Privacy Policy

Contact Forms

When you submit a contact form, we collect and process the information you provide. This data is sent via email and stored for processing purposes only. We do not use this data for any other purposes.

Newsletter and Early Access list

Our newsletter subscription uses a double opt-in process. When you subscribe, we collect your email address and send a confirmation email. Only after confirmation will you receive our newsletter. You can unsubscribe at any time.

Support System

Emails sent to our support addresses (hallo@, join@, support@synctrail.io) are processed through our self-hosted ticket system. This communication is stored for support purposes and is regularly reviewed and deleted.

Roles and responsibilities

SyncTrail is used by practices and professionals in family therapy and counseling. For the clinical data processed in the platform – in particular client data, therapeutic documentation, uploaded files, genograms, appointments and messages – the respective practice or professional is the controller within the meaning of Art. 4(7) GDPR. We process this data exclusively as a processor under Art. 28 GDPR, on the basis of a data processing agreement and only on the practice's instructions. For data arising from operating the platform itself – user accounts, professional profiles, security and access logs, support and billing data – we are the controller.

Note for clients and family members

If your practice uses SyncTrail, please direct requests about your personal data – access, rectification, erasure, restriction of processing, data portability or objection – primarily to that practice. It decides on the purpose and scope of processing; we support it in fulfilling your rights. If you contact us directly, we forward your request to the responsible practice unless we are permitted to answer it ourselves. Independently of this, you always have the right to lodge a complaint with a data protection supervisory authority.

Categories of data processed

• Account and login data: email address, password (stored only as a cryptographic hash), session data
• Professional profile data: name, contact details, settings
• Organizational data: practice, teams, roles and permissions
• On behalf of the practice: client data including health data (Art. 9 GDPR), therapeutic documentation, files, genograms (family diagrams), appointments and messages, as well as metadata on video sessions – video sessions are not recorded
• Log data: immutable access logs, in particular of access to health data

Retention

Clinical documentation is subject to statutory retention periods under health and professional law (usually ten years). The responsible practice decides when retention begins and ends; we implement these requirements technically. We store account data for the duration of the contractual relationship and beyond that only where legal obligations require it.

Security of processing

• Hosting exclusively in the European Union (Germany); no transfers to third countries
• A separate database for each platform service
• Encryption of sensitive content at rest (AES-256-GCM) for therapeutic documentation, files, genograms and identity data; transport encryption (TLS) for all connections
• Immutable access logs enforced at database level
• Role and permission system with strict tenant separation; malware scanning of all file uploads

Hosting and email delivery

The platform runs on servers of Hetzner Online GmbH in Germany. We send system emails (such as invitations and notifications) via our own mail server (mail.synctrail.io); no external email service provider is used.

Cookies in the application

The application uses only technically necessary session cookies for login. No tracking, statistics or marketing cookies are set in the application.