Privacy Policy
Thank you for trusting It's Complicated. Your privacy matters to us, and we're committed to being transparent about how we collect, use, store, and protect your personal data. This document explains how we handle personal information across all user types, including clients, therapists, and corporate partners.
Don't want to read the full policy? Here are the key things you should know:
Key Points
- It’s Complicated is not a healthcare provider or a clinic. We do not offer therapeutic services ourselves, but connect clients with independent mental health professionals.
- We are not responsible for the content or quality of services provided by therapists on our platform.
- Your therapy sessions are private. We do not record, transcribe or store any online sessions held through our platform.
- We do not sell or trade your personal data.
- As independent data controllers under the General Data Protection Regulation (GDPR), therapists on our platform are responsible for certain personal data they collect in the context of providing therapy, such as messages, session notes, or clinical records. This data is handled by them, not by us.
Who we are
It’s Complicated (legal name: Mittelweg 50 Berlin GmbH) is a mental health platform that connects individuals, therapists, and organisations with therapeutic services and tools. You can reach us at:
Mittelweg 50 Berlin GmbH
Mittelweg 50, 12053 Berlin, Germany
Email: support@complicated.life
Website: www.complicated.life
For data protection matters, we work with DataGuard (legal name: DataCo GmbH). DataGuard acts as our official Data Protection Officer (DPO) in accordance with the GDPR of the European Union. Contact details:
DataCo GmbH
Sandstrasse 33, 80335 Munich, Germany
Email: datenschutz@dataguard.de
Website: www.dataguard.de
Roles and responsibilities
It’s Complicated is a two-sided marketplace connecting mental health practitioners (“therapists”) with people seeking therapy (“clients”). As a platform, we provide the technological infrastructure that enables communication, scheduling, sessions, and payment processing, but we are not a therapy provider ourselves. Under the GDPR, we act as the data controller for personal data related to your platform account, verification, payments, and general use of our services. Therapists, however, are independent data controllers for any personal data they collect and process in the context of providing therapy, including messages, invoices, and clinical records. For certain platform features such as chat or video tools, we act as a data processor on behalf of therapists, meaning we only process that data on their instruction and in accordance with our Data Processing Agreement (DPA; Art. 28 GDPR). If you want to exercise your data subject rights (such as access or deletion), you can contact us at support@complicated.life. We will handle the parts of your request that relate to data we control, and forward the rest to your therapist without undue delay, as they are responsible for responding to those parts. All staff at It’s Complicated are bound by confidentiality obligations and only access your data to the extent necessary to fulfil the purposes described in this policy.
Data collection and processing
The type of data we collect depends on your role and how you use our platform. Please check the section that applies to you:
- Data we collect from everyone
- Data we collect from clients
- Data we collect from therapists
Data we collect from everyone
When you visit our website, we collect certain data to make sure the site works properly, keep it secure, and help us improve our services. This applies to all website visitors, regardless of whether you sign up or use our services later on.
Visitor & marketing data
When you visit our website, we may automatically collect certain data to make the site work properly, keep it secure, improve our services, and, if you give consent, show relevant marketing content.
What data we collect:
- IP address, device, and browser information
- Usage data (e.g. pages visited, search inputs and selected filters in the therapist directories, interactions, time spent, errors)
- Cookies and marketing identifiers (if you consent to advertising cookies)
What we use it for:
- Operating and securing our website and platform
- Measuring and improving performance
- Understanding how visitors use our services
- Showing relevant advertising
Legal basis:
- Consent (Art. 6(1)(a) GDPR) for analytics, tracking, and advertising
- Legitimate interest (Art. 6(1)(f) GDPR) for operating and securing our platform
How long we keep your data:
- The data will be stored for 24 months from your last activity on our platform, provided that it is no longer required to achieve the above-mentioned purpose, you have not objected to its processing or requested its deletion, and no statutory retention periods prescribe otherwise.
Matching service
If you need help finding the right therapist, you can use our matching survey to get personalised therapist recommendations.
