, Inc.), platform used to manage referrals and appointments with psychiatrists; the providers of the statistics and marketing tools listed below;
f) Anthropic (Claude) and Google (Gemini), providers of AI assistants used by staff for administrative support;
g) public authorities, including the Italian Revenue Agency through the Sistema Tessera Sanitaria, and judicial authorities where required by law.
The updated list of data processors may be requested from the Data Controller at any time.
Transfer of Data outside the European Economic Area
Some of the providers listed above are established in, or process data in, countries outside the European Economic Area, in particular the United States (Wise.live, Zoom, Google, Stripe, ActiveCampaign, Infinity, Meta, Microsoft, Anthropic) and India (Wise.live support). For providers certified under the EU-US Data Privacy Framework, transfers are based on the adequacy decision adopted by the European Commission on 10 July 2023; otherwise, they are based on the standard contractual clauses adopted by the European Commission, where included in the provider’s data processing terms. Elementor Ltd is based in Israel, and the United Kingdom is covered by an adequacy decision of the European Commission. Further information on the safeguards applicable to each transfer is available on request.
Exercise of the Data Subject’s Rights
The Data Subject may exercise the rights provided for by Articles 7 and 15 to 22 GDPR: withdraw consent at any time; access their personal data; obtain rectification, erasure or restriction of processing; object to processing; receive their data in a structured format (portability). Requests can be sent to privacy@therapsy.it or info@therapsy.it. The Data Subject also has the right to lodge a complaint with the Garante per la protezione dei dati personali (www.garanteprivacy.it) and to take legal action before the competent courts.
Cookies
This website uses cookies. Consent is managed through CookieYes. For details, see the Cookie Policy.
Tools used for the Processing of Personal Data
Hosting
This website is hosted on infrastructures provided by IONOS SE, a company based in Germany. Browsing data, including IP addresses and technical logs, are processed by the provider’s systems to ensure security, proper functioning and stability of the website.
Legal basis: legitimate interest of the Data Controller (Art. 6(1)(f) GDPR) in ensuring the security and proper functioning of the website.
Retention: according to the provider’s policies and for the period strictly necessary for security and maintenance purposes.
Place of processing: IONOS SE data centres in the European Union. Privacy Policy: https://www.ionos.it/terms-gtc/privacy-policy/
Web platform
The website is developed and managed with WordPress, an open-source content management system installed on the hosting described above.
Legal basis: performance of pre-contractual measures (Art. 6(1)(b) GDPR) and legitimate interest in the technical management of the website (Art. 6(1)(f) GDPR).
Retention: for the time necessary to operate the website and provide the requested services.
Contact form
By completing a contact form, the User provides their data to be contacted and to start the matching process. Data collected: first and last name, email address, phone number, difficulties described, past psychotherapy experience, location and preferred language. The forms are created with Elementor (Elementor Ltd, Israel, a country covered by an adequacy decision of the European Commission) and the data are transferred to the internal management tools and to the CRM described below.
Legal basis: see purpose 1.
Privacy Policy: https://elementor.com/about/privacy/
Therapsy Platform (Wise.live)
Registration, informed consent, bookings, reminders, messaging and online sessions take place on the Wise.live Application, provided by Wise Leap Technologies, which acts as data processor. Online sessions take place via Zoom, integrated into the Platform. The Platform processes identification and contact data, booking and session data, messages and documents exchanged, and billing data.
Legal basis: see purposes 2, 3 and 4.
Place of processing: servers located in the United States; the provider’s support staff may access data from India. Privacy Policy: https://www.wise.live/privacy-policy/
Video sessions (Zoom)
Online sessions take place via Zoom, provided by Zoom Video Communications, Inc. (USA), integrated into the Platform.
Place of processing: United States and other countries where the provider operates. Zoom participates in the EU-US Data Privacy Framework. Privacy Policy: https://explore.zoom.us/en/privacy/
Payment management
Payments are processed by Stripe through the Platform. Payment card details are held by Stripe and are not accessible to Therapsy, which receives confirmation of the payment. Stripe also acts as an independent data controller for the data required by payment and anti-fraud regulations.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and legal obligations (Art. 6(1)(c) GDPR).
