Last updated: October 2026
Welcome to I'm Therapist ("we", "us", "our"). We operate the I'm Therapist platform, an AI-powered practice management and clinical support tool for mental health professionals (the "Service").
This Privacy Policy explains what information we collect when you use our Service, how we use that information, and the choices you have in relation to your data. We are committed to protecting your privacy and handling your data with care, transparency, and respect.
By creating an account or using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with any part of this policy, please do not use the Service.
The data controller responsible for your personal data is:
Digital eSolutions Limited
A company incorporated in Hong Kong
Contact email: support@imtherapist.com
If you have any questions about how your data is handled, or wish to exercise your rights, please contact us at the email address above.
A Data Processing Agreement (DPA) is available on request for organisations that require one. Please contact support@imtherapist.com to request a copy.
We collect information in three ways: information you provide directly, information collected automatically when you use the Service, and information entered into the platform as part of your clinical practice.
Account Information: When you register, we collect your name, email address, professional credentials (if provided), and password. You may also optionally provide information about your practice, therapy modalities, and professional background.
Usage Data: We automatically collect certain information about how you interact with the Service, including pages visited, features used, time spent on the platform, browser type, device information, and IP address. This data is used in aggregate to improve the platform.
Client Data Entered by Therapists: As part of using the Service, you may enter information about your clients, including session notes, treatment plans, and clinical observations. This data is entered by you and remains under your control. We act as a data processor for this information (see Section 6).
Communications: If you contact us by email or through our contact form, we retain that correspondence to assist you and improve our support.
Under the General Data Protection Regulation (GDPR), we must have a lawful basis for processing your personal data. The legal bases we rely on are:
We use the information we collect for the following purposes:
We do not sell your personal data to third parties. We do not use your client data or session content to train AI models without your explicit, informed consent.
All data is encrypted in transit and at rest using industry-standard encryption protocols. We use reputable cloud infrastructure providers that undergo regular third-party security audits.
Access to your data within our organisation is governed by strict role-based access controls. Only personnel who need access to perform their job functions are permitted to access platform data, and all access is logged and audited.
We conduct regular security reviews and penetration testing to identify and address vulnerabilities. In the event of a data breach that affects your data, we will notify you in accordance with applicable law.
While we take extensive precautions, no method of transmission over the internet or electronic storage is 100% secure. We encourage you to use a strong, unique password and to contact us immediately at support@imtherapist.com if you suspect any unauthorised access to your account.
Your personal data may be transferred to and processed in countries outside of your country of residence, including the United States. Our third-party service providers are based in the US, including:
Where personal data is transferred outside the European Economic Area (EEA) or the United Kingdom, we ensure appropriate safeguards are in place. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission as our primary transfer mechanism. Copies of the relevant SCCs are available on request by contacting support@imtherapist.com.
We understand that many of our users in the United States are subject to the Health Insurance Portability and Accountability Act (HIPAA). We are actively working through our formal HIPAA compliance programme and are committed to operating as a HIPAA-compliant Business Associate for therapists who require it.
We will enter into a Business Associate Agreement (BAA) with US-based therapists upon request. To request a BAA, please contact us at support@imtherapist.com.
Our security measures — including encryption in transit and at rest, access controls, audit logging, and incident response procedures — are designed to meet HIPAA's security requirements.
When you use I'm Therapist to manage client information, create treatment plans, or record session notes, you are the data controller for that information. You are responsible for ensuring you have the appropriate legal basis and consent from your clients to enter and process their personal data on the platform.
We act as a data processor for client data — we process it only on your instructions and in accordance with this Privacy Policy. We do not access, read, or use client data for any purpose other than providing and improving the Service.
As the data controller, you are responsible for complying with all applicable data protection laws in relation to your clients' personal data, including obtaining appropriate consent and responding to client data subject requests.
We retain your account information and clinical data for as long as your account is active, or as necessary to provide the Service. If you close your account, we will delete or anonymise your personal data within 30 days, unless we are required to retain it for legal compliance purposes (e.g. financial records).
You can request deletion of your account and all associated data at any time by emailing support@imtherapist.com. We will confirm the deletion within 30 days.
We strongly recommend exporting your clinical data before closing your account, as deletion is irreversible.
Depending on your location, you may have the following rights in relation to your personal data:
To exercise any of these rights, please contact us at support@imtherapist.com. We will respond to all requests within 30 days.
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):
We do not sell your personal information. We do not share your personal information for cross-context behavioural advertising. No "Do Not Sell or Share My Personal Information" opt-out is required because we do not engage in these practices.
Categories of personal information we collect: Identifiers (name, email address, IP address), internet or network activity (usage data, pages visited), and professional information (credentials, practice details).
Categories of sources: Directly from you (account registration, forms) and automatically (usage data, cookies).
Business purpose for collection: To provide and improve the Service, communicate with you, and comply with legal obligations.
Third parties with whom information is shared: Cloud infrastructure providers, AI service providers (Anthropic), analytics providers (Vercel), email service providers, and form processing providers (Formspree) — solely as necessary to operate the Service.
To exercise your California privacy rights, please contact us at support@imtherapist.com. We will verify your identity before processing your request and respond within 45 days.
We use cookies and similar technologies to operate and improve the Service. Cookies are small text files stored on your device.
We use the following types of cookies:
Analytics: We use Vercel Analytics, which is cookieless and privacy-friendly by default. It does not use cookies, does not track personal data, and does not require cookie consent under GDPR. Analytics data is aggregated and anonymised.
You can control cookies through your browser settings. Disabling essential cookies may prevent the Service from functioning correctly.
Do Not Track: Some browsers offer a "Do Not Track" (DNT) setting. There is currently no universally accepted standard for how to respond to DNT signals. At this time, we do not respond to DNT signals. If a standard is established in the future, we will review and update our practices accordingly.
We use a limited number of third-party services to operate the platform:
We do not use advertising networks or sell your data to any third-party for marketing purposes.
The Service is intended for use by licensed mental health professionals and is not designed for or directed at individuals under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, please contact us at support@imtherapist.com and we will take steps to delete that information.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you by email and/or by displaying a prominent notice on the platform at least 14 days before the changes take effect.
We encourage you to review this policy periodically. Your continued use of the Service after changes take effect constitutes your acceptance of the updated policy.
If you have any questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact us:
Email: support@imtherapist.com
We aim to respond to all privacy enquiries within 5 business days.
You also have the right to lodge a complaint with your local data protection authority if you are unsatisfied with our response.