Kyan Practice

Kyan Practice Privacy Policy

Version 2026-10-22. Effective from 22 October 2026.

This policy explains how Kyan Health AG ("Kyan", "we", "us") handles personal data in Kyan Practice, the service through which Kyan builds, hosts and runs personal websites for counsellors and therapists. It covers the Kyan Practice pages at https://kyan-practice.web.app/, the private previews and the Studio, the calendar connection, the websites we publish for counsellors, and the tools Kyan staff use to run the service.

Key points

This summary is here to help you read the policy. The numbered sections below are what count.

1. Who is responsible

1.1 Controller. Kyan Health AG, Falkenstrasse 4, 8008 Zurich, Switzerland (company identification number CHE-267.518.768), is the controller of the personal data described in this policy, except where section 2.4 says otherwise. Contact: privacy@kyanhealth.com.

1.2 Data protection officer. Kyan's data protection officer is TechGDPR DPC GmbH, kyanhealth.dpo@techgdpr.com.

1.3 EU representative. Kyan's representative in the European Union under article 27 of the EU General Data Protection Regulation (GDPR) is Kyan Health GmbH, Kollwitzstrasse 76, 10435 Berlin, Germany (privacy@kyanhealth.com).

1.4 The law that applies. We process personal data under the Swiss Federal Act on Data Protection (FADP). Where the GDPR or the UK GDPR applies, for example because you practise in the European Union or the United Kingdom, we also comply with it.

1.5 Other Kyan services. This policy covers Kyan Practice only. The Kyan Care app at care.kyanhealth.com, Kyan's employee-assistance services and the website www.kyanhealth.com are covered by Kyan's general privacy policy at https://www.kyanhealth.com/privacy-policy. Clause 9.2 of the Kyan Practice Terms of Use refers to that general policy for the data Kyan handles about you as controller. For Kyan Practice, that data is described in this policy, which applies instead of the general policy.

2. Who this policy is for, and our role

2.1 Counsellors and therapists. This policy applies to counsellors and therapists who use Kyan Practice or for whom we prepare a website. This includes counsellors in the Kyan network for whom we prepared a private preview before they asked for one, and therapists outside the network whom we invited (section 3.11). For this data, Kyan is the controller.

2.2 Kyan staff. Kyan staff run the service through a staff page. When they use it, we record:

The name is also kept in their own browser so that they do not have to type it again. We use these records to know who did what with counsellors' data and to protect the service (legitimate interest, article 6(1)(f) GDPR). We keep them for 6 years. This policy does not replace Kyan's information for its employees.

2.3 Visitors of the Kyan Practice pages. This policy applies to people who visit https://kyan-practice.web.app/, this policy and the terms pages. Section 3.10 describes what happens when you visit.

2.4 Clients and visitors of a counsellor's website. A counsellor's website lets people visit, ask for an appointment and send a message. For that data, the counsellor is the controller. Kyan processes it only on the counsellor's behalf, as their processor, under the Data Processing Annex. That annex is Annex 1 to the Kyan Practice Terms of Use, at https://kyan-practice.web.app/terms/#doc-dpa. The privacy notice on the counsellor's website explains how the counsellor handles this data. If you are a client and you contact us about it, we pass your request on to the counsellor. Apart from the calendar topics in section 5 and the visitor analytics in section 6.4, for which Kyan is the controller, this policy does not cover that data.

2.5 Your calendar. Data about your calendar connection concerns you. For a connection to Google, Microsoft or Calendly, Kyan is the controller of what we receive and store: your account, the access you granted, your calendar list, your settings and your busy times. We use it only for the calendar feature (section 5.9), and Google's Limited Use requirements apply to what we receive from Google (section 5.14). Your calendar may also contain information about your clients. From Google we read only busy times and the list of your calendars. From Microsoft and Calendly we read a little more, as sections 5.4 and 5.5 explain, but never the subject, description, attendees or location of an event. If you give us a calendar link (ICS), we process the downloaded calendar only in working memory and only on your behalf, as your processor under the Data Processing Annex.

3. Data about counsellors: what, where from and why

3.1 Your Kyan network profile

What. Your name, your profile text in each language and your years of experience. Your languages, specialties, methods and time zone, and whether you offer online sessions. Your city and country, the website listed on your profile and your profile photo. Your Kyan profile identifier, and whether your profile is live, not yet released or on a break.

