Privacy policy

1. Who we are

PsyPsy is operated by Audrey Lalonde, established in Québec. For any question, write to us at info@psypsy.ca.

PsyPsy is not a care service. We provide no treatment, make no diagnosis, and are not an emergency service. The professional relationship that follows a match is formed directly between you and the professional, under their own professional obligations.

Privacy officer

In accordance with the Act respecting the protection of personal information in the private sector (as amended by Law 25), the person responsible is Audrey Lalonde, founder of PsyPsy. You may write to her at info@psypsy.ca with any question, to exercise your rights, or to file a complaint.

2. What this policy covers

It applies to psypsy.ca and to the platform accessible from it, for all four account types: client, professional, clinic and PsyPsy administration.

It does not cover what happens after your match: once you become a professional's client, they become responsible for the information they collect in their practice, under the rules of their order.

3. Information we collect

If you are looking for a professional

Your consultation request contains: who it is for (you, your child, someone close to you, your couple or your family), the month and year of birth and the gender of each person concerned, the reasons chosen from the taxonomy of the Ordre des psychologues du Québec (supplemented by PsyPsy-specific categories, flagged as such), a free-text description if you write one, the type(s) of professional sought, the preferred approach and techniques, whether you need a professional who practises psychotherapy, language, the professional's preferred gender, meeting format, maximum distance, your address if you want home visits, budget, third-party payer, your availability and, where applicable, your openness to a brief consultation (one to four sessions). For a child, we add the type of service sought, school level, the parents' situation and other professionals involved.

Sensitive information. A consultation reason reveals information about your health; some reasons may also reveal a legal situation (for example, court-ordered therapy). Law 25 classifies such information as sensitive and requires your express, separate and informed consent. That is why the platform asks for an explicit confirmation when you submit your request, and logs that consent.

If your request concerns your child or someone close to you, the information identifying them (name, date of birth, school, contact details of parents or other people) is kept in a separate field, never visible to professionals until you have consented to lifting anonymity. Your home address follows the same rule.

If you are a professional

Full name and title, profession, professional order and licence number, proof of licence, profile photo, biography, your practice location(s) (address and postal code), gender, languages, reasons you take on, services and rates, consultation formats, accepted third-party payers, availability and, where applicable, your clinic affiliations. If you are in training (doctorate in psychology, supervised psychotherapy internship): your status, the proof of registration or internship attestation, and your supervisor's name and email. We also keep the history of administrative decisions concerning you, so that we can account for them.

A government-issued piece of identification is requested at registration, solely to confirm that you are the person holding the licence. It is deleted as soon as your profile is approved — the file and its reference alike — and we keep no copy of it.

How long we keep each of these items — proof of licence, piece of identification, history of administrative decisions — is set out in section 8, “How long we keep your information”.

If you represent a clinic

Clinic name, address, Québec enterprise number, name and contact details of the contact person, phone, logo, and the list of affiliated professionals — each of whom has individually consented to that affiliation. When a clinic invites a professional who does not yet have an account, it provides us with their name and email: we use them only to send that invitation.

In all cases

• Consents: nature, date and time of each consent given or withdrawn.
• Notifications we send you, and whether they resulted in an email.
• If you enable push notifications: your device's technical subscription (a delivery address provided by Apple, Google or Mozilla), with nothing else.
• Feedback sent through the feedback module: your message, the page it came from, the device type and any attachments.
• Support thread: your exchanges with the PsyPsy team.
• Attachments you upload in messaging or in the support thread, kept in private storage.
• If you are a professional: the requests you file under “Not for me”, pausing your new requests and, when a request is full, the proposal draft you choose to keep.
• Administration log: actions taken by our team on accounts.

What we do not collect

We use no audience measurement, advertising or behavioural tracking tools — no Google Analytics, no advertising pixel, no third-party statistics service. The only exception, limited to fraud detection: Stripe's payment form (see “Payment”). We do not sell, rent or trade any personal information. We do not ask for your day of birth or your health insurance number. We never receive your card number: it is entered with Stripe (see “Payment”).

4. Account access by the administration

For support and diagnostic purposes, our team can access the platform seeing what you see. This access is reserved for senior administrators, limited to 30 minutes, and flagged by a visible banner throughout.

Your private messaging with a professional is hidden during such a session: the interface replaces it with a notice, and no message can be sent on your behalf. A session does, however, give our team the same technical rights as yours; we commit not to read the content of your exchanges. Each session is limited to 30 minutes and logged: who, which account, when, from which address and which browser.

5. Why we use this information

No decision producing a legal effect is made on a solely automated basis. Matching a request with professionals is a display filter: it is the professional who decides to contact you, and you who decide to accept.

6. The anonymity principle

When you submit a request, verified professionals see the reason, the type of professional sought, the language, the approximate area, the budget, the availability and your free-text description. They do not see your name, your email, your phone, your exact address, or the information identifying the person concerned if it is not you.

This separation is enforced at the database level: professionals read requests through a technical view that simply does not contain the identifying fields. It is not a display filter that a workaround could defeat. Your identity is shared only when you authorize it, for one specific professional.

An honest caveat: your free-text description is a field you fill in yourself. If you write your name or phone number in it, professionals will see it. The platform reminds you of this as you type.

