MyTherapyMatch Privacy Policy

Effective date: August 11, 2026 · Version 1.1 · Contact: hello@mytherapymatch.com

The short version

We built MyTherapyMatch so that we technically cannot read your therapy sessions. Here is the whole policy at a glance; details follow.

1. Who we are, and the one relationship you should understand

Beachhead Enterprises, LLC, a California limited liability company doing business as MyTherapyMatch (“MyTherapyMatch”, “we”, “us”), provides software that independent, licensed therapists use to run their own online therapy practices: a verified therapist directory, and a private “office” for encrypted video sessions, notes, and clinical assessments.

We are not your health care provider. Your therapist is an independent licensed professional — not our employee — and is your treatment provider. Under HIPAA, your therapist (or their practice) is the covered entity responsible for your health information, and MyTherapyMatch is their business associate: a vendor that handles limited health information on the therapist’s behalf, under a signed Business Associate Agreement that legally requires us to safeguard it, forbids us from using it for our own purposes, and makes us report any breach. Questions about your treatment records should go first to your therapist; questions about our systems can come to us at hello@mytherapymatch.com.

2. What we collect from therapists

If you are a therapist with a MyTherapyMatch account, we collect:

• Account information: name, email address, password (stored only as a salted bcrypt hash — we cannot see your password), practice name, and profile content you choose to publish in the directory (photo, specialties, modalities, years in practice).
• License and verification information: license type, number, and state(s); the results and dates of our checks against state licensing-board public records; and, where applicable, interstate-compact privileges you report.
• Malpractice insurance information: certificates of insurance you upload, insurer, policy number, and expiration date, used to verify coverage and remind you before it lapses.
• Billing information: your subscription plan and payment history. Card details go directly to our payment processor (Stripe); we never receive or store full card numbers.
• Operational records: login timestamps, IP addresses for security purposes, and audit logs of access to clinical records (HIPAA requires these logs, and they protect your clients).

We use this information to provide and secure the service, verify credentials for the directory, bill flat subscription fees, and meet legal obligations. We do not sell it. One narrow exception on the advertising side, stated plainly: when you complete a signup, we send Meta a single event recording that a listing was created, with your email address in hashed form — a one-way fingerprint, not the address itself — so we can tell which of our recruitment ads brought therapists to the directory. Nothing else about you goes to any advertising platform: not your license, not your insurance, not your profile, not your billing, and nothing whatever about your clients. Section 4 has the detail.

3. What we collect from clients — and what we deliberately cannot collect

If you are a client attending sessions through MyTherapyMatch, here is the complete picture:

Your session check-in location. At the start of each session, you are asked where you are right now. This is not a marketing feature — your therapist is professionally and (in several states) legally required to confirm your location every session, so that they can send help to the right place in an emergency and confirm they are licensed where you are sitting. Your stated location is relayed through our system to your therapist and displayed to them. The most recent location you confirm is saved on your record in your therapist’s account, so that they can offer it back to you next time instead of asking you to type it again. It is visible to your therapist and to no one else, it is never used for advertising or analytics of any kind, and it is deleted when your therapist deletes your record. If your therapist also writes it into their clinical notes, that copy is part of their record, not ours.

Your session video, audio, and chat — we cannot see them, by design. Sessions on MyTherapyMatch are peer-to-peer: the encrypted media stream travels directly between your device and your therapist’s device using DTLS-SRTP end-to-end encryption. Our server’s only role is the introduction — telling the two browsers how to find each other. Session content never passes through our application servers, is never stored by us, and is not readable by us even in principle, because we do not hold the encryption keys. When a network firewall forces traffic through our relay server (this happens in roughly 10–15% of calls), the relay forwards packets it cannot decrypt; it never sees content. We do not record sessions, and v1 has no recording feature at all.

What your therapist stores with us. Your therapist may write session notes and administer standardized assessments (such as PHQ-9 or GAD-7) through the platform. Those notes and scores are stored on our servers on your therapist’s behalf and under their control, protected as described in Section 6. They are your treatment records; your therapist decides what goes in them, and requests to see, amend, or copy them go to your therapist (Section 8).