What data we collect:
- Your answers to the questionnaire (e.g. session preferences, language, therapy topics, type of support you’re seeking)
What we use it for:
- Recommending suitable therapists based on your answers
- Improving our matching algorithm and service
Legal basis:
- User´s explicit consent (Art. 6(1)(a) GDPR in conjunction with Art. 9 (2) a GDPR)
- Legitimate interest (Art. 6(1)(f) GDPR)
How long we keep your data:
- The data will be stored for 24 months from your last activity on our platform, provided that it is no longer required to achieve the above-mentioned purpose, you have not objected to its processing or requested its deletion, and no statutory retention periods prescribe otherwise.
Contact and support requests
Depending on who you are and what you need, there are different ways to get in touch with us. For example, by using the contact form on our website, submitting a support ticket, or booking a demo with our sales team.
What data we collect:
- Name and contact details (e.g. email address)
- Message content and any information you provide in your request
What we use it for:
- Responding to your request and providing support
- Following up on demo bookings and press, sales, partnership, or other inquiries
Legal basis:
- Legitimate interest (Art. 6(1)(f) GDPR) for handling all inbound requests and activities
How long we keep your data:
- The data will be stored for 24 months from your last activity on our platform, provided that it is no longer required to achieve the above-mentioned purpose, you have not objected to its processing or requested its deletion, and no statutory retention periods prescribe otherwise.
Data we collect from clients
Below you can find an overview of the data we collect if you create a client account and use our platform to find a therapist, book or attend therapy sessions, or access mental health resources.
Registration and account data
When you sign up as a client and create an account, we collect certain data to register you, manage your account, and provide our services. Some of this information is required to create the account, while other details are optional and can be added and changed later in your profile settings.
What data we collect:
- Email address (for login, verification, and essential communication)
- Name (can be a nickname)
- Password (stored in encrypted form)
- User type (client or therapist)
- Language, time zone
- Marketing communication and newsletter subscription preferences
- EAP access code (for employees of partner companies)*
- Profile picture*
What we use it for:
- Creating and managing your account
- Verifying your identity and securing your access
- Sending essential service emails (e.g. verification, password reset)
- Sending marketing communications and newsletters (only with your consent)
- Giving eligible users access to company benefits (EAP)
Legal basis:
- Contractual necessity (Art. 6(1)(b) GDPR) for required fields such as email address, password, or language
- Legitimate interest (Art. 6(1)(f) GDPR) for account security and fraud prevention
- Consent (Art. 6(1)(a) GDPR) for optional fields such as profile picture, and for marketing communications and newsletter subscription
How long we keep your data:
- The data will be stored for 24 months from your last activity on our platform, provided that it is no longer required to achieve the above-mentioned purpose, you have not objected to its processing or requested its deletion, and no statutory retention periods prescribe otherwise.
Appointment and session data
When you use our platform to book or attend sessions, or communicate with your therapist, we collect and process certain data to provide these services.
What data we collect:
- Appointment details: therapist, date and time, session type, session status
- Messages: text and attachments exchanged with your therapist through the chat
- Video call metadata: date, time, duration, and participants of calls held through our video provider
- Session notes and clinical records: information your therapist records about the session via our note-taking feature (if applicable)
Please note: Messages, session notes, and clinical records are collected and controlled by your therapist as an independent data controller, not by It’s Complicated. For questions about how your therapist handles this data, please contact them directly or refer to Section 2 of this policy. For information about Stream, our third-party video and chat provider, see our Third-Party Services page.
What we use it for:
- Scheduling and managing therapy sessions
- Enabling secure communication between clients and therapists
- Supporting therapists in documenting relevant session information
- Delivering and improving core platform functionality such as appointment reminders, and call quality
Legal basis:
- Performance of contract (Art. 6(1)(b) GDPR) for appointment details and session management
- Legitimate interests (Art. 6(1)(f) GDPR) for platform functionality and improvement
- For content exchanged between clients and therapists (including messages, session notes, and clinical records), the respective therapist acts as an independent data controller. The processing of any special categories of personal data contained therein is based on Art. 9(2)(h) GDPR.
How long we keep your data:
- The data will be stored for 24 months from your last activity on our platform, provided that it is no longer required to achieve the above-mentioned purpose, you have not objected to its processing or requested its deletion, and no statutory retention periods prescribe otherwise.
