Privacy Policy

How Narcis collects, uses and protects your data. We work with sensitive health information, so we take privacy especially seriously.

Version: August 2026

1. General provisions

This Policy explains which personal data we process, for what purposes and on what legal grounds. We comply with the EU General Data Protection Regulation (GDPR) and with Ukrainian personal data protection law.

2. Who is responsible for your data

The data controller is the Narcis team. For privacy questions and to exercise your rights, write to the support email listed in the “Contacts” section. Therapists act as independent controllers in respect of the notes they keep as part of their own practice.

3. What data we collect

Account: name, email, language, role (client or specialist), hashed password.
Specialist profile: education, specialisations, methods, price, photo, video introduction, diploma.
Bookings and sessions: the time you chose, your booking history, payments and — with your consent — the session summary.
Technical data: access logs for security, and cookies needed for the site to work.

4. Health data and consent

Your therapy request and the content of your sessions belong to the special categories of data. We process them only on the basis of your explicit consent and solely in order to provide the service. You may withdraw your consent at any time.

5. Purposes and legal grounds

Performance of a contract (booking, payment, holding sessions); your consent (health data, AI summary, mailings); legitimate interest (security, preventing abuse); legal obligation (accounting, responding to requests from public authorities).

6. AI session summary

In short:

The AI does not listen to your session: the conversation is not recorded and nothing is sent to the AI.
The summary is built only from the notes the specialist writes themselves after the session.
A separate consent is required — both yours and the specialist’s. Without it the feature does not work.
You can go through therapy without the AI summary — it changes nothing else.

If you give consent, a short summary is generated automatically after the session from the specialist’s notes. The summary is available only to the participants of the session. You may choose not to give consent — this does not affect your access to therapy.

6а. Visit statistics

We run our own visit counter on our own server — with no cookies and with no data sent to Google or any other external service. To protect the service and analyse traffic sources we store the IP address of a visit for no longer than 180 days, after which it is erased automatically; the country is determined locally, without contacting third-party services. Video session pages are excluded from the statistics.

7. Who we share data with

With the specialist you choose; with payment providers in order to process a payment; with the video connection provider in order to hold the session; and, where needed, with the AI provider in order to generate a summary. We do not sell your data and do not pass it on for third-party advertising.

8. International transfers

Our audience is mainly in the EU. We aim to store and process data within the EEA, and where a transfer is necessary, to apply appropriate legal safeguards.

9. How long we keep data

Account data — for as long as the account is active. Payment documents — for the periods set by law. Health data is deleted or anonymised once its purpose has been fulfilled or consent has been withdrawn, except where the law requires otherwise.

10. Cookie

We use the cookies necessary for the site to work (session, language, cookie consent). You control them through the consent banner and your browser settings.

11. Security

Passwords are stored in hashed form, access to specialists’ documents is limited to the administration, and actions involving sensitive data are logged. We apply organisational and technical protection measures.

12. Your rights

You have the right of access, rectification, erasure, restriction and data portability, the right to object to processing, the right to withdraw consent, and the right to lodge a complaint with a supervisory authority. To exercise them, write to us.

13. Age

Only a person aged 18 or over may hold an account. A child’s or teenager’s data reaches us only when a legal guardian has created the account and given consent, and only to the extent needed to hold the sessions. We do not collect minors’ data without such consent.

14. Changes to this Policy

We may update this Policy. We will announce material changes on the site or by email. The current version is always available on this page.

15. Contacts

For privacy questions, get in touch through the Contacts page.