Where from. Kyan's counsellor database for the Kyan Care app, which Kyan holds because you are a counsellor in its network. Our import tool receives your whole profile record from that database, but it copies only the items above. It does not copy your email address, phone number, rates or internal notes. Your email address is used only to leave out test profiles and Kyan's internal accounts. We copy your profile when we build or refresh your preview. Later changes to your Kyan profile do not reach your preview automatically.

Why. To decide which counsellors to offer a website and to build your preview. Before you accept the Terms, the legal basis is our legitimate interest in offering Kyan Practice, a paid service, to the counsellors in our network with a ready-made, accurate website (article 6(1)(f) GDPR). You can object to this at any time (section 11.2). Once you accept, it is our contract (article 6(1)(b) GDPR).

3.2 Public professional information (credential research)

What. Your professional registrations and licences, protected titles, qualifications and education, professional memberships and publications. The name and location (city and country) of your practice. Your own website and other public professional profiles, including the address of a LinkedIn profile that appeared in search results. We never open LinkedIn pages. For each item, we keep where we found it: the web address, a short quote, how it was checked, and any inconsistency or open question for you. We also keep saved copies of most public web pages we used as sources, but never of LinkedIn pages.

Registration status. For each register we checked, we record what it says about you, for example that a registration is current, lapsed, suspended or restricted, or that no disciplinary measures are recorded. Under the FADP, information about administrative sanctions is sensitive personal data. We use it only to decide whether an item is current. Your website shows only current registrations, never a lapsed, suspended or restricted status or any information about disciplinary measures.

What we do not look for. Your home address, private phone number or private email address, date of birth, family, health, religion or political views. Nor do we look for personal social media, client reviews or criminal records.

Information about other people. To avoid mix-ups, our research records note public register entries and profiles of other people with the same or a similar name, which we checked and ruled out. We use these notes only to keep wrong items off your preview, and we never show them. A saved copy of a web page can also contain information about other people, for example colleagues on a team page or testimonials on your own website. We keep such copies only as evidence of the source.

Where from. Official registers, such as the Swiss PsyReg and MedReg, the UK BACP, HCPC and UKCP registers, the US NPPES registry and state licence registers, Australia's AHPRA and the Dutch BIG-register. Also professional directories, your own website, employer and university pages, and publications.

How. An AI research assistant searched these sources for each counsellor (section 4). A second, independent check had to confirm each item, and that it is about you, from the source itself before the item could appear on your preview. Items with any doubt about your identity were held back.

Why. To show only accurate, sourced information about your qualifications, and to protect clients from wrong or outdated claims. Kyan staff also use the records to answer your questions about where an item came from. Before you accept the Terms, the legal basis is our legitimate interest in offering you an accurate website (article 6(1)(f) GDPR). Once you accept, it is the contract (clauses 5.10 and 8.5 of the Terms). You can object to this research and ask us to correct or remove any item (sections 11.1 and 11.2).

3.3 Text we draft for your website

What. A headline, a short statement and a quote for your website. The title of your profession in each language of your website. Translations of your profile text into those languages. If you have no profile text, two or three neutral sentences.

How and why. We draft them with AI tools (section 4) from your profile and the research results, so that your preview is ready to review. Drafts appear only on your private preview. You can change them in the Studio, or ask us to. The legal basis is the same as in section 3.1.

3.4 Access to your preview

We need this data to give you access and to keep your preview secure (articles 6(1)(b) and 6(1)(f) GDPR).

3.5 What you do in the Studio

What. The Studio keeps:

When you change a text in one language, we translate it into the other languages of your website with an AI tool (section 4). If Kyan staff reset your Studio, we keep the previous state as an archive so that it can be restored.

Why. To set up and run your website as you choose. The legal basis is the contract, or the steps before it while your website is a preview (article 6(1)(b) GDPR).

3.6 Your acceptance of the Terms

What. When you accept the Terms in the Studio, we record:

Why. As evidence of our contract (Terms clause 1.4). The legal bases are the contract and our legitimate interest in being able to prove it (articles 6(1)(b) and 6(1)(f) GDPR).

3.7 Your calendar

Section 5 describes the calendar connection in full, including its legal bases (section 5.9).