Employee data (EAP)
If you are using our platform as an employee with an Employee Access Code, your employer covers the costs of your sessions as part of our Workplace Mental Health Programme. In this case, we may process some additional data to manage your access, verify your eligibility, and provide anonymised and aggregated usage statistics to your employer. Your employer only ever receives anonymised and aggregated data, and they cannot see your individual session information, feedback responses, or any data that could identify you personally.
What data we collect:
- Employee Access Code (identifies you as an EAP client and links you to your employer)
- Session data (e.g. counselling topic, language, and format)
- Session metadata (e.g. date, time, and session type)
- Employee feedback survey responses (optional)
What we use it for:
- Verifying your eligibility and giving you access to sessions paid for by your employer
- Administering and billing EAP sessions
- Generating anonymised, aggregated usage statistics and feedback insights for your employer
Legal basis:
- For managing access to the platform and administering EAP sessions under the agreement with your employer (Art. 6(1)(b) GDPR)
- Legitimate interest (Art. 6(1)(f) GDPR) for generating anonymised usage statistics and feedback insights
How long we keep your data:
- The data will be stored for 24 months from your last activity on our platform, provided that it is no longer required to achieve the above-mentioned purpose, you have not objected to its processing or requested its deletion, and no statutory retention periods prescribe otherwise.
Payment methods
When you use our platform to pay for your therapy sessions, we will collect your payment data via our payments platform Stripe. When you pay for therapy sessions through our platform, payments are processed securely via Stripe. We do not store or have access to your full payment or bank account details. For more details on how payments work and how Stripe handles your data, see Section 7 of this policy and our Third-Party Services page.
What data we collect:
- Billing information: name, email, and (if applicable) billing address
- Payment method details: tokenised card or bank information processed and stored by Stripe
- Transaction data: payment amount, currency, date/time, status, and Stripe customer ID
What we use it for:
- Processing payments for therapy sessions billed through our platform
- Managing invoices and payment history
- Enabling efficient follow-up payments
Legal basis:
- Performance of contract (Art. 6(1)(b) GDPR) for processing payments and managing invoices
- Legitimate interests (Art. 6(1)(f) GDPR) for payment history, fraud prevention, and follow-up payments
How long we keep your data:
- The data will be stored for 24 months from your last activity on our platform, provided that it is no longer required to achieve the above-mentioned purpose, you have not objected to its processing or requested its deletion, and no statutory retention periods prescribe otherwise.
Note: Data marked with an asterisk (*) is optional, meaning you can choose whether to provide this information.
Data we collect from therapists
Below you can find an overview of the data we collect if you create a therapist account and use our platform as a mental health professional to offer counselling services, connect with clients, and manage bookings.
Registration and account data
When you sign up as a therapist and create an account, we collect certain data to register you, manage your account, and provide our services.
What data we collect:
- Email address (for login, verification, and essential communication)
- First and last name
- Password (stored in encrypted form)
- User type (client or therapist)
- Language, time zone
- Marketing communication and newsletter subscription preferences
What we use it for:
- Creating and managing your account
- Verifying your identity and securing your access
- Sending essential service emails (e.g. verification, password reset)
- Sending marketing communications and newsletters (only with your consent)
Legal basis:
- Contractual necessity (Art. 6(1)(b) GDPR) for required fields such as name, email address, password, and language
- Legitimate interest (Art. 6(1)(f) GDPR) for account security and fraud prevention
- Consent (Art. 6(1)(a) GDPR) for optional information and for marketing communications and newsletter subscription
How long we keep your data:
- The data will be stored for 24 months from your last activity on our platform, provided that it is no longer required to achieve the above-mentioned purpose, you have not objected to its processing or requested its deletion, and no statutory retention periods prescribe otherwise.
Verification
To be listed in our therapist directory and participate in the Matching and EAP programmes, therapists must complete a verification process. This process requires you to verify your identity, location, and professional qualifications by uploading certain documents, and helps us ensure the safety and trustworthiness of our platform.
