Privacy Policy
What we collect, where it is stored, who we share it with, and how we protect it.
Last updated:
Scope
This policy covers personal data processed through the psisula marketing site (psisula.com) and the psisula application. For the formal disclosure under Turkish data protection law, see the KVKK Disclosure Notice.
What we collect
When you give it: the name, email, phone, practice type, team size and optional message on the demo request form. Your name, email and role when you open an account. The content of emails you send us.
Generated in use: login and session records, technical logs consisting of a request id plus clinic and therapist ids, and error records. On the marketing site: cookieless visit statistics (pages viewed, referrer, campaign tags, clicks), described in the Cookie Policy.
What we don’t collect: the demo form asks for no tax id, budget, current software, password or card details. The marketing site runs no advertising or profiling tracker of any kind.
Client data
For the client data a clinic enters, the clinic is the controller and we are the processor. We access it only:
- at the customer’s explicit request, to resolve a problem they have reported;
- during technical maintenance strictly necessary to keep the service running.
Both are logged. We do not use client data for product development, analytics, or AI model training.
Cookies
The marketing site sets no cookies and stores nothing in your browser; it counts visits with cookieless analytics (PostHog, EU). The application uses only the essential cookies that keep you signed in. See the Cookie Policy.
Hosting and sub-processors
Servers, database and file storage are located in the European Union (Alkmaar, Netherlands). The providers we rely on, the data each receives and their locations are listed in the table in the KVKK Disclosure Notice: our hosting provider, OpenRouter (and through it OpenAI and Z.AI, which serve the two models we call), Twilio, Resend, Sentry, PostHog (marketing-site visit statistics only), Zoom and Google Meet.
When our sub-processor list changes, account holders are notified in advance under the Data Processing Agreement.
AI and session audio
- Drafting a note from session audio requires recording consent to be captured in the system; without it, the request never reaches any provider.
- Audio is not retained. Once transcribed, the audio is discarded; the transcript text is stored encrypted.
- No AI-generated content is ever published, attached to a record or sent to a client automatically. Every draft waits for therapist review.
- Which providers. AI requests go to one gateway, OpenRouter, on a paid pay-as-you-go account. It routes them to two models:
openai/gpt-transcribe(OpenAI) for speech-to-text, andz-ai/glm-5.3-flash(Z.AI) for drafting, summaries and assessment readings. We use no other AI provider and run no self-hosted model. - No training on your data. Every request carries OpenRouter’s
data_collection: "deny"routing flag, so it can only be served by providers that do not store or train on the payload. Neither model is trained, fine-tuned or evaluated on anything we send. - What reaches them. Only session audio, transcript text and the record text a therapist asks us to work on. Data received from Google or Zoom never reaches an AI provider: the integrations are write-only, there is no code path from them into an AI request, and no AI feature reads the telehealth fields.
Google user data
The Google integration is optional and write-only. When a therapist connects their own Google account, we request a single scope, https://www.googleapis.com/auth/calendar.events, and use it for one call: creating a calendar event with a Meet conference when an appointment is marked as an online session.
What we receive from Google: the OAuth access and refresh tokens, and the Meet join URL of the event we have just created. Nothing else. We do not read, list, import, index or store calendars, events, contacts, mail, files, Photos content or profile data, and we receive no data about any other Google user.
Who we share it with: no one. Google user data is not sold, not transferred to any third party, not used for advertising or profiling, and is never sent to any AI or machine-learning service — not for training, fine-tuning, evaluation or inference. Our AI features operate only on session audio and record text entered in psisula and have no access path to Google data.
How it is protected: tokens and the join URL are encrypted at rest with AES-256-GCM field-level encryption under a root key, and travel over TLS. Tokens are readable only by the component that calls Google; they are never logged, never displayed in the interface and never exported. Access is scoped to the therapist who granted it.
How long we keep it: until the therapist disconnects. Disconnecting in Settings › Telehealth deletes the tokens and the connection record immediately, and revoking access in the Google Account ends our access from Google’s side. Join links already attached to past appointments stay in the clinical record and are deleted with the appointment, or on request.
Limited Use. psisula’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs adheres to the Google User Data Policy, including the Limited Use requirements — in particular, that data is not used to create, train or improve any generalized or foundational machine-learning or AI model, and is not transferred to any service that would.
How we protect data
Sensitive data — health data, which under Turkish law means session notes, treatment plans, diagnoses, assessment answers and scores, homework and session transcripts — is protected by specific measures, not only by the general ones: TLS 1.2+ in transit; AES-256-GCM field-level encryption at rest under a root key, so those fields are ciphertext in the database and in every backup; keys held outside the database and never in the repository; and a hard tenancy check on every request, so a record can only be read in the session of the clinic that owns it. Telehealth OAuth tokens and meeting links are encrypted the same way.
Across the rest of the system: phone numbers do not sit in the database as searchable plaintext; access is limited by role; passwords are stored as bcrypt hashes, and invite, password-reset and portal login tokens only as SHA-256 digests; and administrative access to production data happens only in the two cases named under Client data, and is logged. The full list is on the Security page.
Data is not end-to-end encrypted: search, reporting and AI features require the server to read it. We write that down as a limitation.
Data breach
If we identify a personal data breach we inform affected account holders without undue delay and within 72 hours at the latest. The notice covers the nature of the breach, the categories of data affected, the likely consequences and the measures we have taken. For data we process as controller, we notify the Personal Data Protection Board ourselves; where clinical data is involved the notification duty sits with the clinic, and we give them what they need to meet it.
Children’s data
The product is used by adult healthcare professionals with accounts. Data about child and adolescent clients is entered by the clinic under parental or guardian consent, and obtaining that consent is the clinic’s responsibility.
Changes
When we update this policy we change the date at the top of the page. For a material change we notify account holders by email.