3.8 Messages you send us

When you email support@kyanhealth.com or privacy@kyanhealth.com, we use your message and contact details to answer you and to keep a record of what you asked us to do. Examples are change requests you send by email, and requests about your data. The legal basis is the contract and our legitimate interest in handling requests properly.

3.9 Your published website

When you ask for publication and we publish your website, its content becomes public, and search engines may index it. This includes your name, photo, profile, qualifications, services, fees, languages and hours. Before publication, your website is a preview: a password protects it, and search engines are asked not to index it. The legal basis for publishing your website is our contract (article 6(1)(b) GDPR).

3.10 Visitors of the Kyan Practice pages

The pages at https://kyan-practice.web.app/ (the homepage, this policy and the terms) use no cookies, scripts, analytics or forms. Google hosts them for us and processes your IP address and browser information to deliver them and keep the service secure. That is our legitimate interest in running a website (article 6(1)(f) GDPR).

3.11 Therapists we invite from outside the Kyan network

Who. Therapists in the United States who are not in the Kyan network and who answered Kyan's outreach about joining it.

What and where from.

How. As in sections 3.2 and 3.3, with the AI tools in section 4. Kyan Health AG is responsible for this data (section 1.1).

Why. To offer you Kyan Practice, a paid service, with a private preview built from what you already publish. The legal basis is our legitimate interest in offering our service (article 6(1)(f) GDPR). You can object at any time (section 11.2).

How long. If you tell us you are not interested, we delete your preview and this data within 30 days. If you do not reply, we delete them six months after our invitation.

3.12 What we do not do

We do not sell personal data, share it for advertising or use it for profiling. Kyan Practice does not process payment data at this time.

4. AI tools

4.1 What we used them for.

4.2 Safeguards. A second, independent check had to confirm every researched item from its source. Drafts appear only on your private preview. Nothing is published on a public website until you have accepted the Terms and asked for publication. Before your website goes live, it is checked by a person at Kyan or by Kyan's automated checks, which pass anything they flag to a person at Kyan. You can correct anything at any time.

4.3 The site assistant in your Studio (optional). If you use the site assistant, we send your message, the current content and settings of your website (its texts in each language, design, sections, extra pages, the descriptions of your images, and your name and professional title as shown on your website) and your last few assistant messages to xAI in the United States, which processes them on our behalf only to produce the assistant's answer. Each request carries a code derived from your practice that does not reveal your name. We use xAI with zero data retention, so xAI does not store these requests or answers after processing them and does not use them to train AI models. We check this setting before sending and at least every five minutes, and the assistant stops automatically if it is off; requests sent in the few minutes before such a check could be kept by xAI for up to 30 days under its standard terms. Before sending, we screen your message for information that looks like client data and stop it if we find any. We never send your clients' data, booking requests, contact messages, calendar data, passwords, your contact details or your images. Every change goes to your private preview first and is checked before your website goes live, by a person at Kyan or by Kyan's automated checks, which pass anything they flag to a person at Kyan; qualifications, memberships and years of experience are checked by Kyan before they appear on your website. We keep your assistant messages and answers for 90 days, the answers to your requests for 7 days (so that a repeated click is carried out only once), a record of each change (who and when, not its content) and the history of versions of your website for as long as your website exists with us. Kyan staff can read your assistant conversation to help you. The legal basis is the performance of our contract with you (article 6(1)(b) GDPR).

4.4 What AI tools are never used for.

5. Calendar connections (Google, Microsoft and other calendar services)

5.1 What the feature does. In the Studio, you can connect a calendar so that your booking page does not offer times your calendar shows as busy. Clients choose a free time and send a request, which you then confirm. Calendar services are added one at a time, and the Studio shows which ones you can use. The options are:

You connect from the Studio of your preview, logged in with your own password. The Studio of your preview stays open after your website goes live, so you can change or disconnect your calendar there at any time. Kyan staff cannot connect your calendar, change its settings or disconnect it in the Studio. Section 5.12 explains what we do when you ask us to delete your connection.

5.2 Google Calendar: the permissions we ask for. Google shows you these permissions on its consent screen:

We do not ask for calendar.events.owned, the permission to add sessions to calendars you own, at this time (section 5.6). When adding sessions becomes available, we will ask you for it separately, and we will update this policy first.

We never ask for broader access to your calendar, such as the "calendar", "calendar.readonly" or "calendar.events" permissions. We check which permissions you granted and use only those. If you do not grant the permission to read busy times, we revoke the access at once and do not connect.

