1. Who we are and what this covers
GoToTherapy operates an online platform that connects people with independent, licensed mental-health providers and offers an AI care companion for onboarding, matching, session preparation and between-session support.
This notice covers the GoToTherapy website, patient dashboard, provider portal and the AI companion. Your therapist is an independent licensed professional and is separately bound by their own professional obligations and by the confidentiality terms of your treatment relationship.
2. Information we collect
We collect only what is needed to deliver care, keep you safe and run the service.
- Account details: name, email, password (stored as a salted hash), time zone, and optional two-factor authentication settings.
- Care profile: what you tell the AI companion during onboarding — concerns, goals, preferences, location for licensure purposes, and urgency.
- Clinical records: appointments, therapist notes, assessments, check-ins, journal entries and exercise responses you choose to share.
- Communications: secure messages between you and your therapist, and your conversations with the AI companion.
- Billing: invoices, payment status and receipts. Card numbers are handled by our payment processor and never stored on GoToTherapy servers.
- Technical data: IP address (hashed for session security), browser type and audit events such as sign-ins and data exports.
3. How we use it
Every use falls into one of these purposes:
- Delivering care: matching you with eligible, licensed therapists; scheduling; telehealth video; secure messaging.
- Safety: a deterministic safety engine screens what you write for risk signals and surfaces crisis resources. Safety events are reviewed by trained staff.
- Between-session support: the AI companion offers reflection, exercises and session preparation. It never diagnoses, prescribes or claims to be a person.
- Billing and account administration, including fraud prevention.
- Legal compliance and, where you have opted in, de-identified quality improvement.
4. The AI companion
By default the platform runs a local, deterministic AI engine and your conversations never leave GoToTherapy infrastructure. If we enable a third-party language-model provider, conversation text is sent to that provider only when you have granted the Quality-improvement processing consent in Settings, and only under a signed agreement that prohibits the provider from training on or retaining your data.
AI-generated session summaries and note drafts are always reviewed by your therapist before they become part of your record. You can pause the companion at any time from Settings → AI controls.
5. Who can see your information
We do not sell your information, and we never use therapy data for advertising.
- Your therapist sees your care profile, appointments, messages to them, and anything you explicitly share (journal entries, exercise responses).
- GoToTherapy clinical-operations staff access records only for safety review, complaint handling, credentialing and support, and every access is written to an audit log you can request.
- Service providers (hosting, email delivery, payment processing) receive the minimum data needed to perform their function under contract.
- Authorities, only where required by law, or where there is an imminent risk of serious harm to you or someone else.
6. Your choices and rights
- Consent Center: grant or withdraw consent for telehealth, AI interaction, quality-improvement processing, communications and research at any time.
- Export: download everything we hold about you as a single file from Settings → Privacy & data.
- Delete: request deletion from Settings. Your account is deactivated immediately and remaining data is deleted within 30 days, except records we must keep by law (for example, clinical records retained for the period required by your therapist's licensing board).
- Correct: update your profile and preferences at any time, or ask us to correct anything else.
- Complain: file a report from the Support page or email us. You may also contact your state's health-privacy regulator.
7. Security
Data is encrypted in transit. Passwords are hashed with scrypt; session tokens are stored hashed; two-factor authentication is available to everyone and enforced for clinical and administrative roles. Telehealth video flows peer-to-peer with DTLS encryption and is never recorded. Access to production systems is limited, logged and reviewed.
8. Children
GoToTherapy is for adults 18 and older. We do not knowingly collect information from minors. If you believe a minor has created an account, contact us and we will remove it.
9. Changes and contact
When we change this notice we update the version number above and ask you to re-acknowledge it at your next sign-in if the changes affect your rights.
Questions or requests: support@gototherapy.com. If you are in crisis, call or text 988 (US) or call 911.