7. Who this information is shared with

Professionals, under the rules above. Clinics, when a professional has confirmed their affiliation: the person managing the clinic then accesses the same information as the professional, and no more. The supervisor of a person in training, once the supervision is accepted on both sides: they access the same information as the supervised person, including your exchanges and, if you revealed it, your identity — their profile tells you so before you reply. As part of the supervision, the person in training may also share information about your follow-up with them, under the rules of their professional order.

Public directory of professionals

A professional may consent to their profile (name, title, profession, practice locations, services) appearing in the platform's public directory. That consent is separate, optional and withdrawable at any time from their account; withdrawing it removes the profile from the directory.

Our providers

Payment

When posting a request carries a fee, payment is made in a form provided by Stripe, displayed on PsyPsy (or, failing that, on a Stripe page). Your card number is entered with Stripe and never reaches our servers. We send Stripe the amount, your email address (for the receipt and the invoice) and a technical identifier of the request; nothing of its content. We keep a record of the payment (amount, date, discount applied, Stripe identifiers), with no card number. Stripe is based in the United States. To detect fraud, Stripe collects in this form characteristics of your device and of your browsing on the payment page; it never uses them for advertising. Stripe's script is only loaded on PsyPsy when you click “Pay”, and we have turned off its collection of signals on our own pages.

Technical error tracking

When the platform encounters an error, a technical report is sent to Sentry so that we can fix it. These reports are configured to contain no personal information: no name, no email, no IP address, and error messages go through automatic redaction before being sent.

One narrow exception: on the registration flow, and only in the event of a blocking error, a technical capture of the sequence is attached to the report so we can understand what prevented the registration. All text and images in it are fully masked, and no network details are included. Nothing is sent when registration proceeds normally.

Your information is stored in Montréal, and the code that processes your requests also runs in Montréal. Site pages travel through Vercel's global delivery network, and the providers in the table above located outside Canada receive only what their role requires.

We share your information with no other third party, except where required by law — under a court order, for example. We would then limit ourselves to what is strictly necessary.

8. How long we keep your information

Request deadline. While a conversation with a professional is ongoing (a message from you within the last 7 days) or a proposal is awaiting your answer, the deadline is pushed back 7 days at a time, up to 90 days; beyond that, we ask you to confirm you are still looking. A request paused because you accepted an appointment, a call or an arrangement gets a follow-up question; with no answer 21 days later, it is marked as filled — you can reopen it.

Deletion of requests. A request that expires, that you withdraw or that you mark as filled is not archived: it is permanently deleted, with no way to recover it. You are given time to renew it in one click — at least 48 hours for an expired or withdrawn request, 30 days for a filled one — and the time remaining is shown on the request itself. After that, only anonymous counts remain: how many requests were deleted that month, by reason category and by consultation mode, never cross-referenced and with no link to you. Neither your description, nor your availability, nor any other detail is kept.

Your conversations remain. A conversation opened with a professional is not deleted along with the request: it stays readable on both sides, but no one can write in it any more. Keeping it answers the professional's professional obligation to maintain records. If you would like a conversation deleted, write to us: we review each request case by case, with the professional concerned.

Account deletion. You can request it from your account. A 30-day grace period then opens, during which you can change your mind. At the end of it, your identifying information is irreversibly anonymized: what remains no longer identifies you and serves only to preserve the consistency of records.

9. Your rights

• Access the information we hold about you.
• Have it corrected if it is inaccurate or incomplete.
• Withdraw your consent, in particular to the distribution of your request.
• Request deletion of your account and anonymization of your information.
• Receive your information in a structured, commonly used technological format.
• Be informed of any automated use concerning you.
• File a complaint with the Commission d'accès à l'information du Québec if our response does not satisfy you.

Write to info@psypsy.ca. We respond within 30 days, free of charge. We may ask you to confirm your identity before acting — that is a protection for you.

10. Cookies

The platform also keeps a few preferences and drafts in your browser's storage, without sending them to anyone: request draft (7 days), message and proposal drafts, language choice, request sort order, app installation notice. You can clear them by deleting the site's data in your browser.

No advertising cookie, no audience measurement cookie, no third-party tracker outside payment. That is why you see no cookie consent banner on psypsy.ca: there is nothing to consent to beyond what is strictly necessary to operate.

11. Security

• All communications are encrypted in transit (HTTPS enforced).
• Passwords are stored as irreversible hashes — we cannot read them.
• Data access is controlled at the database level itself, table by table: a professional technically cannot read what is not meant for them, even in the event of an application defect.
• Sensitive documents are held in private storage.
• Administrative access is logged.
• We carry out regular security reviews and fix what they reveal.

No system is infallible. In the event of a confidentiality incident presenting a risk of serious injury, we would inform you and the Commission d'accès à l'information promptly. We keep an incident register, as the law requires.

12. Minors

A PsyPsy account must be created by a person of full age. A request for a child or teenager is submitted by their parent or guardian, who consents on their behalf.

13. Changes

Any significant change will be signalled to you by email or by a notice in your account, before it takes effect. The update date appears at the top of this document.

14. Contact us

Audrey Lalonde — privacy officer

info@psypsy.ca

Commission d'accès à l'information du Québec — the authority with which you may file a complaint. Its contact details are public on its website.