5.3 What we read from Google.

We never read the titles, descriptions, attendees, locations, attachments or any other content of your events.

5.4 Outlook and Microsoft 365 (when available). Microsoft asks you for these permissions:

We do not ask for Calendars.ReadWrite, the permission to add sessions, at this time. Calendars.Read technically allows full events to be read. We ask Microsoft only for each event's start and end, its "show as" status (for example busy, tentative or out of office), and whether it is all-day, cancelled or part of a series. We also read its privacy setting and your response to it. We never ask for the subject, body, attendees or location. From your calendar list, we read each calendar's identifier, name, whether it is your default calendar, whether you can edit it, and which online-meeting types it allows. Busy and out-of-office events block a time, and so do tentative events unless you switch that off. Free, cancelled and declined events do not. "Working elsewhere" blocks only if you switch that on.

5.5 Calendly (when available). When you connect, Calendly sends us your profile. We keep only its identifier, a masked version of your email address and your organisation. We also read your busy times, for future dates only. Calendly tells us when a booking is created or cancelled. That notice contains details of the booking, including the name and email address of the person who booked. We use only the identifier of the user it concerns, to know whose calendar changed, and we discard the rest at once. We never write anything to Calendly.

5.6 What we write to your calendar. Kyan Practice does not add, change or delete anything in your calendar. It does not ask for Google calendar.events.owned or Microsoft Calendars.ReadWrite. If a feature to add sessions is offered later, we will update this policy first and ask you for that permission separately. The event would then be a private event titled "Kyan Practice session", with no client name, no attendees and no message. That feature is not available.

5.7 Calendar link (ICS). You can give us the private link of a calendar instead.

5.8 What we store, and where. For a Google, Microsoft or Calendly connection, we store:

The identifier of your main Google calendar is your email address. The identifier of a calendar that someone shares with you is often their email address. We store these identifiers only to remember your choice, and Kyan staff do not see them (section 5.10).

This data is stored in Google Cloud Firestore in Zurich, Switzerland (region europe-west6). Browsers cannot access that database directly. The encryption keys are kept separately, in Google Secret Manager. Only the Kyan Practice service decrypts your tokens, when it needs to talk to your calendar provider. No Kyan staff member views them.

5.9 How we use calendar data. The calendar feature is visible and prominent in the Studio and on the booking page: you connect and choose calendars in the Studio, and the booking page hides busy times. Visitors are not shown event details. We use calendar data only to provide that feature to you:

The legal basis is our contract with you, or the steps before it while your website is a preview (article 6(1)(b) GDPR). For a calendar link (ICS), we act on your behalf under the Data Processing Annex. We keep the connection log because of our legitimate interest in being able to show what access you gave us and when (article 6(1)(f) GDPR).

We read your calendar only while a booking page uses it. If we take your preview offline and you have no live website, we stop reading your calendar.

An event you add only shortly before a client chooses a time may not be taken into account yet. If a calendar connected through Google, Microsoft or Calendly cannot be read, we keep using its last good copy for up to 72 hours. After that, your booking page only offers to send a request, without times. If a calendar link (ICS) cannot be read, your booking page shows times without it until the next successful read. Your booking page shows only free start times within the hours you publish, never your busy times or any event details. It also shows which kind of calendar is connected, for example "Google". Free times within your published hours can let a visitor work out when you are not free.

5.10 Who can see it. No person at Kyan reads data we receive from Google, Microsoft or Calendly, except:

When Kyan staff open your Studio, they see it read-only, and they see none of the data we receive from your calendar provider. They see only whether a calendar is connected, which provider, the state of the connection, the permissions you granted, how many calendars there are and how many count, your settings and the last error code. They never see your tokens, your account, your calendar identifiers or names, or your busy times. Kyan's operator tools show the same kind of overview.

5.11 How we limit the use of calendar data.

5.12 How long we keep it, and how to delete it.

5.13 Security.

5.14 Google API Services User Data Policy. Kyan Practice's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements. For Google Calendar, which is a Google Workspace API, this includes the Google Workspace API User Data and Developer Policy.