Place of processing: European Union and United States. Stripe participates in the EU-US Data Privacy Framework. Privacy Policy: https://stripe.com/privacy
Email and productivity tools
Therapsy uses Google Workspace, provided by Google, for email and internal documents, and Make (make.com) to automate administrative processes between its tools.
Place of processing: European Union and United States. Privacy Policy: https://policies.google.com/privacy and https://www.make.com/en/privacy-notice
CRM, service emails and newsletter
Therapsy uses ActiveCampaign, provided by ActiveCampaign, LLC (USA), to manage contacts, send service communications and, with consent, newsletters, and to measure interaction with them (e.g. email opens, clicks). ActiveCampaign is not used for automated decisions.
Legal basis: see purposes 1, 2 and 5.
Place of processing: United States. Privacy Policy: https://www.activecampaign.com/legal/privacy-policy
With the User’s agreement, WhatsApp, provided by WhatsApp Ireland Limited, is used for the preliminary exchange and for organisational messages, including the follow-up contacts during a psychiatric path described in the Terms and Conditions. The User may ask for email to be used instead. Detailed clinical information should not be shared via WhatsApp: within the Services, it is exchanged on the Platform.
Legal basis: pre-contractual and contractual measures (Art. 6(1)(b) GDPR).
Place of processing: European Union, with possible transfers to the United States according to the provider’s terms. Privacy Policy: https://www.whatsapp.com/legal/privacy-policy-eea
AI assistants
Therapsy staff may use AI assistants provided by Anthropic (Claude) and Google (Gemini) for administrative support, such as drafting and reviewing documents and correspondence. The AI assistants do not make decisions concerning Clients and are not used for diagnosis or therapy.
Place of processing: United States and European Union. Privacy Policy: https://www.anthropic.com/legal/privacy and https://policies.google.com/privacy
Statistics
This website uses the following tools, subject to the User’s consent given through the cookie banner:
Google Analytics 4 (Google), to collect statistical information on website usage. IP addresses are not stored. Retention: up to 14 months. Opt-out: cookie banner or https://tools.google.com/dlpage/gaoptout. Privacy Policy: https://policies.google.com/privacy
Microsoft Clarity (Microsoft Corporation), to analyse how users interact with web pages through heat maps and pseudonymous session recordings. Microsoft participates in the EU-US Data Privacy Framework. Privacy Policy: https://privacy.microsoft.com/privacystatement
Tag management
The website uses Google Tag Manager (Google) to manage the tags of the other tools. Google Tag Manager does not itself store personal data; the tools it activates are subject to the User’s consent. Privacy Policy: https://policies.google.com/privacy
Advertising and remarketing
With the User’s consent given through the cookie banner, the website uses Google Ads conversion tracking and remarketing (Google Ireland Limited) and the Meta Pixel (Meta Platforms Ireland Limited) to measure the effectiveness of advertising campaigns on Facebook and Instagram and to show advertisements to people who have visited the website. Retention: up to 180 days. Consent can be withdrawn through the cookie banner or in the Facebook ad preferences. Privacy Policy: https://www.facebook.com/privacy/policy/
Social networks and external content
The website includes buttons and content from Facebook and Instagram (Meta Platforms Ireland Limited), LinkedIn (LinkedIn Ireland Unlimited Company), YouTube and Google Maps (Google Ireland Limited) and TikTok (TikTok Technology Limited). These services may collect usage data and, with the User’s consent, set cookies, according to their respective privacy policies.
Users resident in the United Kingdom
For Users resident in the United Kingdom, personal data are processed in compliance with the UK GDPR and the Data Protection Act 2018. The competent supervisory authority is the Information Commissioner’s Office (ICO).
Users resident in Switzerland
For Users resident in Switzerland, personal data are processed in compliance with the Federal Act on Data Protection (nFADP). The competent supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC).
Changes to this Privacy Policy
The Data Controller may update this Privacy Policy. The date of the last update is indicated at the top of this page.