Back to home
§For patients

Privacy (Patients)

You use Theramate because your therapist uses it. This page explains, in plain language, how your data is processed, who keeps it, and what your rights are.

Last updated: 20 September 2026
§ 01

Who processes your data

  • Your therapist Your therapist is the data controller under GDPR: they decide what data to collect, for what purpose, and for how long. To exercise your rights, they are your primary point of contact.
  • Theramate (Playfield SRL) We provide the tools your therapist uses every day (hosting, encryption, management platform). They decide what happens with your data, not us. We process data on your therapist's instructions, and our team does not view clinical content. Necessary technical interventions are governed, logged, and not used to read records.
  • Address Playfield SRL · Company no. 0833.702.033 · Chemin de Toune 4, 1325 Chaumont-Gistoux, Belgium
§ 02

Data collected

  • Identity Last name, first name, date of birth, communication language
  • Contact Email and phone number if you or your therapist provided them
  • Appointments Dates, times, brief reasons, attendance
  • Clinical data Session notes, questionnaires, shared documents (only what is relevant to your care)
  • Technical data Connection logs strictly limited to technical support and security
§ 03

Why this data

Your data is used exclusively to provide your therapeutic care: preparing sessions, keeping clinical history, notifying you of appointments, sharing documents (questionnaires, reports, attestations). No other use. No advertising. No resale.

§ 04

Legal bases

Core guarantee

Your therapist, as data controller, determines the legal basis that applies to your care. Depending on the context, processing generally relies on therapeutic care or the care relationship (Article 6 GDPR), combined with Article 9(2)(h) GDPR for health data processed by a professional bound by professional secrecy. Some optional features, such as the patient assistant, audio transcription, or sharing information with a third party, may require specific information and/or your explicit consent where required by law or by your therapist's configuration.

§ 05

Health data

Core guarantee

Your clinical data qualifies as health data under Article 9 GDPR. It benefits from enhanced protection: AES-256-GCM encryption at rest with a key specific to your therapist, encryption in transit (TLS), European hosting, logging, and limited access to systems. Audio submitted for transcription is encrypted with that same key as soon as it is taken in charge, then deleted once integrated into the record, and video is never stored. Only your therapist accesses the clinical content useful to your care. The Theramate team does not view your clinical data: that is our commitment to users.

§ 06

Encryption and hosting

Core guarantee
  • Encryption All clinical and personal data is encrypted with AES-256-GCM at rest, with a key specific to each practitioner, and exchanges are encrypted in transit (TLS). Keys are managed server-side in a secure environment, with restricted access and internal controls. Our commitment is not to view clinical content.
  • Hosting Google Cloud, European Union: database replicated in Belgium and the Netherlands (eur3 multi-region), server processing in Frankfurt (europe-west3), files in the EU multi-region. HDS v2.0 certified infrastructure. Your data stays in the European Union.
  • Backups Automatic backups, encrypted and geo-redundant within the EU.
§ 07

Subprocessors

To run the platform, we rely on technical subprocessors. All are bound to Theramate by a GDPR-compliant subprocessing agreement.

  • Google Cloud (European Union) Primary hosting, database, serverless functions, authentication. European Union: database replicated in Belgium and the Netherlands (eur3 multi-region), processing in Frankfurt (europe-west3), files in the EU multi-region.
  • Scaleway (France) Transactional email (appointment confirmations and reminders, access links, documents sent by your therapist) and hosting of the video consultation server. Session video and sound pass through it live and are never recorded. Infrastructure and datacenters located in Paris, France.
  • OpenAI Notes, transcripts and clinical context needed to generate summaries, documents and responses through the OpenAI APIs. No content retention by the provider (Zero Data Retention, ZDR) and no training on your data. Processing is governed by a DPA and the applicable contractual agreements.
  • Soniox Session audio sent to the European (EU) endpoint of the Soniox APIs for transcription. No content retention by the provider (Zero Data Retention, ZDR) and no training on your data. Processing is governed by a DPA and the applicable contractual agreements.
  • Google AI provider for selected clinical processing. No training on your data, no API-side storage.
  • Stripe (Ireland) If your therapist bills via Theramate: payment processing and billing data only
§ 08

Artificial intelligence

Core guarantee
  • No training Your data is never used to train AI models.
  • No API-side storage AI APIs process the data necessary for the request without retaining it.
  • Assistance, not automated decision-making AI may help your therapist draft, summarize, or organize information, including notes related to your care. No clinical, therapeutic, or administrative decision about you is made solely by AI: your therapist remains responsible, reviews, and validates what is used.
  • Specific information and agreement Where certain features involve direct interaction with you or particular sensitive processing (patient assistant, audio transcription, third-party sharing), your therapist must inform you and obtain the required agreement before activation.
§ 09

Emails you may receive

  • Appointment confirmation and reminder Sent by your therapist via Theramate
  • Booking link If your therapist shares a public booking link
  • Shared documents Questionnaires, reports, attestations sent by your therapist
  • Temporary access links To view a shared document without creating an account

No marketing emails. No newsletters. Only what is strictly necessary for your therapeutic care.

§ 10

How long

Retention duration is set by your therapist, in compliance with the legal obligations applicable to their profession. In Belgium, the patient record is kept for at least 30 years from the last contact with the patient (Act of 22 April 2019 on the quality of healthcare practice, Article 35). Once the period set by your therapist ends, your data is irreversibly deleted.

§ 11

Your GDPR rights

  • Access Request a copy of the data concerning you
  • Rectification Have inaccurate information corrected
  • Erasure Request deletion, subject to legal retention obligations
  • Portability Receive your data in a reusable format
  • Objection and restriction Object to processing or request its restriction

To exercise these rights, contact your therapist (data controller) first. If you cannot reach them, write to privacy@theramate.pro and we will guide you through the process.

§ 12

Minors and legal representatives

If you are a minor or under guardianship, the rights above are exercised by your legal representative, under applicable law. From the age of discernment (typically between 12 and 16, depending on the situation and maturity), the minor may exercise certain rights related to their own health.

§ 13

Complaint to a supervisory authority

You have the right to lodge a complaint with a data protection authority, notably in the EU Member State where you reside or work. In Belgium, the competent authority is the Data Protection Authority (APD/GBA), Rue de la Presse 35, 1000 Brussels, dataprotectionauthority.be.

§A question

For any request about your data, please contact your therapist first. For technical questions:

privacy@theramate.pro

Playfield SRL · Company no. 0833.702.033 · Chemin de Toune 4, 1325 Chaumont-Gistoux, Belgium

· § · Are you a therapist? See the version for you