Privacy policy

1. Identity of the Data Controller

Kooplia is a service published by Kooplia SAS, whose head office is located in France.

• Contact email : contact@theralink.io
• Data Protection Officer (DPO) : dpo@theralink.io

2. Data Collected

2.1 Therapist (user) data

• Name, first name, email address
• Phone number
• Business address and postal code
• Billing and subscription information

2.2 Patient data (entered by the therapist)

Kooplia allows the therapist to enter and manage the following data relating to their patients. These data are described as health data within the meaning of Article 9 of the GDPR:

• Identity: last name, first name, date of birth, gender
• Contact details: email, telephone, address
• Relationship information: marital status, type of relationship
• Therapy notes and session reports
• Audio transcriptions of sessions
• Individual, relational and professional therapeutic objectives
• Genogram (family and relationship tree)
• Information about children and those around them
• Documents and images related to the sessions

3. Purposes and Legal Basis of Processing

4. Health Data — Enhanced Protection

Health data is sensitive data within the meaning of article 9 of the General Data Protection Regulation (GDPR). Their processing is subject to strict conditions:

• The therapist must collect the explicit consent of its patients before entering their information into Kooplia.
• The processing is carried out under the responsibility of a healthcare professional subject to professional secrecy (Art. 9.2.h).
• Data is encrypted in transit (TLS) and at rest (Google Cloud).
• Access to data is strictly limited to the therapist who entered them.

5. Subcontractors and Data Transfers

No data transfer is made outside the European Economic Area (EEA). Google Cloud operates under standard contractual clauses (SCCs) approved by the European Commission.

6. Shelf Life

• Therapist data : kept for the duration of the account, then deleted within 30 days after closure.
• Patient data : kept in accordance with the legal obligations of the therapist (20 years — CNIL). The therapist can delete a patient file at any time.
• Audit logs : 5 years.
• Billing data : 10 years (accounting obligation).

7. Rights of Data Subjects

In accordance with the GDPR (articles 15 to 22), you have the following rights:

• Right of access (Art. 15) — Obtain a copy of your data.
• Right of rectification (Art. 16) — Correct your inaccurate data.
• Right to erasure (Art. 17) — Request deletion of your data.
• Right to limitation (Art. 18) — Restrict processing.
• Right to portability (Art. 20) — Receive your data in a structured format.
• Right to object (Art. 21) — Object to the processing.

To exercise these rights, contact us at: dpo@theralink.io

You can also file a complaint with your national supervisory authority (CNIL — www.cnil.fr).

8. Data Security

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Secure authentication via Firebase Auth (Google SSO)
• Firestore security rules limiting access to the owner therapist only
• No access to patient data by the Kooplia team
• Logging of access and modifications

9. Cookies

Kooplia uses cookies that are strictly necessary for the operation of the service (authentication, session). No third-party tracking, advertising or analytics cookies are used.

10. Changes to this Policy

This policy may be modified to reflect regulatory or functional developments. In the event of a substantial modification, users will be informed by email or via the application.