Privacy Notice
Privacy Notice
Last updated: 12 October 2026 · Version 6 · Binding versions: English and Turkish
1. Controller
FMC Software, İstanbul, Türkiye (Sultanbeyli V.D., VKN 2531136119). Once FMC Software OÜ (Estonia) is registered, it will take over as controller; this notice will be updated that day and registered users will be informed. Questions and requests: hello@seansly.co. This notice covers seansly.co, clinic.seansly.co and the Seansly mobile app.
2. What Seansly does
Seansly is a matching platform that connects people looking for therapy (clients) with mental-health professionals registered with Seansly Clinic (psychologists). A client posts a request; psychologists whose declared expertise matches send offers; the client accepts exactly one. Psychologists register themselves by declaring their profession; Seansly may not have verified a psychologist's licence, and you may ask the psychologist for their professional title and licence details. Seansly does not provide healthcare, does not deliver therapy and does not diagnose. The session fee is paid directly to the psychologist; Seansly is not a party to that payment.
3. What we process
Clients. The request form: topic, a free-text description of your situation, age group, session format, city, budget range, preferred times and who the request is for. These fields may reveal information about your mental health; that is special-category (health) data and is processed only with your explicit consent. Contact details: name, e-mail, phone - stored separately from the request itself. Account: e-mail address and one-time sign-in codes (there is no password). Your accept/decline decisions on offers. Source of the request: which site and which page you came to us from (see Visitors).
Psychologists (Seansly Clinic). Name, e-mail, phone, title, country and city, the languages you work in, topics, the groups you work with, approaches, profile text, session fee and currency; optional bank details (sent only to the client who accepted you, in the payment reminder); licence country, registry/registration number and the documents you upload (private storage, visible only to you and the reviewer); verification status and reason; credit movements and orders; the offers you send; which page you signed up from (signup source - it does not identify you, it stores only a page name) and where you came to the site from before signing up (see Visitors). How you use Seansly Clinic: which screen and tab you had open and active, when and for how long (only the screen and tab name, the start time and the active time). Client names, the content of your records, the identifiers in the address bar, your IP address and browser details are not part of this measurement; nothing is written to your browser (no cookie, no storage), and no screen recording or third-party analytics tool is used. Only the Seansly team sees this data.
Clinic tools. Client files, appointments, homework and mood logs you keep in Seansly Clinic are the psychologist's own professional records; the psychologist is the controller of those records and Seansly is the processor. Session notes and the clinical card are open only to the psychologist's own account; other psychologists and clients cannot see them. As processor, Seansly handles this content only to run the service and on the psychologist's instructions.
Visitors. One functional cookie (language, the language you chose, 1 year). We use no analytics, advertising or tracking cookies. We keep the first page you visit, only the domain name of the site that referred you (for example a search engine) and the campaign tag in the link (utm) in your browser tab's session storage (sessionStorage; not a cookie, deleted when the tab closes). It leaves your browser only with a request form you send yourself or when you sign up to Seansly Clinic, and is added to your request or account; it does not identify you, does not follow you across other sites and is not shared with anyone. Server logs (IP address, request time) are kept for a short period for security and fault diagnosis only.
4. Purposes and legal bases
| Purpose | Basis (GDPR) |
|---|---|
| Showing your request to matching psychologists, delivering offers, opening contact after acceptance | Performance of a contract - Art. 6(1)(b); explicit consent for health data - Art. 9(2)(a) |
| Account creation, sign-in codes, notification e-mails | Performance of a contract |
| Psychologist verification at the psychologist's request (licence/document review) | Performance of a contract and legitimate interest (client safety) |
| Credit movements, orders and accounting records | Legal obligation |
| Abuse and spam prevention, rate limiting, security | Legitimate interest |
| Measuring the signup and request source (which page and which site you came from) | Legitimate interest; no individual tracking |
| Measuring how Seansly Clinic is used (which screen, when, for how long), improving the service and helping psychologists who struggle with it | Legitimate interest; no content or client data, right to object |
| Founding-psychologist invitations (see 8) | Legitimate interest; right to object |
5. Who we share data with
- Psychologists. Your request is shown to psychologists registered with Seansly Clinic whose declared expertise matches it, with your contact details masked. Your name, e-mail and phone are shared only with the one psychologist you accept.
