Privacy Policy

Last updated: 2026-07-14

1. Data controller

The controller of your personal data is the operator of MyTheraSpace: Дигитална Планета ЕООД, UIC 208153950, БЪЛГАРИЯ, гр. София (1303), р-н Възраждане, жк. Сердика, бл. 20, ет. 12, ап. 46. Data protection contact: support@mytheraspace.com.

2. What data we collect

Account — name, email, password (stored as an irreversible hash), language, timezone.
Bookings and sessions — chosen therapist, date/time, status, payment history.
Messages — your correspondence with the therapist through the Platform.
Payments — processed by Stripe; we store only the last 4 digits and card brand, never the full number.
Video sessions — held in real time; we do not record session content.
For therapists — qualifications, verification documents (processed via Stripe Identity/KYC), payout and invoicing data.
Technical — IP address, device type, security logs.

3. Why we process it (legal bases)

Contract performance — account, bookings, payments, communication (Art. 6(1)(b) GDPR).
Legal obligations — accounting and invoicing (Art. 6(1)(c)).
Legitimate interest — security, fraud prevention (Art. 6(1)(f)).
Mental-health-related data is a special category — we process it only as necessary for the service you yourself have requested (Art. 9(2)(a) and (h) GDPR).

4. Who we share data with

Your therapist — sees your name, bookings and the messages you send them.
Stripe (payment partner, EU/US under standard contractual clauses) — payment processing and therapist verification. Stripe's policy.
Infrastructure providers — hosting and video service, bound by data processing agreements.
Public authorities — only where legally required.
We do not sell data to third parties. We show no ads.

5. How long we keep it

Account and profile — while the account is active, plus a reasonable period after closure to settle obligations.
Financial documents (invoices) — for the statutory period (up to 10 years under Bulgarian law).
Messages — while the account exists; you can request deletion.

6. Your rights (GDPR)

You have the right of access, rectification, erasure ("right to be forgotten"), restriction, portability and objection. Write to support@mytheraspace.com — we reply within 30 days. You may also lodge a complaint with the Bulgarian DPA (cpdp.bg).

7. Cookies

We use only technically necessary cookies: session (login), language (bg/en) and cookie-consent memory. No third-party advertising or tracking cookies.

8. Security

Encrypted connection (HTTPS/TLS) everywhere, hashed passwords, restricted data access, audit logs of administrative actions.

9. Minors

The Platform supports work with teenagers. For users under 18 we recommend involving a parent/guardian; for children under 14, registration and use require parental/guardian consent under Bulgarian law.

10. Changes

Updates to this policy are announced on this page with a new last-updated date.