PsyHealthOK

Privacy Policy

Effective date: 2026-07-18

1. Who we are

PsyHealthOK ("we", "us", the "Platform") operates the online educational platform at app.psyhealthok.com and the marketing site at psyhealthok.com. The Platform is owned and operated by Olga Kucherenko, a sole proprietor registered in Ukraine. Contact: info@psyhealthok.com.

2. What this Platform is — and is not

PsyHealthOK is an educational platform. We publish self-paced courses, videos, articles, and interactive quizzes about anxiety, panic, health anxiety, social anxiety, and related topics, grounded in the academic literature on cognitive behavioural therapy (CBT).

The Platform is not a medical service. We do not diagnose, treat, cure, prevent, or provide medical advice for any disease or mental-health condition. We do not prescribe medication. Nothing on the Platform substitutes for consultation with a licensed physician, psychiatrist, or psychologist. If you are in crisis, contact local emergency services (112 in the EU, 911 in the US) or a crisis line in your country.

3. Data we collect

3.1 Information you give us

  • Account data: email, name, password hash, language preference.
  • Payment data: name, email, and billing details processed by our payment provider (we do not store full card numbers).
  • Course-progress data: lessons completed, quiz answers, video-watch events.
  • Communications: messages you send us by email, in-app inbox, or via our Telegram bot.

3.2 Information collected automatically

  • Technical data: IP address, browser type, device type, operating system, referring URL.
  • Usage data: pages viewed, time on page, clicks, search queries.
  • Cookies and similar technologies (see §7).

3.3 Information from third parties

  • If you sign in with Google, we receive your email, name, and Google account ID from Google.
  • If you message our Telegram bot, we receive your Telegram user ID, username (if public), and the messages you send.
  • Advertising platforms (Meta, TikTok, Google, YouTube) may share aggregated campaign performance.

4. Why we process data (legal basis under GDPR)

  • To provide the service — account creation, course access, progress tracking, customer support. Legal basis: performance of a contract.
  • To process payments — billing, invoicing, and access confirmation. Legal basis: performance of a contract and legal obligation.
  • To improve the platform — analytics, A/B testing, error monitoring. Legal basis: legitimate interest.
  • Marketing — email newsletters, retargeting ads, Telegram drip sequences. Legal basis: your consent, which you can withdraw at any time.
  • Legal compliance — tax records, court orders. Legal basis: legal obligation.

5. Third-party services we use

We share the minimum data necessary with the following processors, each under a data processing agreement:

  • Supabase (database and authentication) — EU region.
  • Hetzner (hosting) — Germany.
  • Amazon SES / Brevo (transactional email).
  • Google OAuth (sign-in).
  • Telegram (bot messaging).
  • WayForPay (payment processing) — Ukraine.
  • YouTube (embedded course videos, with privacy-enhanced mode where possible).
  • Google Analytics 4, Meta Pixel, TikTok Pixel (marketing analytics, set only after you consent to cookies).

6. International transfers

Some processors (Google, Meta, TikTok) transfer data outside the EU/EEA. Transfers rely on Standard Contractual Clauses approved by the European Commission and, where applicable, supplementary safeguards.

7. Cookies and tracking

We use strictly-necessary cookies to keep you logged in and to remember your language. We use analytics and advertising cookies only after you give consent through our cookie banner. You can withdraw consent at any time from your browser settings.

8. Data retention

  • Account and course-progress data: while your account exists, plus up to 3 years after deletion for legal and accounting purposes.
  • Payment records: 7 years (tax law).
  • Marketing data: until you unsubscribe or revoke consent.
  • Server logs: 90 days.

9. Your rights

Under GDPR and Ukrainian law, you have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate data.
  • Delete your data ("right to be forgotten").
  • Restrict or object to processing.
  • Receive your data in a portable format.
  • Withdraw consent at any time.
  • Lodge a complaint with your local data-protection authority.

To exercise any of these rights, email info@psyhealthok.com. We respond within 30 days.

10. Security

We use TLS 1.2+ in transit, encrypted storage at rest, password hashing, role-based access controls, and regular backups. No system is perfectly secure; we notify affected users and regulators of breaches as required by law.

11. Children

The Platform is for users aged 18 and over. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

12. Google API Services — Data Use Disclosure

PsyHealthOK operates an internal keyword-research and advertising-planning application called PsyHealthOK Search Question Graph (public page: /en/search-question-graph). Google API data used by that application is handled as follows:

  • Google OAuth authenticates authorized PsyHealthOK staff who use the application. No other identity provider grants access to Google API data.
  • Google Ads API data — accessible customer accounts, keyword ideas, search-volume estimates, competition and bid-range estimates — is used strictly for internal keyword and campaign planning by PsyHealthOK.
  • No client or health data is sent to Google Ads or to any other Google API. Client names, quiz answers, symptoms, diagnoses, health profiles, Telegram activity and video-viewing data are not sent by this application to Google Ads or to any other Google API.
  • Google API data is not sold, transferred to third parties, or exposed to clients or the public.
  • Google OAuth credentials are stored separately from operational data and access is restricted to authorized staff.
  • Authorized users can revoke this application's access at any time through their Google Account's connected-apps settings.
  • Use complies with the Google API Services User Data Policy, including the Limited Use requirements.

13. Changes to this policy

We may update this policy. Material changes are announced by email or in-app notice at least 14 days in advance. The "Effective date" at the top of this page reflects the most recent version.

14. Contact

For any privacy question, contact info@psyhealthok.com.