- Clients. When you send an offer, your name, title and offer are visible to the client who posted the request.
- Our processors. Database and authentication: Supabase (AWS eu-west-1, Ireland). Application servers: Hetzner Online GmbH (Nuremberg, Germany). E-mail delivery: Resend (EU region). Domain name resolution: Cloudflare (DNS only; no traffic content passes through it). Encrypted copy of the nightly backups: Google (Google Drive). Mobile app notifications: Expo (USA); Apple's or Google's notification service delivers them to your phone; a notification carries only a short fixed text, never your name or the content of your request. When credit purchases open, the payment provider will be added to this notice.
- We do not sell personal data and do not share it with advertising networks. We may disclose data to authorities where the law requires it.
6. International transfers
Service data is processed on servers in the European Union: Supabase (Ireland), Hetzner (Germany) and Resend (EU region); Cloudflare only resolves the domain name. There are two exceptions. The encrypted copy of the nightly backups is stored on Google Drive, and Google's storage locations are not limited to the EU; the copy is encrypted before it leaves our server, the key stays with us and Google cannot read its content. Mobile notifications are sent through Expo (USA) and carry neither your name nor the content of your request. For users located in Türkiye, processing by these processors is a transfer abroad under Article 9 of the Turkish Personal Data Protection Law (KVKK). That transfer rests not on consent but on the appropriate safeguards provided for in Article 9 KVKK, namely standard contractual clauses with our processors; this notice informs you of its scope.
7. How long we keep data
- An open request: until you choose a psychologist or cancel it.
- Contact details of an expired or cancelled request are deleted 30 days later.
- Account data until you delete your account; clients can download their data and delete their account from My account.
- Psychologist documents for the duration of the review and while the account is open; credit and order records for the statutory retention period.
- Backups: nightly backups are kept on our server for 7 days; of the encrypted copies on Google Drive, daily copies are kept for 14 days, weekly copies for 8 weeks and monthly copies for 12 months, and an expired copy is removed automatically from the Google Drive trash 30 days later. A deleted record can therefore remain in backups for up to 13 more months; a file deleted from document storage also leaves the backup within 45 days.
- Seansly Clinic usage measurement (screen, tab, time, duration) is deleted after 180 days.
- Sign-in codes are short-lived and invalid after use.
8. Founding-psychologist invitations - notice under GDPR Article 14
To invite you to the founding-psychologist programme in your country, we may collect professional contact details only (name, title, organisation, business address or business e-mail) from publicly available professional sources (official registers, professional-body listings, practice websites). The sole purpose is the invitation. At first contact we tell you the source and your rights; you can object in one step and we never contact you again. These details are not published on the site and no profile is created in your name. The contact channel follows the rules of your country; e-mail is used only where it is permitted.
9. Your rights
You have the right of access, rectification, erasure, restriction, data portability, objection and withdrawal of consent. Clients can download their data as JSON and delete their account from My account; for anything else, write to hello@seansly.co. When you delete your account or unlink from a psychologist, the mood logs and homework answers you sent that psychologist through Seansly stay in their client file: they are the psychologist's independent professional record, and the psychologist is their controller (see 3, Clinic tools). To have them deleted, contact your psychologist directly; while you are linked, they are included in the file you download from My account. We answer within 30 days at the latest. You may lodge a complaint with a supervisory authority: in Türkiye, the Personal Data Protection Board; if you are in the European Union, the data protection authority of your own country.
10. Security
All traffic is encrypted with TLS. Row-level access rules apply in the database; documents live in private storage; only the psychologist who wrote them can access session notes; system access is limited to what a role needs.
11. Children
Requests are opened by people aged 18 or over. For a child under 18, a parent or guardian opens the request; information about the child is processed with the parent's consent and only to find a suitable professional.
12. Changes
When we update this notice, the date and version number change; we notify material changes to your registered e-mail address.