Data Processing Agreement (DPA)

Pursuant to Art. 28 GDPR

1. Subject and Duration of Processing

This Data Processing Agreement governs the processing of personal data by MatchYourTherapy (processor) on behalf of therapists registered on the platform (controllers). Processing takes place for the duration of the therapist's use of the platform and ends upon account deletion or contract termination.

2. Nature and Purpose of Processing

Processing includes the storage and display of therapist profile data, the receipt and forwarding of contact requests from patients, and the matching between patients and therapists based on stated preferences.

3. Types of Personal Data

The following categories of personal data are processed:

Name and contact details of therapists
Professional qualifications and specializations
Name and email address of patients (for contact requests)
Therapy preferences of patients (anonymized for matching)
Usage data and statistics (pseudonymized)

4. Categories of Data Subjects

Data subjects include:

Patients who submit contact requests via the platform
Visitors who use the matching service

5. Obligations of the Processor

The processor commits to:

Processing data only on documented instructions from the controller
Implementing appropriate technical and organizational measures to protect data (encryption, access control, regular security audits)
Ensuring that all persons with access to data are bound by confidentiality
Assisting the controller in fulfilling data subject rights
Deleting or returning all data upon termination of processing
Providing the controller with all information necessary to demonstrate compliance with obligations

6. Sub-processors

The following sub-processors are used:

Vercel Inc. (Hosting, Edge Functions) — USA, EU Standard Contractual Clauses
Neon Inc. (PostgreSQL Database) — USA/EU, EU Standard Contractual Clauses
Stripe Inc. (Payment Processing) — USA, EU Standard Contractual Clauses
Cloudinary Ltd. (Image Optimization) — EU/USA, EU Standard Contractual Clauses
Resend Inc. (Email Delivery) — USA, EU Standard Contractual Clauses
Groq Inc. (AI-powered Matching) — USA, EU Standard Contractual Clauses
PostHog Inc. (Analytics, consent-based only) — EU Hosting

A detailed description of data processing by sub-processors can be found in our Privacy Policy.

7. Rights of Data Subjects

The processor assists the controller in fulfilling the rights of data subjects pursuant to Art. 15–22 GDPR, including access, rectification, erasure, restriction of processing, data portability, and objection.

8. Deletion and Return of Data

Upon termination of processing, all personal data will be deleted unless statutory retention obligations apply. Therapists can request deletion of their data and processed contact requests at any time via account settings.

9. Data Protection Contact

For questions about data protection and this DPA, please contact:

MMag. Dr. Gregor Studlar BA / MatchYour GmbH i.G.

Domgasse 14, 4020 Linz, Austria

datenschutz@matchyourtherapy.at

Last updated: March 2026