GDPR Compliance

Last Updated: January 26, 2026

TerapiaPerTe is committed to compliance with the General Data Protection Regulation (GDPR). This page outlines how we protect your rights under GDPR and handle your personal data.

1. Lawful Basis for Processing

We process your personal data based on:

•Your consent for specific processing activities
•Performance of contract (providing therapy services)
•Compliance with legal obligations
•Legitimate interests in operating and improving our platform
•Protection of vital interests in emergency situations

2. Your Rights Under GDPR

You have the following rights:

Right to Access

You can request a copy of all personal data we hold about you

Right to Rectification

You can request correction of inaccurate or incomplete data

Right to Erasure (Right to be Forgotten)

You can request deletion of your personal data, subject to legal retention requirements

Right to Restriction

You can request limitation of how we process your data

Right to Data Portability

You can request your data in a structured, machine-readable format

Right to Object

You can object to processing based on legitimate interests or for direct marketing

Right to Withdraw Consent

You can withdraw consent at any time where processing is based on consent

Right to Lodge a Complaint

You can file a complaint with your local data protection authority

3. Data Controller

TerapiaPerTe acts as the data controller for personal information collected through our platform. Our Data Protection Officer can be contacted at:

[email protected]

4. Data Processors

We work with carefully selected third-party processors who assist in providing our services. All processors are bound by data processing agreements ensuring GDPR compliance. These include:

•Cloud hosting providers
•Payment processors
•Email service providers
•Analytics services
•Customer support tools

5. International Data Transfers

When we transfer data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including:

•Standard Contractual Clauses (SCCs)
•Adequacy decisions by the European Commission
•Binding Corporate Rules
•Your explicit consent when required

6. Data Protection Measures

We implement technical and organizational measures to protect your data:

•Encryption in transit and at rest
•Regular security assessments and penetration testing
•Access controls and authentication
•Staff training on data protection
•Incident response procedures
•Privacy by design principles

7. Data Retention Periods

We retain personal data only as long as necessary:

•Account information: Duration of account plus 6 months
•Medical records: As required by healthcare regulations (typically 7-10 years)
•Payment records: 7 years for tax purposes
•Communication logs: 3 years
•Marketing data: Until consent is withdrawn

8. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will:

•Notify the relevant supervisory authority within 72 hours
•Inform affected users without undue delay
•Provide details of the breach and mitigation measures
•Take immediate steps to contain and remedy the breach

9. Data Protection Impact Assessments

We conduct Data Protection Impact Assessments (DPIAs) for high-risk processing activities, particularly those involving sensitive health data. These assessments help us identify and mitigate privacy risks.

10. How to Exercise Your Rights

To exercise any of your GDPR rights:

1.Log into your account and visit Settings > Privacy
2.Submit a request via email to [email protected]
3.We will respond within one month (extendable to three months for complex requests)
4.We may require identity verification before processing requests
5.All requests are processed free of charge unless manifestly unfounded or excessive

11. Contact Our Data Protection Officer

For any GDPR-related questions or concerns: