Privacy Policy

PothosCare helps coaches and therapists run their practice. Running a practice means handling personal and often sensitive information, so this policy explains, in plain language, what we collect, why, who we share it with and what control you have.

Who we are

This policy covers the website pothos.care and the PothosCare application at app.pothos.care. The controller responsible for your personal data is:

[TODO: legal name of the company and registry code]
Tornimäe tn 5, 10145 Tallinn, Estonia [TODO: confirm address]
Email: support@pothos.care [TODO: dedicated privacy address, e.g. privacy@pothos.care?]

Our role: your data and your clients’ data

PothosCare handles two different kinds of data, and our responsibility is different for each.

Your account data: we are the controller

When you, as a practitioner or organisation, sign up and use PothosCare, we decide how your account, subscription and billing data are used. This policy describes that processing.

Your clients’ data: you are the controller, we are the processor

When you add clients, sessions, notes, files, packages or invoices, you decide what is recorded and why. We process that data only on your instructions and only to provide PothosCare to you, as your processor under Article 28 of the GDPR. We do not use your clients’ data for our own purposes. [TODO: link to the Data Processing Agreement]

If you are a client of a practitioner who uses PothosCare, your practitioner is responsible for your data. Please contact them first with questions or requests about your records. We will help them answer you.

What we collect and why

Each purpose below has a legal basis under Article 6 of the GDPR. We keep data only as long as the purpose requires.

Purpose	Data	Legal basis	How long we keep it
Running the website securely	IP address, browser type, pages requested, time of the request (server logs)	Legitimate interest in keeping the site secure and working (Art. 6(1)(f))	[TODO: log retention, e.g. 14 days]
Your account	Name, email address, password (stored only as a secure hash), organisation, role, profile details you add	Performance of our contract with you (Art. 6(1)(b))	While your account is active, then [TODO: deletion period after closing the account]
Signing in with Google (optional)	Name, email address and profile picture from your Google account	Performance of our contract with you (Art. 6(1)(b))	While your account is active
Fixing errors in the app	Technical details of errors: browser, page, time and error message. Configured not to include personal data.	Legitimate interest in a reliable service (Art. 6(1)(f))	[TODO: Sentry retention period]
Subscription and billing	Plan, billing name and address, VAT number if provided, invoices, payment status	Contract (Art. 6(1)(b)) and legal obligation to keep accounting records (Art. 6(1)(c))	Invoices and accounting records for 7 years, as required by Estonian accounting law [TODO: confirm]
Support and messages	Your messages to us and the details you share in them	Contract (Art. 6(1)(b)) or legitimate interest in answering you (Art. 6(1)(f))	[TODO: e.g. 2 years after the conversation ends]
Google Calendar and Zoom integrations	Connected account email address, OAuth tokens and the appointment details needed to create meetings and sync events, only for the services you connect, Google, Zoom or Microsoft Outlook (see Calendar and video integrations)	Contract (Art. 6(1)(b)), only after you connect the service	Until you disconnect the integration or close your account
Newsletter (when available)	Email address	Your consent (Art. 6(1)(a)), which you can withdraw with one click in every email	Until you unsubscribe

We do not make decisions about you based solely on automated processing, and we do not build advertising profiles.

Calendar and video integrations

Connecting Google Calendar, Zoom or Microsoft Outlook is optional. PothosCare accesses these accounts only after you authorise it, and only for the purposes below.

Google Calendar

If you choose to connect your Google account, PothosCare may access your Google account email address and Google Calendar events permission.

We use this access only to:

• identify and display the connected Google account;
• create Google Meet links for appointments you create in PothosCare;
• create, update, or delete calendar events related to appointments managed in PothosCare;
• sync eligible PothosCare appointments to your Google Calendar when you enable calendar sync.

PothosCare does not use Google user data for advertising, does not sell Google user data, and does not share Google user data with third parties except as necessary to provide the requested integration functionality.

We store OAuth tokens securely so the integration can continue working until you disconnect it. You can disconnect Google at any time from Settings > Integrations, which stops future access. You may also revoke access from your Google Account permissions page.

PothosCare’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Zoom

If you choose to connect your Zoom account, PothosCare may access your Zoom account email address and permissions needed to create, update, and delete Zoom meetings.

We use this access only to:

• identify and display the connected Zoom account;
• create Zoom meeting links for appointments you create in PothosCare;
• update or delete Zoom meetings when related appointments are changed or removed.

PothosCare does not sell Zoom user data, does not use Zoom user data for advertising, and does not share Zoom user data with third parties except as necessary to provide the requested integration functionality.

