Privacy policy

1. Who we are

PsyPsy is operated by Audrey Lalonde, established in Québec. For any question, write to us at info@psypsy.ca.

PsyPsy is not a care service. We provide no treatment, make no diagnosis, and are not an emergency service. The professional relationship that follows a match is formed directly between you and the professional, under their own professional obligations.

Privacy officer

In accordance with the Act respecting the protection of personal information in the private sector (as amended by Law 25), the person responsible is Audrey Lalonde, founder of PsyPsy. You may write to her at info@psypsy.ca with any question, to exercise your rights, or to file a complaint.

2. What this policy covers

It applies to psypsy.ca and to the platform accessible from it, for all four account types: client, professional, clinic and PsyPsy administration.

It does not cover what happens after your match: once you become a professional's client, they become responsible for the information they collect in their practice, under the rules of their order.

3. Information we collect

If you are looking for a professional

Your consultation request contains: who it is for, the reasons chosen from the official taxonomy of the Ordre des psychologues du Québec (supplemented by a PsyPsy-specific assessment category, flagged as such), a free-text description if you write one, the type(s) of professional sought, language, preferred gender, meeting format, maximum distance, budget, third-party payer, your availability and, where applicable, your openness to a brief consultation (one to four sessions).

Sensitive information. A consultation reason reveals information about your health. Law 25 classifies such information as sensitive and requires your express, separate and informed consent. That is why the platform asks for an explicit confirmation when you submit your request, and logs that consent.

If your request concerns your child or someone close to you, the information identifying them is kept in a separate field, never visible to professionals until you have consented to lifting anonymity.

If you are a professional

Full name and title, profession, professional order and licence number, proof of licence, profile photo, biography, your practice location(s) (address and postal code), gender, languages, reasons you take on, services and rates, consultation formats, accepted third-party payers, availability and, where applicable, your clinic affiliations. If you are in training (doctorate in psychology, supervised psychotherapy internship): your status, the proof of registration or internship attestation, and your supervisor's name and email. We also keep the history of administrative decisions concerning you, so that we can account for them.

A government-issued piece of identification is requested at registration, solely to confirm that you are the person holding the licence. It is deleted as soon as your profile is approved — the file and its reference alike — and we keep no copy of it.

How long we keep each of these items — proof of licence, piece of identification, history of administrative decisions — is set out in section 8, “How long we keep your information”.

If you represent a clinic

Clinic name, address, Québec enterprise number, name and contact details of the contact person, phone, logo, and the list of affiliated professionals — each of whom has individually consented to that affiliation. When a clinic invites a professional who does not yet have an account, it provides us with their name and email: we use them only to send that invitation.

In all cases

• Consents: nature, date and time of each consent given or withdrawn.
• Notifications we send you, and whether they resulted in an email.
• If you enable push notifications: your device's technical subscription (a delivery address provided by Apple, Google or Mozilla), with nothing else.
• Feedback sent through the feedback module: your message, the page it came from, the device type and any attachments.
• Support thread: your exchanges with the PsyPsy team.
• Administration log: actions taken by our team on accounts.

What we do not collect

We use no audience measurement, advertising or behavioural tracking tools — no Google Analytics, no advertising pixel, no third-party statistics service. We do not sell, rent or trade any personal information. We do not ask for your day of birth, your health insurance number, or any financial data.

4. Account access by the administration

For support and diagnostic purposes, our team can access the platform seeing what you see. This access is reserved for senior administrators, limited to 30 minutes, and flagged by a visible banner throughout.

Your private messaging with a professional is excluded from it, for reading as well as writing: the PsyPsy team cannot read the content of those exchanges, even during such a session. Every session is logged: who, which account, when, from which address and which browser.

5. Why we use this information

No decision producing a legal effect is made on a solely automated basis. Matching a request with professionals is a display filter: it is the professional who decides to contact you, and you who decide to accept.

6. The anonymity principle

When you submit a request, verified professionals see the reason, the type of professional sought, the language, the approximate area, the budget, the availability and your free-text description. They do not see your name, your email, your phone, your exact address, or the information identifying the person concerned if it is not you.

This separation is enforced at the database level: professionals read requests through a technical view that simply does not contain the identifying fields. It is not a display filter that a workaround could defeat. Your identity is shared only when you authorize it, for one specific professional.

