Privacy Policy

1. Scope

This Privacy Policy describes how Dafne ("we," "us") collects, uses, and shares personal information when you visit dafne.care, use the Dafne app, or interact with us (the "Platform"). "Dafne" refers to the company that owns and operates the Platform.

Health information created or received by your provider in connection with your care is governed by the Notice of Privacy Practices (dafne.care/notice-of-privacy-practices), which controls for that information. The Platform handles such information only on behalf of and as permitted by your provider under applicable health-privacy law.

2. Information we collect

• Account information: name, email, phone number, date of birth, address, state of residence, emergency contact.
• Intake and questionnaire responses: answers you provide during onboarding, including health-related answers.
• Usage and device information: IP address, device type, operating system, app version, log data, and interactions with the Platform.
• Payment information: processed by our payment processor (e.g., Stripe); we do not store full card numbers.
• Communications: messages you send to support, and, where you have consented, SMS/WhatsApp messages.

3. How we use information

• To create and manage your account, match you with a licensed therapist, and operate the Platform.
• To process payments, provide support, and send service communications (appointment reminders, account notices).
• To maintain safety, including surfacing intake responses to licensed clinicians for review.
• To comply with law and enforce our terms.
• To improve the Platform using de-identified or aggregated data that cannot reasonably identify you.

4. Sales and advertising

We do not sell your personal information. We do not use or disclose your health information—including intake questionnaire responses—for third-party advertising without your affirmative consent.

5. Text messaging (A2P disclosure)

If you opt in to text messages, we use your mobile number to send the messages described in our SMS Terms (dafne.care/sms-terms). No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, excluding vendors and service providers acting on our behalf solely to deliver the messages.

6. When we share information

• With your therapist and provider, to deliver your care.
• With service providers acting on our behalf under contractual confidentiality obligations (hosting, communications delivery, payment processing, analytics).
• For legal reasons: to comply with law, legal process, or to protect the rights, safety, or property of users, the public, or the Platform.
• In a corporate transaction (merger, acquisition, financing), subject to this Policy’s commitments and applicable health-privacy law.
• With your direction or consent.

7. Cookies and similar technologies

We and our service providers use cookies, pixels, SDKs, and similar technologies on the Platform. We use them in the following categories:

Strictly necessary. Required for the Platform to function—signing you in, keeping your session secure, remembering your consent choices, and preventing fraud. These cannot be switched off.

Functional. Remember your settings and preferences, such as language (English/Spanish) and device preferences, so the Platform works the way you set it.

Analytics. Help us understand how the Platform is used—which pages are visited, where errors occur, and how features perform—so we can improve it. Where we use third-party analytics providers, they process this data on our behalf.

Advertising. We may use advertising cookies and similar technologies on our public marketing pages (such as our homepage and blog) to measure our advertising campaigns and reach people who may be interested in Dafne. We do not use advertising technologies on pages where you sign up, complete questionnaires, or receive care, and we do not use your health information for advertising, consistent with Section 4.

You can manage cookies through your browser settings, including blocking or deleting them; doing so may affect how the Platform functions. Where required by law, we present a consent banner for non-essential cookies and honor opt-out preference signals such as the Global Privacy Control. To exercise choices about your information, see our Privacy Choices page (dafne.care/privacy-choices).

8. Security and retention

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including encryption in transit and at rest and access logging. No system is perfectly secure. We retain personal information for as long as needed for the purposes described here and as required by law; clinical records are retained by your provider under applicable record-retention laws.

9. Your rights

Regardless of where you live, you may request that we: provide access to and a copy of the personal information we hold about you; correct inaccurate personal information; delete your personal information (subject to legal retention requirements); and stop or limit certain processing, including opting out of marketing communications. To make a request, email help@dafne.care or use the Privacy Choices page (dafne.care/privacy-choices). We will verify your identity before acting on a request and respond within the time required by applicable law (and in any event within 45 days, extendable where the law permits). We will not discriminate against you for exercising your rights. Where applicable law provides an appeal process, you may appeal a decision by replying to our response, and we will inform you of the outcome and of your right to contact your state Attorney General. You may use an authorized agent where permitted by law; we will require proof of authorization.

Rights regarding your health records and other information held by your provider are described in the Notice of Privacy Practices and can be exercised with your provider.

Consumer health data. Some states, including Washington and Nevada, provide specific rights over consumer health data. Where those laws apply, you have the right to confirm whether we collect, share, or sell consumer health data, to withdraw consent, and to have such data deleted; we do not sell consumer health data, and we collect and share it only as described in this Policy. Requests may be made through the channels above, and our Consumer Health Data Privacy Notice (dafne.care/consumer-health-data) provides the disclosures required by those laws.

California residents. The California Consumer Privacy Act, as amended, provides California residents the rights described above and requires the following disclosures. In the preceding 12 months we have collected the categories of personal information described in Section 2, from you directly and from your devices, for the purposes described in Section 3, and disclosed them for business purposes to the categories of recipients described in Section 6. We do not sell personal information and do not share personal information for cross-context behavioral advertising, as those terms are defined by California law, and we have no actual knowledge of selling or sharing the personal information of consumers under 16. We retain personal information as described in Section 8. Sensitive personal information is used only for the purposes permitted by California law (providing the services, security, and legal compliance). To exercise your rights, use the channels above.

10. Children

The Platform is for adults 18 and older. We do not knowingly collect information from anyone under 18; if we learn we have, we will delete it.

11. Changes

We will post any changes here with a new effective date and, for material changes, notify you through the Platform or by email.

12. Google Calendar for therapists

The Google Calendar integration is optional and available only to therapists. Patients never connect a Google account to the Platform.

When a therapist chooses to connect it, we receive from Google only free/busy start and end intervals, OAuth access and refresh tokens with their expiry, the primary calendar identifier, IDs of events created by the Platform, and the connected Google account email address. We do not receive or store titles, descriptions, locations, guests, or other content from the therapist’s personal events.

We send Google a session’s start and end date and time, a generic title, a session description, and its session reference identifier. We do not send patient names or email addresses. We use this information only to calculate bookable availability and to create or delete the session hold. Therapists, patients, and administrators see only a generic “Busy” marker.

OAuth tokens are encrypted at rest with AES-256-GCM. The OAuth client secret remains only in the backend and is never exposed to the browser.

We delete Google Calendar access and refresh tokens, along with the connected account’s email, immediately when a therapist disconnects Google Calendar or when their account is deactivated—whether by an administrator or automatically due to license expiration. In both cases, we attempt to revoke the authorization directly with Google.

Google Calendar event identifiers and related audit records are retained together with the corresponding session record, under our general data retention policy. We do not sell data received from Google APIs, use it for advertising, or use it for generalized model training.

The Platform’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

13. Contact

Privacy questions or requests: Dafne, c/o InMind Evaluations LLC · 16192 Coastal Hwy, Lewes, DE 19958 · help@dafne.care.