Privacy notice

1. Who is responsible for your information

PsiloAtlas is the data controller for personal information used to operate this directory and its listing services. This notice describes our practices, not those of independent treatment providers or external websites.

2. Information collected and why

Accounts: email, account identifiers, authentication credentials or sign-in tokens, and account activity are processed to create accounts, secure access and provide saved listings and the provider portal. Authentication services handle credentials; never send us your password through a contact form.

Provider inquiries: name, email, optional phone, preferred dates, preferences and message are used to record and handle your inquiry and allow follow-up by the selected provider. Please do not include diagnoses, medical records or other sensitive health details. If you voluntarily include them, they may be seen by PsiloAtlas staff and the selected provider; this is not a clinical intake system.

Provider administration: work contact details, business information, claims of authority, proposed edits, ownership records and review history are used to verify listing control, review changes and manage the portal. Approved listing information is public; private claim details are not published merely because you submit them.

Support and press: name, email, inquiry type, optional organization and message are used to respond and manage support, media and partnership correspondence.

Technical information: hosting and service providers may process IP addresses, device/browser information, request logs, usage statistics and error or security events to deliver pages, maintain reliability, understand aggregate traffic and prevent fraud or abuse. Built-in site traffic statistics cannot distinguish visits made by the site's own operators from visits by other people.

3. Legal bases

Where applicable data-protection law requires a legal basis, we rely on contract performance for accounts and requested listing services; legitimate interests for responding to requested inquiries, verifying provider authority, operating and securing the site and handling support; consent for optional processing that requires it; and legal obligations for records or disclosures required by law. We consider the impact of legitimate-interest processing on your rights. You may object where the law provides that right and withdraw consent without affecting prior lawful processing.

4. Inquiries and AI-assisted matching

Internal treatment inquiries are currently unavailable. Use the provider's published website or phone number to contact it directly; information submitted there is handled under the provider's own privacy practices. Existing inquiry records remain access-restricted for authorized administration and listing representatives. PsiloAtlas does not promise delivery, a response, availability or a booking.

When you use AI-assisted matching, your location, interests, practical needs and remote-care preferences are sent with relevant directory details to Lovable's AI service and its model provider to generate suggestions. Matching is informational, not medical advice or clinical screening. Do not enter sensitive health details. Our matching code does not save inputs or results as application records, but AI service providers may process service logs under their own retention practices; we do not promise zero retention. We do not use matching to make binding medical, eligibility or legal decisions about you.

5. Who receives information

Recipients may include authorized site staff; the selected provider for inquiries; hosting, authentication, database, operational email, AI and technical service providers needed to operate the service. External maps, fonts or linked sites may receive technical information when your browser requests their resources.

We may disclose necessary information to legal or accounting advisers, authorities when required by law, or to protect rights and security. A business transfer may involve relevant records subject to applicable law and appropriate notice. The current service does not sell contact addresses or inquiry records. Providers cannot access inquiries directed to other listings.

6. Retention and deletion

We retain account information while the account is needed; inquiries and support records for follow-up, administration and legitimate dispute or security needs; previously submitted contact preferences until withdrawal or until no longer needed; and audit records for applicable legal obligations. Retention depends on the record and purpose rather than a single fixed period.

There is currently no automatic deletion schedule for inquiries, press messages or prior contact records. Requests for deletion are handled manually. We will delete or anonymize information when no longer needed, subject to lawful retention exceptions. Copies in backups and service-provider logs may persist under their retention cycles and security restrictions; deletion cannot recall information already received by an independent provider.

7. Your privacy rights

Depending on where you live and the law's applicability, you may request access, correction, deletion, portability, restriction or objection to processing; withdraw consent; and appeal a denied request or complain to a relevant regulator. Applicable U.S. state laws may also provide rights regarding sale, sharing or targeted advertising and protection against unlawful discrimination for exercising rights. Applicability depends on the relevant law, processing activity and statutory thresholds. Small size alone does not establish an exemption; protections concerning minors, biometric information, security, disposal and breach notification may apply separately.

Send requests using the contact form below. We may reasonably verify your identity without asking for unnecessary sensitive documents and will respond within applicable statutory deadlines. Where GDPR applies, rights include access, rectification, erasure, restriction, portability, objection, consent withdrawal and complaint to a supervisory authority; we normally respond within one month, subject to lawful extensions.

8. Security and international processing

We use appropriate technical and organizational measures, including encrypted connections and role-based access controls, to protect information. No system is perfectly secure, and this notice is not a guarantee against every incident. We do not claim the service is a confidential medical-record platform.

PsiloAtlas is a small, independently operated online service, and our service providers may process information in other countries. Where UK/EEA transfer rules apply, legally required safeguards must be used, such as applicable adequacy decisions or standard contractual clauses. This notice does not assert that every provider's hosting location or transfer arrangement has been independently verified; contact us for information relevant to your request.

9. Cookies and browser storage

Sign-in uses essential browser storage for sessions and security. Hosting and external resource providers may also use cookies or process technical requests under their own notices. No separate Google Analytics or marketing-pixel integration is currently configured in the application; built-in hosting traffic statistics may still operate. PsiloAtlas also keeps anonymous counts of listing views and contact clicks (website, phone, directions) to understand which listings are useful; these counts store no cookie, IP address or visitor identity.

You can manage cookies and site storage through your browser, sign out to end your account session. Blocking essential storage may prevent sign-in. This application currently has no optional-cookie preference panel; if optional analytics or marketing cookies are introduced, we will provide consent controls where required before using them.

Anonymous application activity

PsiloAtlas stores aggregate page paths, search counts, empty-result counts, map/compare actions and referral domains. It does not store search text, matching inputs, query strings, IP addresses, cookies or visitor identifiers in these event records. Private account paths are excluded. Staff can separate synthetic checks and exclude their browser from first-party application event collection; that browser setting does not control hosting statistics or other service logs. These are action counts, not unique people.

10. Children and notice changes

Accounts, listing services and inquiry tools are intended for adults aged 18 or older, not for collecting children's information. Contact us if you believe a child has submitted personal information. We will update the date above when practices change and provide additional notice where law requires it. This Privacy Notice describes data handling; it does not waive privacy rights or provide consent on your behalf.

Contact

For questions, privacy requests or rights-holder complaints, contact the PsiloAtlas team through the PsiloAtlas contact form. Select “Something else” and describe your request. Do not include medical records or identity documents.