What data we collect:
- Identity information: first and last name, supported by an identification document (e.g. passport or driver’s licence)
- Location information: practice location, supported by proof of residence (e.g. utility bill or rental agreement)
- Professional qualification: professional title, education, and relevant experience, supported by certificates, diplomas, or professional registrations
What we use it for:
- Verifying your identity, location, and eligibility to offer professional therapy services
- Approving your account and enabling your listing in the directory, Matching, and EAP programmes
- Maintaining platform quality, safety, and trust
- Preventing fraudulent or false information
Legal basis:
- Performance of contract (Art. 6(1)(b) GDPR) for verifying your identify, location, and qualifications as a condition of using our platform
- Legitimate interests (Art. 6(1)(f) GDPR) for maintaining platform safety and preventing fraud
How long we keep it:
- Once your verification is complete, identity and location documents are deleted immediately. We retain only a brief text record of key details such as document type, country, and date. Credential documents such as diplomas and certificates are stored for 12 months so you can update your professional title without having to repeat the verification process.
Therapist profile
At It’s Complicated, therapists can create a professional profile page to present themselves to potential clients in our directory. To create your profile, we collect information about you, your work, and your professional background to display on your profile and help clients find the right therapist for their needs.
What data we collect:
- Professional information: professional title, personal statement, education, training, work experience, therapeutic approaches, and specialties
- Practice information: session formats, languages, accepted insurances, practice location, session types, durations, and prices
- Personal information: gender, “about me” text, profile photo, profile video*, gallery photos*, social links*, pronouns*, and identity information*
What we use it for:
- Creating and displaying your public therapist profile
- Enabling clients to find and contact you through our platform
- Matching you with suitable clients through our Matching programme
Legal basis:
- Performance of contract (Art. 6(1)(b) GDPR) for required profile information necessary to list you in the directory
- Legitimate interest (Art. 6(1)(f) GDPR) for displaying your profile to potential clients
- Consent (Art. 6(1)(a) GDPR) for optional profile elements such as profile video, gallery photos, and social links
How long we keep your data:
- The data will be stored for 24 months from your last activity on our platform, provided that it is no longer required to achieve the above-mentioned purpose, you have not objected to its processing or requested its deletion, and no statutory retention periods prescribe otherwise.
Practice management tools
As a therapist on our platform, you can optionally use our built-in practice management tools for client management, scheduling, booking, notes, invoicing, video calls, and more.
What data we collect:
- Client details (e.g. name, email address)
- Appointment details (e.g. date, time, format, price, and service description)
- Personal notes about your clients
- Session invoicing information (cost, description, and transaction details)
- Banking and business information (to invoice clients and receive payouts via Stripe)
What we use it for:
- Providing practice management tools to help you run your practice
Legal basis:
- Performance of contract (Art. 6 (1)(b) GDPR) for providing the respective practice management tools
- Legitimate interest (Art. 6 (1)(f) GDPR) for platform security and fraud prevention
How long we keep your data:
- The data will be stored for 24 months from your last activity on our platform, provided that it is no longer required to achieve the above-mentioned purpose, you have not objected to its processing or requested its deletion, and no statutory retention periods prescribe otherwise.
Payments, banking & tax information
As a therapist, you can purchase subscriptions to access additional tools and features on our platform. All transactions are processed securely via Stripe.
What data we collect:
- Billing information: name, email, and billing address
- Payment method details: tokenised card or bank information processed and stored by Stripe
- Transaction data: payment amount, currency, date/time, status, and Stripe customer ID
- VAT number and country (for tax assessment)
What we use it for:
- Processing subscription payments and managing your membership
- Issuing invoices and managing payment history
- Complying with applicable tax and accounting obligations
Legal basis:
- Performance of contract (Art. 6 (1)(b) GDPR) for processing subscription payments and managing your membership
- Legitimate interest (Art. 6 (1)(f) GDPR) for payment history, fraud prevention, and tax compliance
How long we keep your data:
- The data will be stored for 24 months from your last activity on our platform, provided that it is no longer required to achieve the above-mentioned purpose, you have not objected to its processing or requested its deletion, and no statutory retention periods prescribe otherwise.
Note: Data marked with an asterisk (*) is optional, meaning you can choose whether to provide this information.