5.15 Calendar connections made in other Kyan products. Kyan Practice does not use calendar connections you made in other Kyan products, such as the Kyan Care app at care.kyanhealth.com. Kyan Practice has its own Google sign-in, shown as "Kyan Practice", and its own stored connections. It does not read the connections, access tokens or calendar data of the Kyan Care app, and our import of your Kyan Care profile (section 3.1) does not include them. If we offer you the option to use a calendar you already connected in Kyan Care for Kyan Practice too, we will ask you first, and we will update this policy before we do.

6. Cookies and similar technologies

6.1 Previews and the Studio. Private previews and the Studio, at https://kyan-practice.web.app/ followed by the name of a preview, use one cookie, __session. It keeps you logged in.

This cookie is strictly necessary for the password protection, so it needs no consent.

6.2 Staff page. The staff page keeps the staff member's name in their own browser's local storage.

6.3 Everywhere else. The Kyan Practice pages and the websites we publish set no cookies of their own, and use your browser's local storage only for your analytics choice and, if you accept, for analytics (section 6.4). Kyan Practice uses no advertising trackers, tracking pixels or third-party scripts: the analytics code is served from our own pages, and its fonts are too. A counsellor can choose to show an external booking page on their website, for example from Calendly or Cal.com. That provider may then set its own cookies, and the privacy notice on the counsellor's website covers this.

6.4 Analytics, only with your consent. The Kyan Practice directory, the Studio and the websites we publish ask visitors whether we may count visits with PostHog analytics. Until you choose, and if you reject or your browser sends a Global Privacy Control or Do Not Track signal, nothing is loaded, stored or sent. If you accept:

Your choice is kept in your browser's local storage for 12 months, then we ask again. You can change it at any time with "Cookie settings" at the bottom of each page; if you reject after accepting, the identifier is deleted from your browser. The legal basis is your consent (Art. 6(1)(a) GDPR; Art. 5(3) of the ePrivacy Directive as implemented in the EU member states; regulation 6 PECR in the United Kingdom; in Switzerland, Art. 45c of the Telecommunications Act and the Federal Act on Data Protection), which you can withdraw at any time. A counsellor can switch analytics off for their own website in the Studio. On a counsellor's website, too, Kyan is the controller of these analytics: we use them to run and improve Kyan Practice, and the privacy notice on the counsellor's website says so.

7. Who receives personal data

7.1 Service providers that process data for us.

Provider What it does for Kyan Practice Where
Google (Google Cloud and Firebase) Hosts the Kyan Practice pages, the previews and the websites we publish (Firebase Hosting). Runs our server functions and build service. Stores our database (Firestore), files (Cloud Storage), keys (Secret Manager) and logs (Cloud Logging) Database, files, keys, server functions and build service: Zurich, Switzerland (region europe-west6). Logs: Cloud Logging's global location. Files of the websites we publish, and delivery of all pages: Google's worldwide network
xAI (provider of the Grok models) AI research assistant with web search, drafting and translation, and the optional site assistant in the Studio (section 4) United States
Providers of AI software assistants used by Kyan staff Drafting of a small number of early previews, and software assistance when Kyan staff build and maintain Kyan Practice (section 4) United States
PostHog Inc. Visitor analytics, only after consent (section 6.4) PostHog's EU cloud: Frankfurt, Germany. PostHog Inc. is a company in the United States. Kyan has a data processing agreement with PostHog; any access from the United States is covered by the EU Standard Contractual Clauses, with the Swiss amendments
Netlify, Inc. Hosting of some early previews created in October 2026, before Kyan Practice moved to Google Cloud Server functions and stored Studio data, including calendar links and acceptance records: the EU (Frankfurt). Form submissions: United States. Delivery: Netlify's worldwide network

We do not use an email delivery provider for Kyan Practice at this time. Booking and contact requests are stored in our database in Zurich for 90 days, and Kyan forwards each request to the counsellor until email notifications are switched on. If we start sending notifications by email, we will add the provider here.

7.2 Others.

8. Where data is stored, and transfers to other countries

8.1 Switzerland. Our database, files, keys, server functions and build service are in Zurich, Switzerland, on Google Cloud. The European Commission and the United Kingdom recognise Switzerland as providing an adequate level of data protection.

8.2 Google's worldwide infrastructure. Our logs are stored in Cloud Logging's global location. Firebase Hosting stores the files of the websites we publish and delivers all pages through Google's worldwide network, from the location nearest the visitor. This data can therefore be processed in any country where Google operates, including the United States. Previews and the Studio are never stored in that network's cache. Google processes this data under its data processing terms for Google Cloud and Firebase.

