Privacy policy

Bobbe ("we", "our", "us") is committed to protecting and respecting your privacy. This policy explains how we collect, use, and safeguard any information that you give us when you use our website (www.bobbe.co.uk).

As a UK based therapy directory, we take data protection seriously. We only work with therapists who meet the UK's highest training standards, and similarly, we adhere to the highest standards when handling your data.

Please read this privacy policy carefully to understand our practices regarding your personal data.

Bobbe is a UK based therapy directory, operating as Bobbe Therapy Limited registered in England and Wales (16426635).

If you have any questions about this privacy policy or our privacy practices, please contact us at:

Email - support@bobbe.co.uk

3.1. Information provided by website visitors

When you use our website without creating an account, we collect very limited information:

- Cookies store information about therapists you have saved and when you last contacted a therapist

- When you contact a therapist through our platform, we temporarily process the information you provide in your message (which may include your name, email address, and any health or medical information you choose to share)

- If you contact us for support or to provide feedback, we process the information you include in your communication

We do not store visitor information in our databases. Information such as saved therapists and contact history is stored only in cookies on your device.

3.2. Information provided by therapists

When therapists register to be listed on our directory, we collect:

- Name and contact details

- Home address

- Professional qualifications and accreditations

- Insurance documentation (temporarily, for verification purposes)

- Years of experience

- Gender and pronouns

- Profile photo/avatar

- Professional description and services offered

- Any other information therapists choose to include in their listing

4.1. Website visitors

- To connect you with therapists you contact through our platform

- To provide our website functionality, including features like saving therapists and tracking when you last contacted them

- To respond to any support requests or feedback you provide

4.2. Therapists

- To create and maintain your listing in our directory

- To verify your qualifications and insurance

- To provide our services to you as outlined in our Terms of Service

- To communicate with you about your account and our services

We use cookies to enable core website functionality:

- Session cookies for logged-in therapists

- Cookies to remember therapists you have saved

- Cookies to track when you last contacted a therapist

We use Umami analytics, which is privacy-focused and GDPR-compliant. Umami does not collect any personally identifiable information and anonymises all data. Users cannot be identified and are never tracked across websites.

We also use Sentry for error tracking and website performance monitoring. Sentry collects information related to software bugs, API calls, and page loads. By default, this information does not include personally identifiable details.

You can manage cookie settings through your browser. Please note that disabling certain cookies may affect the functionality of our website.

We do not sell, trade, or otherwise transfer your personal information to outside parties.

When you contact a therapist through our platform, your message (including your name, email, and any information you include) is securely processed through our email service provider (Resend) and delivered to the therapist's email address. When therapists respond, they do so directly to your provided email address.

We implement a variety of security measures to maintain the safety of your personal information, including:

1. User authentication with secure OTP (one-time password) system

2. CSRF protection for all form submissions

3. Secure cookie configuration (httpOnly, secure, sameSite attributes)

4. Input validation and sanitisation using schema validation

5. API key validation with constant-time comparison

6. Bot protection using Turnstile service

7. Secure environment variable management

8. Secure error handling to prevent information leakage

9. Secure document handling for insurance documents

10. Proper data encryption for sensitive information

Our databases and website are managed by Bobbe and located in the UK. Our email servers are located in the EU (Ireland).

- Therapist data: We retain therapist data indefinitely while your account is active, or up to one year after your subscription is cancelled

- Insurance documents: These are stored securely during the validation process and are accessible only to authorised Bobbe staff. After validation is complete, these documents are permanently deleted from our systems

- Website visitor data: We do not store visitor data in our databases

- Contact form messages: Messages sent through our platform are stored temporarily by our email service provider (Resend) and may be retained for up to 30 days on their servers

Under UK data protection law, you have rights including:

- Access: You can request copies of your personal information

- Rectification: You can request corrections to inaccurate or incomplete information

- Erasure: You can request deletion of your personal information in certain circumstances

- Restriction: You can request the restriction of processing of your information

- Data portability: You can request transfer of your information

- Objection: You can object to certain types of processing

Therapists can exercise many of these rights directly through their account dashboard, where they can update or delete their information.

For all other requests related to your data rights, please contact us at [Your Data Protection Email].

We may update this privacy policy from time to time. We will notify registered therapists of significant changes by email. We recommend checking this page periodically for any changes.

If you have any questions about this privacy policy or our data practices, please contact us:

Email - support@bobbe.co.uk

If you have concerns about our data processing activities, please contact us first so we can address your concerns. However, you also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues.