Legal Documents

1. Parties and Acceptance

These Terms of Use are entered into between PsyPractice (hereinafter the "Platform" or "Data Controller") and any natural or legal person who accesses or uses the Platform (the "User"). By creating an account, signing in, or using the Platform in any manner, the User confirms that they have read, understood, and unconditionally accept and undertake these Terms in full. Anyone who does not accept these Terms must not use the Platform.

2. Nature of the Service — For Educational Purposes Only

• PsyPractice is an AI-assisted patient SIMULATION and educational tool for psychology students and trainee clinicians.
• The Platform is NOT, and is not a substitute for, real psychotherapy, medical/psychological diagnosis, treatment, supervision, or any clinical competency certification.
• The simulated “patient” is not a real client; its responses are synthesized by artificial intelligence, may be erroneous, incomplete, inconsistent, or misleading, and carry no claim of clinical accuracy or truth.
• Feedback reports produced by the supervisor AI are automated, developmental content; they do not replace professional supervision, expert opinion, or any official assessment.

3. User Representations and Undertakings

• The User undertakes to use the Platform solely for lawful, ethical, and educational purposes.
• The User agrees NOT to enter any REAL patient/client data, identifying information, or special-category health data belonging to any person; all legal consequences of doing so rest exclusively with the User.
• The User undertakes not to use any output obtained from the Platform for the diagnosis, treatment, intervention, or clinical decision-making concerning any real person.
• The User is solely responsible for their own professional competence, scope of authority, and compliance with applicable professional and ethical regulations.
• Account security, password confidentiality, and all activity carried out under the User's account are the User's responsibility.

4. All Liability Rests with the User (Waiver)

The Platform is provided “AS IS” and “AS AVAILABLE”, without any express or implied warranty whatsoever (including uninterrupted operation, error-freeness, fitness for a particular purpose, accuracy, or currency).

The User accepts and undertakes that they are EXCLUSIVELY and PERSONALLY responsible for any and all direct, indirect, incidental, special, or consequential damages (including material, moral, professional-reputation, data-loss, revenue-loss, and damages caused to third parties) arising from their use of, or inability to use, the Platform, from relying on AI outputs, or from applying such outputs in any way.

To the fullest extent permitted by applicable law, the User hereby irrevocably and unconditionally WAIVES — now and in advance — any and all claims, lawsuits, and rights to compensation that they might raise against the Platform, its owners, employees, developers, business partners, and service providers in respect of any harm they may face in the event of any adverse outcome.

The User further undertakes to hold the Platform fully harmless (indemnify) from any and all claims, damages, penalties, and costs (including attorneys' fees) should the Platform be approached by any third party or institution due to the User's own fault, negligence, or use in breach of these Terms.

5. Limitation of Liability

Without prejudice to the mandatory provisions of applicable law, the Platform's total legal liability shall in any event be limited to the amount actually paid by the User to the Platform in the 12 months preceding the event giving rise to the relevant claim. Where use is free of charge, this amount is zero.

6. Intellectual Property, Modification, and Termination

• All intellectual property rights in the Platform, its software, design, patient case templates, and content belong to the Platform.
• All transferable economic intellectual-property rights in any content the User creates on the Platform (including the therapist messages they write, session transcripts, and materials derived therefrom) are deemed assigned to the Platform exclusively, perpetually, and royalty-free at the moment such content is created; the Platform may use, reproduce, and process this content worldwide and without restriction for any purpose, including operating the service, generating feedback, and improving and training the system. The User's personal-data rights under applicable data-protection law (GDPR / KVKK) are unaffected by this assignment and remain reserved.
• The Platform reserves the right to modify, suspend, or discontinue these Terms and the scope of the service at any time, without prior notice.
• In the event of a breach of these Terms, the Platform may suspend or close the account without prior notice.

7. Governing Law and Jurisdiction

These Terms are governed by the laws of the Republic of Türkiye. The courts and enforcement offices of the Republic of Türkiye have jurisdiction over any dispute that may arise.

For consumers resident in the European Union, the protections afforded by the mandatory consumer-protection provisions of their country of residence and by their data-protection rights under the GDPR are reserved; this choice of law does not override those mandatory provisions.

This Privacy Policy explains how personal data is processed within the Platform operated by PsyPractice (hereinafter the "Platform" or "Data Controller"). As its baseline data-protection standard, the policy follows the EU General Data Protection Regulation (GDPR / 2016/679); for users located in Türkiye, the Turkish Personal Data Protection Law No. 6698 (KVKK) — in particular Article 9 on transfers abroad — additionally applies. The KVKK Information Notice and the Explicit Consent Statement are integral parts of this policy.

