Privacy Policy

Here Is Therapy is operated by A Key Disruption LLC. Effective [effective date] · Version draft-1

We built this for therapists and the people looking for them, so privacy is the main design rule. The short version: we collect as little as we can, we keep it for as short a time as we can, and we never sell it or use it to advertise.

People looking for a therapist

You don't need an account to search, read profiles, or write to a therapist.

• Searching and reading profiles. We don't ask who you are. We count how often a profile appeared in results or was opened, as a number for that therapist, without recording who looked.
• Writing to a therapist. You give a name, an email, an optional phone number and a message. We email it to that therapist, with your email as Reply-To so they answer you directly. We don't keep a copy of the message. To limit spam we keep a one-way scrambled form of your email and of your internet address for 30 days, which can't be turned back into either.
• "Tell us what you need." If you ask us to find someone, we store what you told us (what you're looking for, your age group, insurance, places, an optional note, your name and email, and a phone number if you give one), encrypted. Therapists who fit see only what you're looking for, never your name or contact details. Your name and contact details go only to the therapist you choose to connect with. Everything is deleted after 14 days.
• The phone app. If you use the app without an account, it keeps a list of therapists you saved, your choice of role, and the private link to a request on your device only. If you allow notifications, the app gives us a token from Apple so we can tell you an answer arrived. We store that token encrypted with the request and delete it with it.

Please don't put health details, names of other people, or anything you'd regret sharing into a note or message. Share more directly with a therapist once you're talking.

Therapists

• To join, you give your name, email and at least one license (state, type and number). We check the license against the state's public lookup, and may check the federal NPI registry, which is public. A reviewer sees your name, email and license while checking. We keep the license's expiration date and status as the board publishes them, and where a state publishes its licenses as open data, or a license file (New Jersey, California, Florida, Virginia, Michigan, Missouri, Iowa, Rhode Island, Wyoming, Massachusetts, New Hampshire, Ohio, Alaska, Idaho, and New York once it sends one), we look yours up there by name and number, now and every week, so a license that lapses stops counting. When the number and the name both match a license in good standing, that check verifies it. From a state's file we keep only therapists' names, license numbers, professions, status and dates, never a birth year or an address, to check our own members' licenses. We remind you before a license expires.
• Therapists who aren't members, from a state's list. Where a state's public licensee list includes emails (New Jersey's, Florida's, Virginia's and Michigan's do), we keep the name, license number and type, and email of therapists whose license is in good standing, encrypted, to send each one a single invitation to our newsletter. Nothing more is sent unless they say yes and confirm. Saying no, a bounce, or no answer within 60 days deletes the address. If a therapist later joins with the email the board has for their license, a scrambled fingerprint of it confirms the license is theirs. The full rules.
• The newsletter. If you sign up (on the site, from an invitation, or in your settings), we keep your email, encrypted, with when you agreed and the words you agreed to, until you unsubscribe. We don't track opens or clicks, and we don't use newsletter platforms.
• Your profile is what you write: headline, bio, specialties, ages, languages, insurance, fees, town, an optional photo and video link, and booking links. It's public once your license is verified. Your office ZIP code is used to work out roughly how far you are from someone; your street address is shown only if you type it into the public address box. A photo you upload is public.
• Your availability (accepting, waitlist, full or away), when you last confirmed it, and your vacation or paused-listing dates. The public sees your status and how recently you confirmed it.
• Referrals you send carry what a client needs (age group, concerns, state, format, insurance, preferences and an optional short note), never a name, contact details or other identifying information. A colleague's answer is saved as available, not a fit (with an optional reason they pick from a fixed list, never typed words) or a question; the sender sees counts of reasons, never who gave them. They stay with the referral until you delete your account. We stop showing an unanswered one after 7 days. Answers are saved as a kind (available, not a fit, question) and a time, not as words.
• The Commons. Your posts, tags, replies, drafts and what you follow. Posts come off the board after 60 days; we keep them on your Your posts page until you delete them or your account.
• Counts for you. How many times your listing appeared, was opened or was written to. They are numbers only, and we keep them for 24 months.
• Records of what happened. A log of status changes, referral decisions, sign-ins, license decisions and any freeze, kept while your account exists so we can fix mistakes and investigate misuse.
• Sign-in. We email a one-time link (it works once, for 15 minutes) or a six-digit code for the app. A session cookie keeps you signed in for 14 days; an app sign-in ends after 30 days unused. We store only one-way hashes of links, codes and tokens.
• Notifications. An email or push notice only says that something is waiting, never who it's from or what it says. You choose which kinds you get under Notification settings.

Colleague messages

Messages between verified colleagues are stored, encrypted with a key held by the service, so you can read them later. Only the people in a conversation can open it. Referral conversations refuse email addresses and phone numbers; contact details are shared when an introduction is arranged. A conversation about a referral is deleted 30 days after that referral ends. A direct conversation is deleted 365 days after its last message. You can delete a conversation for yourself at any time, and it's gone for good once both people have. Messages you sent are deleted with your account. Reviewers can't read conversations.

Clients can't message therapists inside the service. We have not built messaging with clients, and we won't without a separate privacy review.

How long we keep things

Deleting your account removes your profile, license details, referrals, posts, replies, messages you sent, saved replies, follows, counts, logs and photo. A colleague keeps the fact that a referral was answered, without your name. Backups, once we have them, expire on a schedule.

Who sees it

• We never sell personal information, and we don't share it for advertising. There are no advertising or analytics trackers on the site or in the app.
• Therapists see what the sections above say they see, and no more.
• Reviewers (a small number of people who run the service) see therapists' names, emails and licenses to verify them and to handle reports. They don't read messages.
• Service providers that run the service for us: our host and database, our email provider, and Apple (push notices). Each is limited to doing that job. We name them to you on request.
• The law. We may disclose information if legally required, or to protect someone's safety. Because we keep little, there is little to give.

Cookies and third parties

We use one session cookie. It protects forms from forgery and, for therapists, keeps you signed in. We don't use cookies to track you across sites. Our typefaces are served from this site, so no font company receives your internet address. A profile video is a link: nothing loads from YouTube or Vimeo unless you press play, and then it loads the privacy-enhanced version.

Your choices

• Therapists can download everything we hold about them, and delete their account, on the Settings page.
• Everyone else can ask us to delete a request or anything else we hold, or ask what we have, by writing to lexsanti@hereistherapy.com. Requests are deleted automatically after 14 days anyway.
• If you live somewhere with privacy rights, such as California, you can use them by writing to us. We don't discriminate against anyone for doing so. [Attorney to confirm which state laws apply and how to describe them.]

Security

Pages and the app use an encrypted connection. Requests and messages are encrypted before they're stored. Sign-in uses one-time links and codes, with limits on how often they can be tried. Sensitive actions are logged. No system is perfectly secure, and we won't claim ours is.

Health information

The service is built for needs, not names. A referral carries what a client needs and never who they are, and we tell people not to put identifying or health details in notes. Until the legal, security and vendor reviews are complete, don't send protected health information through the service. We don't claim the service is HIPAA compliant: encryption alone doesn't make it so. [Attorney to confirm how each partner organization's rules, such as FERPA or HIPAA, apply.]

Children

The service is for adults. A parent or guardian may look for a therapist for a child. We don't knowingly collect information directly from anyone under 18. [Attorney to confirm.]

Changes and contact

If this policy changes in a way that matters, we'll say so on this page and email therapists before it takes effect. Questions or requests: lexsanti@hereistherapy.com, or by mail to 46 Elm St, Trumansburg, NY 14886.

Terms of Use · If you're in crisis