Is it mandatory to provide your data?
Some personal data is required for us to provide our services — for example, your email address and password to create an account, billing information to process payments, and proof of identity and qualifications for therapist verification. If you don’t provide this information, we won’t be able to create your account, process payments, or list you in our directory. All optional information is clearly labelled as such, and not providing it has no negative impact on your access to our services.
Additional services
In addition to the data described above, there are a few other features on our website that involve limited data processing:
Self-tests
On our website, you can complete various mental health self-assessment tests (example: depression test). Your answers are processed locally on your browser, and your results are displayed immediately after completion. We do not collect, store, or otherwise process this data.
Newsletter
If you subscribe to our newsletter, we collect your email address, name, and user type (client or therapist) to send you regular updates about our services, company news, and mental health content. You can unsubscribe at any time via the link included in each email.
Legal basis: Consent (Art. 6(1)(a) GDPR). We store your newsletter data until you unsubscribe or withdraw your consent, unless longer storage is required for proof purposes (e.g. to document your consent).
Community
We host our online mental health community on Circle (CircleCo, Inc., see our Third-Party Services page), where therapists can connect with colleagues, join discussions, host and attend events, and share resources. Some areas of the community may also be accessible to clients or the public. When you participate in the community, we process your account and profile information (e.g. name, email, profile photo) and your interactions within the community (e.g. posts, comments, messages). We use this data only to operate and moderate the community space and to maintain a safe, professional environment.
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) in operating a professional community and enabling exchange between members. We store community content for as long as your community account is active or until you delete your contributions, unless legal retention obligations require longer storage.
Embedded third-party content
We use embedded content from third-party providers to offer enhanced functionality on our website. When an embedded element loads, the provider may automatically receive certain technical data from your device (such as your IP address, browser information, device type, and usage data). These providers may also set cookies or use similar technologies. You can control whether this content loads through our cookie consent banner. Embedded content will only be activated if you provide the relevant consent. Services we use include:
- Spotify (Spotify AB, privacy policy here):
Used to embed audio content, such as our podcast episodes. - Mapbox (Mapbox, Inc., privacy policy here):
Used to display interactive maps, for example to show therapist locations.
Social media
We use social media platforms to share updates about It’s Complicated, connect with our community, and communicate with people who are interested in our services. When you visit our profiles or interact with our content on these platforms, the respective platform may collect and process personal data as an independent data controller. We currently maintain company profiles on Instagram (see here), LinkedIn (see here), and TikTok (see here). Your interactions with our pages (such as likes, comments, shares, or messages) may be visible to others depending on your privacy settings. We may receive aggregated or anonymised insights from these platforms (for example, follower statistics or engagement metrics), but we do not have access to individual user analytics unless you actively interact with us. You may choose to contact us through direct messages or comments on these platforms, but please avoid sharing personal or sensitive information in social media messages, as these platforms are not part of our secure support channels.
Payments & billing
Depending on your role and how you use our platform, different payment processes apply. All payment transactions involving credit cards, bank accounts, or other financial information are handled securely via our payment provider Stripe (see our Third-Party Services page). It’s Complicated does not store or have access to full payment or bank account details.
Subscription payments by therapists
Therapists can purchase monthly or yearly subscriptions to access certain tools and features on our platform. Subscription fees are paid directly to It’s Complicated, and all transactions are processed securely by our payment provider, Stripe. Stripe stores your payment method to enable automated renewals. We collect certain billing information (such as name, email, billing address if applicable, payment method tokens, subscription details, and VAT information) to manage your subscription, process payments, issue invoices, and comply with tax and accounting requirements. You can update or cancel your subscription at any time in your account settings, in accordance with our cancellation policy and Terms of Use.
