This notice explains what personal data TheraSocial collects, why, who can see it, how long it is kept, and how to use your rights. It describes how the platform works today.
Data:email, username, password (hashed), birth year, city
Shared with:Platform administrators
Kept:Until you delete your account
Well-Being Tracking
Purpose:To provide well-being diary and tracking features
Legal basis:Contract performance and consent
Data:mood, energy, sleep quality, physical activity, anxiety, social belonging, notes
Shared with:You, Users you grant access to via circles, Professionals you approve (only if you allow professional access)
Kept:Until you delete your account
Health-related information:Diary entries can reveal health information. They are recorded only when you choose to. Other members see them only through the circles you choose or a professional you approve. The AI provider receives them only to write the AI weekly summary and reflection prompts you open.
AI Weekly Summary
Purpose:To write your personal weekly well-being summary when you view it
Legal basis:Consent
Data:the last 7 days of diary scores (mood, energy, sleep quality, physical activity, anxiety), diary notes
Shared with:AI provider (Anthropic), which generates the summary text
Kept:Not stored by TheraSocial beyond the summary shown to you
Processed outside your country: Yes
AI Reflection Prompts
Purpose:To suggest a personal reflection question when you open a reflection prompt in your diary
Legal basis:Consent
Data:your last 5 diary entries (scores and the start of your notes, including earlier reflection answers)
Shared with:AI provider (Anthropic), which generates the prompt text
Kept:Not stored by TheraSocial beyond the prompt shown to you
Processed outside your country: Yes
Social Features
Purpose:To enable connections, messaging, and community features
Legal basis:Contract performance
Data:messages, posts, follows, circles
Shared with:Users you interact with
Kept:Until either person in the conversation deletes their account
Notifications
Purpose:To send alerts, reminders, and updates
Legal basis:Consent
Data:email, notification preferences
Shared with:Email service provider (Resend)
Kept:Until consent withdrawn
Processed outside your country: Yes
Security & Audit
Purpose:To protect your account and maintain platform security
Legal basis:Legitimate interest
Data:IP address, login times, security events
Shared with:Security team
Kept:Kept as security records; detached from your account when it is deleted
Hosting and Delivery
Purpose:To run the platform and deliver pages to your browser
Legal basis:Contract performance
Data:all platform data (stored and processed by the host), session data, IP address
Shared with:Render (application hosting and database), Redis session store (when configured), jsDelivr (serves the charting library; receives your IP address)
Kept:As listed for each data type above
Processed outside your country: Yes
Do you have to give us data?
You are under no legal obligation to provide personal data. An email address and birth year are needed to create an account; everything else, including diary entries, is optional and only limits the features you can use if you leave it out.
Your rights
Access: Use Export Data feature
Complaint: In Israel: the Privacy Protection Authority (gov.il). In the EU/EEA: your national data protection authority
Erasure: Use Delete Account feature
Objection: Contact support (see the Support page)
Portability: Use Export Data feature (JSON format)
Rectification: Use profile settings or contact support
Restriction: Contact support (see the Support page)
Stop marketing: Untick marketing in Privacy Settings (it is off unless you turned it on)
Withdraw consent: Use Privacy Settings
Complaints
You can contact us first, and you can also complain to a data protection authority: in Israel, the Privacy Protection Authority; in the EU/EEA, the authority in your country.
How your data is protected
All connections use HTTPS. Messages are shown only to you and the person you write to, and once you both turn on end-to-end encryption they are end-to-end encrypted. Other members see your diary entries only through the circles you choose or a professional you approve. The platform uses CSRF protection, secure sessions and a strict Content Security Policy.