We store OAuth tokens securely so the integration can continue working until you disconnect it. You can disconnect Zoom at any time from Settings > Integrations, which stops future access. You may also revoke access from your Zoom account’s added apps or marketplace settings.

Microsoft Outlook

If you choose to connect your Microsoft account, PothosCare may access your basic profile and email address and permission to read and write your Outlook calendar.

We use this access only to:

• identify and display the connected Microsoft account;
• create, update, or delete calendar events related to appointments managed in PothosCare;
• sync eligible PothosCare appointments to your Outlook calendar when you enable calendar sync.

PothosCare does not sell Microsoft user data, does not use it for advertising, and does not share it with third parties except as necessary to provide the requested integration functionality.

We store OAuth tokens securely, encrypted, so the integration can continue working until you disconnect it. You can disconnect Microsoft at any time from Settings > Integrations, which stops future access. You may also remove PothosCare from the apps and permissions settings of your Microsoft account.

Sensitive information about your clients

Session notes and files can contain health information and other special categories of data (Article 9 of the GDPR). As the controller, you choose the legal basis for recording it, for example the provision of health or social care, or your client’s explicit consent, and you inform your clients about it.

On our side, PothosCare is built for this kind of data: access depends on each person’s role, files and notes have their own visibility rules per client, and a sponsor who pays for a client’s sessions never sees clinical detail.

Cookies

Our website sets no cookies for visitors. It uses no analytics, no advertising and no social media trackers, and our fonts are hosted on our own server, so visiting pothos.care sends nothing to third parties.

The PothosCare application uses only two cookies, both strictly necessary for it to work. They do not require consent and cannot be switched off.

Cookie	Purpose	Duration
pothoscare_session	Keeps you signed in while you use the app	Expires after 2 hours without activity [TODO: Harun confirms production setting]
XSRF-TOKEN	Protects your account against forged requests	Same as the session

If we ever add analytics or other optional cookies, we will ask for your consent first and update this policy.

Who we share data with

We never sell personal data. We share it only with service providers who help us run PothosCare, under contracts that require them to protect it and use it only for our instructions.

Provider	What they do for us	Location
Hetzner Online GmbH	Hosting of the website, application and database	Nuremberg, Germany (EU)
Stripe	Card payments. Card details go directly to Stripe and never touch PothosCare.	EU, with transfers to the US [TODO: confirm Stripe entity]
PayPal	PayPal payments, when you choose PayPal	Luxembourg (EU) [TODO: confirm]
Google, Zoom, Microsoft	Calendar sync and meeting links, only when you connect them	EU and US
Brevo (Sendinblue SAS)	Sending account, reminder and billing emails	France (EU)
Sentry (Functional Software, Inc.)	Error monitoring for the app, configured not to send personal data	[TODO: Harun: EU or US region]
[TODO: server management, e.g. Ploi, if it has access to data]	Server management and backups	[TODO]

We may also disclose data when the law requires it, for example to a court or a public authority, and only to the extent required.

Transfers outside the EU

Our hosting is in the EU. Some providers above, such as payment and integration services, may process data in the United States. Where that happens, the transfer is protected by the EU–US Data Privacy Framework or by the European Commission’s Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.

How we protect your data

• All traffic to the website and the application is encrypted with HTTPS (TLS).
• Access inside an organisation follows each person’s role, and notes and files have visibility rules per client.
• Payments are processed by PCI-compliant providers, and we never store full card details.
• Access tokens for connected services and the payment credentials of organisations are stored encrypted.
• Daily database backups and server backups at our hosting provider in Germany protect against data loss.
• [TODO: encryption at rest for notes and files, once enabled in the app (Harun)]
• Only the people who need access to run and support PothosCare have it, and they are bound to confidentiality.

If a personal data breach puts your rights at risk, we will inform you and the supervisory authority as the GDPR requires.

Your rights

Under the GDPR you have the following rights. To use any of them, write to support@pothos.care. We answer within one month and may ask you to confirm your identity first.

You also have the right to lodge a complaint with a data protection authority, either in the EU country where you live or work, or with our lead authority, the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, www.aki.ee. [TODO: confirm the company is established in Estonia] We would appreciate the chance to resolve your concern first.

Children

PothosCare is a tool for professionals and is not directed at children. Practitioners who work with minors are responsible for obtaining any consent required from parents or guardians before recording their data.

Changes to this policy

We may update this policy when our service or the law changes. The date at the top shows the latest version. If a change significantly affects how we handle your data, we will tell you by email or in the app before it takes effect.

Contact us

Back to top