Privacy policy

This policy describes what PsyAccess actually does with personal data today — no more, no less. This policy is reviewed as the directory evolves and updated accordingly.

Who is responsible (controller)

The controller for personal data processed on this site is Pink Elephant, Unipessoal Lda, Portugal — Edifício Amoreiras Square, Rua Carlos Alberto da Mota Pinto, no. 17, second floor, 1070-313 Lisboa, Portugal (NIPC 519056582). Data-protection contact: hello@psyaccess.health. Company details are on the imprint page.

How we use your application data

Before submission, your pre-screening answers are processed in your browser and are not stored by us. If you submit the application, PINK ELEPHANT, UNIPESSOAL LDA will process:

• Your name, email address and optional message;
• Your selected country, treatment route and provider;
• The questions and answers shown in “Your summary,” which may include information about diagnosis or symptoms, previous treatments and medication, treatment resistance, age range, pregnancy or breastfeeding, cardiovascular or mental-health contraindications, substance-use history, insurance or budget, travel availability and language preference;
• Your pre-screening result and a record of your consent.

We use this information only to create and review your application and, if it meets the stated pre-screening criteria, send the individual application to your selected provider so that the provider can respond and conduct its own intake. The pre-screening is informational and is not a medical diagnosis or treatment decision; final eligibility is always determined by the provider.

Our legal basis is your consent under Article 6(1)(a) GDPR and, for health-related data, your explicit consent under Article 9(2)(a) GDPR. Providing the application is voluntary. Without this consent, we cannot store or forward it, but you may still use the directory and download your summary.

Storage and recipients

Applications are stored in a Neon Postgres database hosted in a European Union region. Neon and necessary infrastructure providers process data only as service providers acting on our instructions. Where a service provider accesses data from outside the EEA, we use an applicable adequacy decision or approved safeguards such as the EU Standard Contractual Clauses.

We send only your individual application to the provider named above. We do not give providers access to our application database, share your application with other clinics, use it for marketing or cold outreach, or sell it.

After receiving the application, the selected provider is independently responsible for its own processing and should provide its own privacy information. Withdrawal from PINK ELEPHANT cannot recall a copy already delivered to the provider; you may contact the provider directly regarding that copy.

We delete the application from our active database 90 days after submission, or earlier where you validly withdraw consent or request erasure. Any residual backup copy is overwritten within a further 30 days. Anonymous, non-identifying aggregate counts may be retained.

You may request access to, correction, deletion, restriction or portability of your personal data and may withdraw consent at any time. Where applicable, you may also object to processing. You may lodge a complaint with your local data-protection authority or with Portugal's CNPD. The controller and privacy contact are named at the top of this page.

The eligibility check stores nothing

The eligibility check runs entirely in your browser. Your answers are held in the page's memory only, are never stored, and are never sent to us or to anyone else unless you choose to submit an enquiry. Closing or reloading the page discards them. No account is required and no identifier is attached to your answers.

Cookies and analytics

This site sets no cookies. We use Plausible, a cookie-less analytics service, to count aggregate, anonymous usage events (page views and feature usage); it collects no personal identifiers and stores nothing in your browser. If this changes, this policy will be updated first and any non-essential technology will ask for consent before it runs.

Data about listed professionals

Provider listings contain professional — not private — data about clinics, programs, trial sites and, in some cases, named practice holders: name, professional address, professional contact details, registry entries and treatment information. This data is sourced from public national registries and official program lists, as described in our methodology. We process it on the basis of legitimate interest (Art. 6(1)(f) GDPR) in operating a transparent, registry-verified public directory of licensed healthcare providers.

If you are a listed professional, you have the right to object (Art. 21 GDPR) to this processing, and the right to have inaccurate data corrected. Use the contact above or the contact section; corrections are reviewed within 5 working days.

Hosting and server logs

The site is served as static pages by our hosting provider, which may process technical connection data (such as IP addresses) in server logs for security and delivery. Details of the production hosting setup and any processing agreement: hello@psyaccess.health.

To protect our forms from automated abuse, we keep a salted, irreversible hash of the submitting IP address for up to 48 hours, used solely for rate limiting (legitimate interest, Art. 6(1)(f) GDPR). The raw IP address is not stored.

Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), as well as the right to withdraw consent at any time and the right to lodge a complaint with a supervisory authority — in Portugal, the CNPD (Comissão Nacional de Proteção de Dados).