What we don’t have. Clients do not create accounts in v1. We do not have your name unless your therapist enters it, your email, your browsing history, your contacts, or your device’s GPS coordinates (the location check-in is what you type or confirm, not a background tracker).

4. Cookies and tracking: none on the pages that touch care

We treat three parts of our service very differently, on purpose:

• The application (app.mytherapymatch.com) — where therapists run sessions, and where any client information lives — loads no analytics and no third-party scripts of any kind. The only cookie is a session-authentication cookie so a logged-in therapist stays logged in; it is HTTPS-only in production and is never used to track anyone across other websites. Video and audio travel peer-to-peer and are never recorded or routed through us (Section 3).
• The therapist directory (the “Find a Therapist” pages) — where a visitor may search for care by concern or specialty — is treated as a health-adjacent context. We deliberately load no third-party analytics or tracking scripts on the directory — no outside company measures, profiles, or receives what you search for. What we keep is our own anonymous, first-party record of directory activity — searches run, matching-assistant conversations, and how a visit arrived at the page — collected with no name, account, IP address, or contact information attached (any email address or phone number typed into the matching assistant is automatically removed before storage). This record is used solely to improve search and matching, and is never shared or used for advertising.
• Our general marketing and therapist-signup pages (our home page, the pages for therapists, the pages inviting a therapist to claim a listing, this policy, our terms, and our contact page) use Google Tag Manager and Google Analytics to understand basic, aggregate traffic — for example, how many people visited or which page they arrived from. This helps us improve the site. These are ordinary web-analytics cookies set by Google; Google acts as our service provider for this purpose. No health information is present on these pages, and we do not use this analytics data to identify you personally.
  
  These same pages also carry a Meta (Facebook) advertising pixel. We advertise to recruit licensed therapists to the directory, and the pixel is how we tell which of those ads worked. It sets Meta’s own cookies (_fbp, and _fbc if you arrived from a Facebook or Instagram ad) and reports page views to Meta. When a therapist finishes creating a listing, we also send Meta a single event named ListingCreated, from our server, containing their email address in hashed form — a one-way fingerprint, not the address itself — so the signup can be matched to the ad that produced it. That is the whole of it: no name, no specialty, no profile content, and nothing a client ever typed.
  
  The people these pages are addressed to are professionals considering a business listing, not people seeking care. If you are looking for a therapist, the pages you use — the directory, the matching assistant, and every therapist’s profile — carry none of this, and never will.

Across everything we run:

• No advertising pixel ever runs on a page where care is looked for or delivered. Not on the directory, not on the matching assistant, not on any therapist’s profile page, and not on any clinical screen inside the app — not your sessions, your clients, your notes, your schedule, or your clients’ portal. The one advertising pixel we use — Meta’s, described above — runs only on our marketing and therapist-signup pages and on three confirmation screens shown to a therapist — after signing up, after starting a subscription, and when a course lead first opens the free course, so we can tell which advertisement brought a therapist to us. Those three screens carry no client information of any kind. The pixel exists for one purpose: finding licensed therapists to list.
• No data-broker scripts, anywhere, and no TikTok, Snap or LinkedIn pixels.
• We never place third-party analytics or tracking on the clinical app or on the directory — third-party analytics run only on the general marketing pages described above and on the three therapist confirmation screens named in the first bullet. The only measurement on the directory is the first-party, anonymous activity record described in the directory bullet, which never leaves us.
• Nothing a client does is ever used for advertising. No search you run, no conversation with the matching assistant, no profile you open, and nothing in a therapy session is sent to any advertising platform, in any form, ever. On the pages that touch care this is enforced by architecture — the third-party scripts are simply not present — and not merely by policy.
• We do not build advertising audiences from client or health information, and we do not engage in cross-context behavioral advertising directed at people seeking care.
• Nothing loads until you say so. On the marketing and therapist-signup pages described above, Google Tag Manager, Google Analytics and the Meta pixel do not run when you arrive. You are asked first, in a notice at the foot of the page, and nothing loads unless you accept. Declining is a single click, in a button the same size and weight as the one that accepts — we do not make refusing the harder path. If your browser or an extension sends the Global Privacy Control signal, we treat that as an answer already given: nothing loads and you are not asked again. If you accept and later change your mind, use Cookie choices in the footer of any page, or the control at the end of this policy; when you turn them off we also delete the analytics and advertising cookies already on your device (_ga, _gid, _fbp, _fbc) rather than merely stopping new ones. Ordinary tracker-blocking extensions work too. The site works fully either way — and the pages that touch care carry none of this whatever you choose.

5. What we never do with your information

These are commitments, and for therapists they are also contractual terms in our Business Associate Agreement:

1. We never sell personal information or health information — anyone’s, ever.
2. We never use or disclose health information for advertising, ad targeting, ad measurement, or audience building.
3. We never give advertising platforms, social networks, or data brokers access to any information about therapists’ clients.
4. We never use clients’ health information to train or improve products for anyone other than the treating therapist and we will not use it for machine-learning development without explicit, separate, non-bundled consent.
5. We never charge per client or per session — so we have no business incentive to mine client data.

These five are about clients and their health information, and they are absolute. For completeness, the one thing that sits outside them: we advertise to recruit therapists, and our marketing and therapist-signup pages carry a Meta advertising pixel that reports page views and, on signup, a hashed therapist email (Section 4). That concerns professionals choosing to list a business. It touches no client, no session, and no health information — and none of the five commitments above bends for it.

6. How we protect information

• End-to-end encrypted sessions (DTLS-SRTP, peer-to-peer) — see Section 3.
• Encryption in transit: all connections to our sites and app use TLS (HTTPS/WSS).
• Encryption at rest: our server storage volumes are encrypted, and uploaded documents receive an additional layer of application-level encryption (AES-256-GCM) with the key held outside the database.
• Access controls and audit logs: access to clinical records is limited to the treating therapist’s account and logged.
• Hardened infrastructure: hosting on AWS under a signed Business Associate Addendum, using only HIPAA-eligible services; login rate-limiting; one-time session links that expire.
• No system is perfectly secure, and we will not pretend otherwise — which is why Section 10 exists.

7. When we share information

We share personal information only with:

• Your therapist (for clients): your check-in location and anything you communicate in session goes to them directly — that is the product.
• Service providers (subcontractors) who host or support our systems — currently Amazon Web Services (hosting, under a BAA) and Stripe (therapist subscription payments; no health data). Those two are the complete list; if it ever changes we will update this policy. Each provider that touches health data signs a business associate agreement with us.
• Legal requirements: we may disclose information if required by a valid legal process, and where lawful we will notify the affected therapist so they can object. Requests concerning clinical records are directed to the therapist as the record holder wherever the law permits.
• Business transfers: if MyTherapyMatch is acquired or merges, health information remains subject to HIPAA and to our BAA commitments (including the no-advertising, no-sale terms, which survive), and we will provide notice before any such change takes effect.
• Analytics and advertising, on our marketing and therapist-signup pages only: Google (aggregate site analytics) and Meta (page views, and a hashed therapist email when a listing is created, so we can measure which recruitment ads work). This is described in full in Section 4. No client, session, directory-search or health information reaches either of them, and neither receives anything at all from the app or the therapist directory.

We do not share information with anyone else.

8. Your rights

For clinical records (clients): HIPAA gives you the right to access, request amendment of, and receive an accounting of disclosures of your treatment records. Because your therapist is the covered entity and record holder, direct these requests to your therapist; we support therapists in fulfilling them, including data export. If you contact us instead, we will route your request to your therapist within five business days.

For everything else: therapists may access, correct, export, or delete their account information by contacting hello@mytherapymatch.com or using in-app tools. When a therapist leaves the platform, they may export all of their clinical data in a standard format; we then return or destroy remaining data per our BAA.