An honest caveat: your free-text description is a field you fill in yourself. If you write your name or phone number in it, professionals will see it. The platform reminds you of this as you type.

7. Who this information is shared with

Professionals, under the rules above. Clinics, when a professional has confirmed their affiliation: the person managing the clinic then accesses the same information as the professional, and no more. The supervisor of a person in training, once the supervision is accepted on both sides: they access the same information as the supervised person, including your exchanges and, if you revealed it, your identity — their profile tells you so before you reply. As part of the supervision, the person in training may also share information about your follow-up with them, under the rules of their professional order.

Public directory of professionals

A professional may consent to their profile (name, title, profession, practice locations, services) appearing in the platform's public directory. That consent is separate, optional and withdrawable at any time from their account; withdrawing it removes the profile from the directory.

Our providers

Technical error tracking

When the platform encounters an error, a technical report is sent to Sentry so that we can fix it. These reports are configured to contain no personal information: no name, no email, no IP address, and error messages go through automatic redaction before being sent.

One narrow exception: on the registration flow, and only in the event of a blocking error, a technical capture of the sequence is attached to the report so we can understand what prevented the registration. All text and images in it are fully masked, and no network details are included. Nothing is sent when registration proceeds normally.

Your information is stored in Montréal. However, the code that processes your requests currently runs on servers located in the United States: your information transits there in memory, for the duration of each request, without being stored. We are working to bring that execution back to Québec.

We share your information with no other third party, except where required by law — under a court order, for example. We would then limit ourselves to what is strictly necessary.

8. How long we keep your information

Deletion of requests. A request that expires, that you withdraw or that you mark as filled is not archived: it is permanently deleted, with no way to recover it. You are given time to renew it in one click — at least 48 hours for an expired or withdrawn request, 30 days for a filled one — and the time remaining is shown on the request itself. After that, only anonymous counts remain: how many requests were deleted that month, by reason category and by consultation mode, never cross-referenced and with no link to you. Neither your description, nor your availability, nor any other detail is kept.

Your conversations remain. A conversation opened with a professional is not deleted along with the request: it stays readable on both sides, but no one can write in it any more. Keeping it answers the professional's professional obligation to maintain records. If you would like a conversation deleted, write to us: we review each request case by case, with the professional concerned.

Account deletion. You can request it from your account. A 30-day grace period then opens, during which you can change your mind. At the end of it, your identifying information is irreversibly anonymized: what remains no longer identifies you and serves only to preserve the consistency of records.

9. Your rights

• Access the information we hold about you.
• Have it corrected if it is inaccurate or incomplete.
• Withdraw your consent, in particular to the distribution of your request.
• Request deletion of your account and anonymization of your information.
• Receive your information in a structured, commonly used technological format.
• Be informed of any automated use concerning you.
• File a complaint with the Commission d'accès à l'information du Québec if our response does not satisfy you.

Write to info@psypsy.ca. We respond within 30 days, free of charge. We may ask you to confirm your identity before acting — that is a protection for you.

10. Cookies

No advertising cookie, no audience measurement cookie, no third-party tracker. That is why you see no cookie consent banner on psypsy.ca: there is nothing to consent to beyond what is strictly necessary to operate.

11. Security

• All communications are encrypted in transit (HTTPS enforced).
• Passwords are stored as irreversible hashes — we cannot read them.
• Data access is controlled at the database level itself, table by table: a professional technically cannot read what is not meant for them, even in the event of an application defect.
• Sensitive documents are held in private storage.
• Administrative access is logged.
• We carry out regular security reviews and fix what they reveal.

No system is infallible. In the event of a confidentiality incident presenting a risk of serious injury, we would inform you and the Commission d'accès à l'information promptly. We keep an incident register, as the law requires.

12. Minors

A PsyPsy account must be created by a person of full age. A request for a child or teenager is submitted by their parent or guardian, who consents on their behalf.

13. Changes

Any significant change will be signalled to you by email or by a notice in your account, before it takes effect. The update date appears at the top of this document.

14. Contact us

Audrey Lalonde — privacy officer

info@psypsy.ca

Commission d'accès à l'information du Québec — the authority with which you may file a complaint. Its contact details are public on its website.