Data Security. Privacy Policy.

How do we protect your data?

Your data belongs only to you. The information you enter about your clients is visible only to you. No one on the Morph team has access to it.

• The platform is built in compliance with GDPR policies for Europe

• Only your account has access to your clients’ information and everything you enter into the platform. All data is encrypted (end-to-end encryption).

• Automatic backups are performed several times a day. In the event of a failure, the latest version is restored.

Privacy Policy—Key Points

Your clients’ information is protected. You can view the full privacy policy at the link here → https://morphpractice.com/politika-za-poveritelnost/

Who is responsible for what? Morph Practice acts as the data controller for your data as a therapist. For your patients’ data, you are the data controller. We only provide the technical platform and process this data solely according to your instructions, without having access to its content. We recommend that you do not enter information that is not necessary for your practice.

What data do we collect about you? When you register and use the platform, we collect: names, email addresses, phone numbers, payment and billing information, and technical data such as your login history. We do not collect or have access to the contents of your patient records.

What do we use this data for? Solely to provide you with the platform—account management, subscriptions, invoices, technical support, and system security. We do not use your data for advertising unless you have explicitly consented.

How long do we retain your data?

• As long as your account is active, plus up to 5 years after termination (for potential legal issues)

• Financial documents—10 years (required by law)

• System logs—up to 12 months

• If you’ve subscribed to a newsletter—until you withdraw your consent

Do we share your data? Only with vendors necessary for the platform’s operation (hosting, payments, accounting)—and only under contractual confidentiality obligations. We do not sell data. If legally required, we may provide data to government agencies (the National Revenue Agency, the Commission for Personal Data Protection, etc.).

What are your rights? You have the right to receive a copy of your data, to correct or delete it, to restrict its processing, and to file a complaint. Please send all requests to: teodora@morphpractice.com. We will respond within 30 days.

If you have a complaint: You may contact the Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., Sofia · kzld@cpdp.bg

Data Processing Agreement (DPA)—What It Means for You

When you register with Morph Practice, you also accept a Data Processing Agreement (DPA). This is a standard GDPR document that governs the relationship between you and Morph regarding your patients’ data. You can view the full Data Processing Agreement, which is part of the Terms and Conditions, at the link here → https://morphpractice.com/data-processing-agreement/

In short, here’s what it means:

You are the data controller; we are the data processor. You decide what patient data you enter into the platform and why. We only store and protect this information technically—according to your instructions.

Your responsibility as a therapist includes:

• Having a legal basis for processing your patients’ data (consent, contract, or legal obligation)

• Entering only information that is necessary for your practice

• Managing access—if you work as part of a team, you determine who has access to what

• Informing your patients that their data is stored on the platform

• If a colleague or assistant leaves—immediately revoke their access

Patient data is end-to-end encrypted. This means that even technically, Morph cannot read the contents of the records. Only your account has access to them.

What happens to the data when you cancel your subscription? You have 12 months after cancellation to download your data. After that, it is deleted or anonymized.

Which third-party service providers do we use? For technical purposes, we work with Google Ireland and OpenAI Ireland—both companies are registered in the EU and are subject to GDPR requirements.

Do you have any questions?

Contact us at info@morphpractice.com.