Privacy Policy

1. Who is responsible for your data

The data controller is LLC "TOPOS ACADEMY OF PSYCHOLOGY", Limited liability company (OOO), tax ID 313 384 188, registration number 7495422, Republic of Uzbekistan, registered address: Tashkent, Yashnobod district, Semurg' MFY, Parkent ko'chasi, 30V (“we”, “us”). You can contact us about anything related to your personal data at hello@psitopos.com.

Specialists who give consultations are independent professionals. For the content of the consultation itself (what is said in the session and any notes the specialist makes), the specialist acts as an independent controller under the rules of their profession.

2. What data we process, why, and on what legal basis

• Account data (name, email address, password in hashed form, optional phone number, optional profile photo). Used to create and secure your account and to let you sign in. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Sign-in with Yandex ID (name and email provided by Yandex when you choose this option). Used only to sign you in. Legal basis: performance of a contract; the sign-in method is your choice and you can use email and password instead.
• Booking data (which specialist and time you chose, booking status, cancellations). Used to organise and manage your consultations. Legal basis: performance of a contract.
• Messages, mood check-ins and journal entries that you choose to write in your account. Used to provide these features to you. Because they can reveal information about your health, they are processed on the basis of your explicit consent (Art. 9(2)(a) GDPR), given by using the feature. You can withdraw consent at any time by deleting the entries or your account.
• Reviews you write about a specialist. Legal basis: legitimate interest in providing a trustworthy directory (Art. 6(1)(f)) and your consent where the review reveals health information.
• Payment data. Payments are currently switched off. If they are enabled, card or bank details are handled directly by the payment provider and are not stored by us; we only keep the payment status and amount. Legal basis: performance of a contract and compliance with legal obligations (accounting and tax).
• Technical data (IP address, browser and device data, security logs) and the cookies described in section 7. Used to run the Platform, keep it secure and prevent abuse. Legal basis: legitimate interest in the security and operation of the Platform (Art. 6(1)(f)).
• Correspondence with us (for example, support requests). Legal basis: legitimate interest in answering you, or performance of a contract.
• Compliance data (for example, records we must keep for accounting, tax or in response to lawful requests). Legal basis: legal obligation (Art. 6(1)(c)).

We do not sell your personal data and we do not use it for advertising or profiling. You are not required to provide data beyond what is needed for the features you use, but without it we may not be able to provide them.

3. Health information and consultations

The fact that you seek a consultation with a psychologist or psychosomatic specialist, and what you say in it, can be information about your health, which the GDPR treats as a special category of data. We process such data only where you have given explicit consent or where it is necessary to provide the service you asked for, and we limit access to it.

The video and audio of a consultation are transmitted in real time and are not recorded or stored by us.

Before a consultation, the client and the specialist are each separately asked whether they agree to an automatic text transcript (for example, for quality control). A transcript is made only if both agree. The audio is not stored at any stage; it is processed only at the moment of recognition and only the resulting text is saved. Access to transcripts is restricted to an authorised representative of ours with extended access rights; specialists and ordinary administrators cannot read other people's transcripts. Your consent is optional and can be withdrawn for future consultations at any time; declining does not affect your ability to use the Platform.

4. Who we share data with

We share personal data only with the following recipients, and only to the extent necessary:

• The specialist you book with — the name and contact details needed to hold the consultation.
• Service providers (processors) acting on our instructions: hosting and infrastructure; email delivery; the video service used to transmit the call in real time (without recording); the speech-recognition service used for transcripts (only with both parties' consent); and the payment provider when payments are enabled.
• Authorities and advisers where we are legally required to, or where needed to establish or defend legal claims.

We do not share your data with third parties for their own marketing purposes.

5. The “Psychea” AI assistant

“Psychea” is an optional AI chat assistant that helps you find your way around the Platform. If you use it, the messages you type are sent to an external AI language-model service (Yandex Cloud / YandexGPT) to generate a reply, with storage on the service's side disabled. We do not save chat texts in our database. The assistant does not make diagnoses and is not a substitute for a professional. Please do not enter health details, identity documents or payment data in the chat. Because this service may process data outside the European Economic Area (see section 6), using the assistant is entirely optional and the data is sent only when you choose to send a message.

6. Transfers outside your country / the EEA

We are established in Republic of Uzbekistan, and some of our providers may be located elsewhere. This means your data may be transferred to and processed in countries that are not covered by an EU adequacy decision. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses together with additional measures (for example encryption in transit), or, in limited cases, on your explicit consent for a specific transfer (Art. 49(1)(a) GDPR). You can ask us for information about the safeguards used at hello@psitopos.com.

7. Cookies and similar technologies

We use only strictly necessary cookies and local storage: a session cookie that keeps you signed in, security cookies, and a small entry that remembers that you have seen the cookie notice. These do not require consent under the ePrivacy rules. We do not use advertising, analytics or tracking cookies. If this changes, we will ask for your consent before setting any non-essential cookie.

8. How long we keep your data

• Account, booking, message, mood and journal data: for as long as your account exists; deleted or anonymised when you delete your account or ask us to, unless we must keep it longer by law.
• Consultation transcripts (if both parties consented): kept only as long as necessary for the quality-control purpose and deleted on request.
• Accounting and payment records: for the period required by the applicable tax and accounting law.
• Security and technical logs: for a short period needed to keep the Platform secure, then deleted.

9. Your rights

Under the GDPR and comparable laws you have the right to:

• access your data and receive a copy (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (Art. 17);
• restrict the processing of your data (Art. 18);
• receive your data in a structured, machine-readable format and transmit it to another provider (Art. 20);
• object to processing based on our legitimate interests (Art. 21);
• withdraw any consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3)); and
• lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work.

To exercise your rights, write to hello@psitopos.com. We will reply within one month. We may need to verify your identity first.

10. Security

We apply technical and organisational measures appropriate to the sensitivity of the data, including encryption of connections (HTTPS/TLS), hashed passwords, restricted access to the database and to transcripts, and regular software updates. No system is perfectly secure; if a personal data breach affects you in a way the law requires us to report, we will notify you and the competent authority.

11. Age

The Platform is intended for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact hello@psitopos.com and we will delete it.

12. Changes to this Policy

We may update this Policy from time to time. We will post the new version on this page and, for material changes, notify you in the Platform or by email.

13. Contact

LLC "TOPOS ACADEMY OF PSYCHOLOGY", Tashkent, Yashnobod district, Semurg' MFY, Parkent ko'chasi, 30V, Republic of Uzbekistan. Email: hello@psitopos.com.