Payments by clients for therapy sessions
Therapists on our platform may choose to enable client payment processing through Stripe, which allows them to accept payments from clients through our platform interface. When a therapist decides to use this feature, they create a Stripe Connect Account (subject to Stripe’s Connect Account Agreement) that allows them to create invoices, send payment requests to clients, securely receive payments, and transfer funds from their Stripe account to their linked bank account, all through our platform interface. When a client completes a payment, Stripe securely stores their payment method details; It’s Complicated does not store full payment credentials. We only receive limited transaction metadata from Stripe (such as payment amount, currency, time, status, and technical identifiers) to provide receipts, display your payment history, and support payment-related inquiries. The therapist is responsible for the content of invoices, their pricing, and their own accounting and tax obligations. Therapists may also choose to accept payments outside our platform. These transactions occur entirely between the client and the therapist and are not processed, recorded, or monitored by It’s Complicated.
Payments by corporate clients (B2B)
Companies that purchase sessions for their employees as part of Workplace Mental Health Programme or other corporate services receive invoices directly from It’s Complicated. These invoices are typically issued through our billing system (e.g. Qonto) and sent to the company’s designated billing contact. Payments are made directly to It’s Complicated via bank transfer or any other payment method agreed in the service contract. We process the company’s billing information (such as legal entity name, address, VAT number, billing contact details, invoice details, payment status, and associated contract information) to manage the commercial relationship, issue and track invoices, and comply with applicable tax and accounting obligations.
Data retention & deletion
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected or to comply with applicable legal, contractual, or regulatory obligations. Certain data may be subject to statutory retention periods (e.g. tax, accounting, anti-money-laundering, or professional/clinical record-keeping requirements). Once these periods expire or the data is no longer needed, we securely delete or anonymise it. For specific data-retention periods and related details, please refer to Section 3 of this policy. To submit a data-deletion request or exercise any GDPR right, please contact support@complicated.life. Where therapy-related data is controlled by your therapist (as an independent controller), we will forward your request to them.
Your rights under GDPR
As someone whose data is processed by It’s Complicated, you have specific rights under the General Data Protection Regulation (GDPR). These rights give you control over your personal data and how it is used. Here’s a summary of your most important rights under GDPR:
Right to Access (Art. 15 GDPR, see here)
You have the right to ask whether we are processing your personal data. If we are, you can request a copy of that data along with information about how we use it.
Right to Rectification (Art. 16 GDPR, see here)
If your personal data is inaccurate or incomplete, you can ask us to correct or update it.
Right to Erasure ("Right to be Forgotten") (Art. 17 GDPR, see here)
You can ask us to delete your personal data, for example if you no longer use our services or withdraw your consent. Please note that in some cases we may be legally required to keep certain data, such as for tax or accounting purposes.
Right to Restrict Processing (Art. 18 GDPR, see here)
In certain situations, such as when you contest the accuracy of your data, you can ask us to temporarily stop using it.
Right to Data Portability (Art. 20 GDPR, see here)
You can request your personal data in a structured, machine-readable format and have it transferred to another provider.
Right to Object (Art. 21 GDPR, see here)
You can object to us processing your personal data if we rely on legitimate interest. If you object to processing for direct marketing, we will stop immediately.
Right to Withdraw Consent (Art. 7(3) GDPR, see here)
If we process your data based on your consent, you can withdraw it at any time. This only applies going forward and does not affect the lawfulness of past processing.
Right not to be subject to automated decision-making (Art. 22 GDPR, see here)
You have the right not to be subject to decisions made only by automated processing, including profiling, if these decisions have legal or similarly significant effects. We do not use such processes.
Right to Lodge a Complaint (Art. 77 GDPR, see here)
If you believe we have mishandled your data, you can lodge a complaint with your local data protection authority. For Germany, you can find a list of the competent authorities here.
Restrictions: Please note that in some situations, we may be legally required to share personal data with public authorities, such as law enforcement agencies or courts. Any disclosure will only take place on the basis of a valid legal request and in line with the GDPR (Art. 23). In such cases, certain data protection rights may be restricted under Union or Member State law, for example to protect public security, support investigations, or fulfil other legal obligations.
How to exercise your rights
You can exercise any of these rights by contacting us at support@complicated.life. For security reasons, we may need to verify your identity before fulfilling your request.
Changes to this policy
We may update this policy from time to time to reflect changes in legislation or how we operate our services. We encourage you to review this policy periodically to stay informed about how we handle your data. The latest version of this policy is always available at: https://complicated.life/legal/privacy