8.3 AI providers. xAI is based in the United States and processes the data it receives there (section 4). Kyan uses xAI with zero data retention; section 4.3 explains how we check it and the short window in which requests could be kept. The AI software assistants Kyan staff use can also process data in the United States. Switzerland and the European Union recognise an adequate level of protection in the United States only for companies certified under the Data Privacy Frameworks. You can ask us at privacy@kyanhealth.com which safeguards apply to these transfers and for a copy of them.

8.4 Netlify. Netlify, Inc. is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework.

8.5 Your calendar provider. The data we exchange with your calendar provider goes back to the provider you chose, wherever it processes data.

8.6 Kyan's work computers. Kyan's operators keep working copies of research records, saved source pages, copies of Kyan profiles, drafted texts and preview passwords on the work computers of the Kyan staff who run Kyan Practice. These copies follow the retention periods in section 9.

9. How long we keep personal data

Data How long we keep it
Your Kyan profile data, research records, saved source copies, drafted text and your preview While we offer you a preview or run your website. If you tell us you do not want a preview, we take it offline at once, delete this data within one month and confirm it to you. If you have not accepted the Terms 6 years after we first offered you the preview, we delete it. After a contract ends: deleted within 90 days
Research and previews for therapists outside the Kyan network Within 30 days after you tell us you are not interested, and at the latest six months after our invitation if you do not reply (section 3.11)
Your preview password (hashed and encrypted copy) Until your preview or website is deleted. It is replaced whenever the password changes
Login cookie Up to 30 days in your browser. For Kyan staff: the staff grant up to 30 days, a staff page login 12 hours
Your analytics choice 12 months in your browser's local storage, then we ask again
Analytics events (only after consent) 12 months. The identifier in your browser: until you reject, your choice expires after 12 months, or you clear your browser's storage
Studio settings, change requests, history and reset archives While your preview or website exists. After a contract ends: within 30 days after the exit period (clause 16.5 of the Terms)
Your acceptance of the Terms For as long as the law requires, and as evidence of our contract until claims under it are time-barred (clause 16.5 of the Terms)
Calendar connection (Google, Microsoft, Calendly) Until you disconnect or ask us to delete it. After a contract ends, or when your preview is removed: within 30 days. Section 5.12 has the details
Calendar connection log Each entry 6 years after it was written
Calendar link (ICS) Until you disconnect, then deleted at once. After a contract ends: within 7 days. Busy times: up to 5 minutes in our server's memory
Messages you send us As long as we need them to handle your request, and as a record of what you asked us to do while your contract runs
Application logs (the preview's short name and the event, never content) and server request logs 30 days, in Google Cloud Logging. Google's own records of administrative changes to our cloud project, which can include a preview's short name, are kept by Google for 400 days
Staff page records (staff name, action, time, IP address, browser) 6 years
Failed login counts In our server's memory, for up to 15 minutes

Copies in backups and version history are kept out of use and deleted in the normal cycle, no later than 6 years after the contract ends.

10. Security

We protect personal data with technical and organisational measures that fit the risk:

11. Your rights

11.1 What you can ask for. Under the FADP and, where it applies, the GDPR, you can ask us:

Where processing is based on your consent, you can withdraw it at any time with effect for the future. To stop the calendar connection, you can disconnect it at any time (section 5.12).

11.2 Your right to object. You can object at any time to the preparation of a preview for you, to the research about you and to our offers of Kyan Practice. We always honour such an objection, without weighing it against our interests: we stop, take your preview offline and delete it, together with the research about you (section 9). You can also object to other processing based on our legitimate interests (article 21 GDPR). We will then stop, unless we have compelling grounds that the law recognises.

11.3 How to ask. Email privacy@kyanhealth.com. To change your website, you can also request changes in the Studio. We may ask you to confirm your identity. We answer within 30 days. This is free of charge in most cases.

12. Complaints

You can complain to:

We would appreciate the chance to answer your concern first.

13. Changes to this policy

Each version of this policy has a version number and an effective date, shown at the top. If we make material changes, we tell counsellors by email before they take effect. If we want to use data from your calendar connection in a new way, we will ask for your consent first where the law or Google's policies require it.

14. Contact

Kyan Health AG, Falkenstrasse 4, 8008 Zurich, Switzerland.