Privacy Policy

1. Data controller

The controller of the personal data collected through the Therago platform (the "Platform") is the publisher of Therago: WIZE SRL (CBE 0691.653.847), Allée des Chanterelles 14, 5101 Erpent, Belgium, reachable at privacy@wize.be. For the data that therapists process in the course of their own activity, each therapist is the data controller; Therago then acts as a processor (see the Professional Terms of Use).

2. Data we process

We process the following categories of data:

• Account data: name, email address, password (hashed), phone number, preferred language.
• Therapist profile data: identity, titles and diplomas, INAMI/RIZIV or ComPsy number, photograph, description of the practice, fees, consultation addresses, identity verification data (via Stripe Identity).
• Appointment data:patient's name, email and phone number, practitioner consulted, date and time, location or video link.

Health data: the mere fact of booking an appointment with a therapist (psychologist or wellness practitioner) reveals information about your health and therefore constitutes health data within the meaning of Article 9 GDPR. This processing is based on your explicit consent, collected at the time of booking (Art. 9(2)(a) GDPR). You may withdraw this consent at any time (see section 6).

3. Purposes and legal bases

• Providing the service (account creation, booking and managing appointments, confirmation and reminder notifications): performance of the contract (Art. 6(1)(b) GDPR) and, for health data, explicit consent (Art. 9(2)(a) GDPR).
• Billing of therapists' subscriptions: performance of the contract and legal obligation (accounting, tax).
• Security, abuse prevention and improvement of the Platform (logging, rate limiting): legitimate interest (Art. 6(1)(f) GDPR).
• Non-essential communications (where applicable): consent (Art. 6(1)(a) GDPR).
• Responding to requests from authorities: legal obligation (Art. 6(1)(c) GDPR).

4. Recipients and processors

Your data is accessible to the therapist with whom you book an appointment, as well as to our technical processors, strictly to the extent necessary:

• Hosting: Microsoft Azure (European Union region).
• Stripe: payment processing and identity verification of therapists (Stripe Identity).
• Email provider: sending of transactional emails (confirmations, reminders, notifications).
• Twilio: sending of SMS reminders.

Some of these providers may process data outside the European Union. In that case, transfers are governed by appropriate safeguards, in particular the standard contractual clauses adopted by the European Commission, supplemented where necessary by additional measures. We never sell your data.

5. Retention periods

• Account data:duration of the registration. When the account is deleted ("Delete my account" button or request by email), name, email address, phone number, password and sessions are erased or anonymised immediately.
• Appointment data:3 years after the appointment; after that, the email, phone number and relative's birth date are erased automatically (daily purge), only the name and the session remain. When a patientaccount is deleted, their past appointments are immediately reduced to their name (no email, phone, relative's birth date or link to the account), for the practitioners' own follow-up. When a practitioneraccount is deleted, their patients keep their past appointments in their history, with the practitioner's name as it was at the time of deletion; those appointments keep the patients' contact details for 3 years after the session, then they are purged. Reviews received by a deleted practitioner are kept anonymised (author "Client") and are no longer published.
• Therapists' subscription invoices: 7 years (accounting obligation), with our payment provider.
• Sending log (emails, SMS and WhatsApp messages sent, without their content): 24 months, then automatic deletion. When an account is deleted, the recipients concerning it are masked immediately.
• Administration log (support actions performed on an account, without their content): kept for traceability; when an account is deleted, the identifiers concerning it are masked or removed immediately.
• Anti-fraud fingerprint: when a therapist account is deleted, a technical fingerprint (salted hashes of the email address, phone number and verified identity, with no readable data) is kept for 24 months. Its only purpose is to avoid granting the free trial twice to the same person: legitimate interest (Art. 6(1)(f) GDPR), prevention of trial abuse.
• Technical logs: 12 months.

Longer periods may apply where required by law (for example accounting obligations) or in the event of a dispute, for its duration.

6. Your rights

In accordance with Articles 15 to 22 GDPR, you have the following rights: right of access, right to rectification, right to erasure, right to restriction of processing, right to data portability, right to object (in particular to processing based on legitimate interest) and the right to withdraw your consent at any time, without this withdrawal affecting the lawfulness of the processing carried out before the withdrawal.

Two of these rights can be exercised directly from your account, without writing to us: the "Download my data" button (access and portability: an archive of your data in an open format) and the "Delete my account"button (erasure), available under "My account" for patients and under "Settings" then "Account" for therapists. Deletion is immediate and permanent; section 5 describes what is kept and why.

For the other rights, or if you prefer to go through us, contact us at privacy@wize.be. We respond within one month, extendable by two months for complex requests. Proof of identity may be requested.

7. Complaints

If you believe that the processing of your data violates the GDPR, you may lodge a complaint with the Belgian Data Protection Authority: Rue de la Presse 35, 1000 Brussels — www.dataprotectionauthority.be.

8. Security

We implement appropriate technical and organisational measures to protect your data, including: encryption of communications in transit (TLS), strict access control to data based on the principle of least privilege, password hashing, and logging of access and sensitive operations.

Version of 29 October 2026.