Complaints: you may complain to us at hello@mytherapymatch.com, to your therapist, or to the U.S. Department of Health and Human Services Office for Civil Rights (hhs.gov/ocr). We will never retaliate against anyone for exercising privacy rights.

9. California residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act as amended by the CPRA gives you rights over “personal information.” Two notes specific to us:

• Health information we handle as a HIPAA business associate (clinical notes, assessment scores, session-related data) is generally exempt from the CCPA. Your rights over that information run through HIPAA and your therapist, as described above.
• Therapist account, license, billing, and website data is ordinary personal information, and for it California residents have the rights to know/access, delete, correct, portability, and non-discrimination for exercising rights.
• We do not sell personal information, as that term is defined in California law, and we have not done so in the preceding 12 months. We never share client or health information for cross-context behavioral advertising. Our marketing and therapist-recruitment pages do carry a Meta advertising pixel (Section 4), which sends Meta page views and, when a therapist creates a listing, that therapist’s email address in hashed form. Some state privacy laws would treat that as “sharing.” Rather than argue the point, we do not do it unless you agree to it: the pixel and the analytics do not load at all until you accept them, and if your browser sends the Global Privacy Control signal we treat that as a decision already made and never ask. You can change your answer at any time from Cookie choices in the footer of any page.
• We do not use or disclose sensitive personal information for any purpose beyond providing and securing the service, and never to infer characteristics about you.
• To exercise any of these rights, write to hello@mytherapymatch.com. We will verify your identity and respond within 45 days (extendable once by 45 days, with notice). You may use an authorized agent.
• We extend these rights to everyone who asks, wherever they live, rather than only where a statute compels it.

10. If a breach happens

If we discover a breach of unsecured health information, we will notify the affected therapist(s) without unreasonable delay — our internal commitment is within five business days of discovery, well inside HIPAA’s 60-day maximum — with the facts they and their clients need: what happened, what information was involved, and what we are doing about it. Therapists, as the covered entities, lead notification to their clients as HIPAA requires, and we support them. Where state breach-notification laws impose direct duties on us (for example, for therapist account data), we comply with those timelines too. We will never bury a breach.

11. Children

MyTherapyMatch v1 is for adults. Client sessions are intended for individuals 18 or older, and therapist accounts require professional licensure. We do not knowingly collect information from anyone under 18, and never from anyone under 13. If we learn we have collected such information, we will delete it and notify the therapist involved. Support for minor clients (with parent/guardian consent flows appropriate to each state) is on our roadmap and this policy will be updated before any such launch.

12. Data retention

• Session media (video/audio/chat): never stored — nothing to retain.
• Client check-in location: transient; see Section 3.
• Clinical notes and assessment scores: retained for as long as the therapist maintains them, and returned or destroyed per the therapist’s instructions when they leave the platform (therapists have independent professional record-retention duties, so export precedes deletion).
• Therapist account/billing records: for the life of the account plus seven years for tax, audit, and legal purposes.
• Audit logs: six years, consistent with HIPAA documentation requirements.
• Anonymous directory activity (searches and matching-assistant conversations): retained while we operate the service, so matching can keep improving; it carries no name, account, IP address, or contact information to begin with.
• Encrypted backups: rotated on a regular cycle; deleted data ages out of backups as they rotate, rather than instantly.

13. Changes to this policy

We will post changes here with a new effective date and version number. For material changes, we will notify therapists by email and in-app notice at least 30 days before the change takes effect. We will never use a policy change to retroactively permit selling or advertising use of health information — Sections 5 and 9’s commitments do not have a “we may update this” escape hatch.

14. Contact

Beachhead Enterprises, LLC (d/b/a MyTherapyMatch)
19528 Ventura Blvd., Suite 468
Tarzana, CA 91356
hello@mytherapymatch.com

Security researchers: please write to the same address with “Security” in the subject line, and we will reply.