Data controller and hosting location

• Data controller: PsyPractice. Data-subject requests are handled through the contact channel announced on the Platform (contact email: privacy@psycora.com).
• Hosting: the Platform and its database are hosted within the European Union — in a data center in the Netherlands (Oracle Cloud). For users located in the EU/EEA, data is processed and stored within the EU.
• The hosting provider acts solely as a processor, under an executed Data Processing Agreement (DPA).

Data collected

• Account data: name, email, hashed password, subscription/plan information.
• Usage data: created sessions, session transcripts, generated patient cases, supervisor feedback reports.
• Technical data: session records, IP, browser/locale preference, rate-limit and security logs.
• Optional: the User's own Anthropic API key (stored encrypted).

Purposes of processing and legal basis (GDPR Art. 6)

• Performance of a contract (Art. 6(1)(b)): account creation, running sessions, multi-session patient memory, supervisor evaluation, subscription and usage-limit management.
• Legitimate interest (Art. 6(1)(f)): security, abuse prevention, system improvement, and debugging.
• Legal obligation (Art. 6(1)(c)): retention/reporting arising from legislation.
• Consent (Art. 6(1)(a)): analytics/product-improvement processing not strictly necessary for the service and, where required, transfer outside the EU/EEA.

International transfers

Because hosting is within the EU (Netherlands), the data of EU/EEA users is, as a rule, processed within the EU with no transfer to a third country at that layer. However, to generate AI responses, session content and prompts are transmitted to the AI service provider (Anthropic), whose processing infrastructure may be located outside the EU/EEA (e.g. the United States).

Such transfers outside the EU/EEA rely on appropriate safeguards under GDPR Art. 44 et seq. — in particular the European Commission's Standard Contractual Clauses (SCCs) — and a data processing agreement (DPA) is concluded with the provider. The Platform does NOT sell personal data for marketing purposes; data is not shared with third parties except where strictly necessary to operate the service (lawful requests by competent authorities reserved).

For users in Türkiye — KVKK Art. 9 (transfer abroad)

The personal data of users located in Türkiye is transferred outside Türkiye because hosting is in the Netherlands (EU), and may also be transferred to Anthropic for AI processing. These transfers fall under KVKK Art. 9 and rely on appropriate safeguards (the standard contract / undertaking published by the Board) or, where required, on your explicit consent. The scope, recipients, and purpose of the transfer are detailed in the KVKK Information Notice and the Explicit Consent Statement.

Data-subject rights (GDPR Art. 15–22)

• Access, rectification, erasure ('right to be forgotten'), and restriction of processing.
• Data portability: receiving the data you provided in a structured, commonly used, machine-readable format.
• Objection: objecting to processing based on legitimate interest and to direct marketing.
• Rights relating to solely automated individual decision-making/profiling.
• Withdrawing consent at any time for consent-based processing (withdrawal does not affect the lawfulness of processing up to that point).
• The right to lodge a complaint with a supervisory authority: the relevant data protection authority in the EU; the Personal Data Protection Authority (KVKK) in Türkiye.

Retention and security

• Data is retained for as long as the processing purpose requires and for the periods prescribed by applicable law; once the period expires it is deleted or anonymized.
• Sensitive fields (e.g. the User's API key, password) are kept encrypted/hashed; access is permission-based.
• As no method of transmission or storage is 100% secure, absolute security cannot be guaranteed.

Prohibition on real patient data

The Platform is an educational simulation; entering personal/health data belonging to real clients is prohibited. All liability arising from the User entering data in breach of this prohibition rests exclusively with the User.

Data Controller

Pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”), your personal data is processed by PsyPractice (hereinafter the "Platform" or "Data Controller") in its capacity as Data Controller, within the scope described below.

Data processed and purposes

• Identity/Contact (name, email): account creation, authentication, communication.
• Customer transaction (subscription, plan, usage): service delivery, billing, limit enforcement.
• Transaction security (session, IP, logs): security, abuse prevention, legal obligation.
• User content (session transcripts, generated cases): delivery of the educational service and feedback generation.

Legal basis (Art. 5)

• Conclusion/performance of a contract: data necessary to provide the service.
• Legitimate interest of the data controller: security, fraud prevention, system improvement.
• Legal obligation: retention/reporting arising from legislation.
• Explicit consent: transfer abroad (Art. 9) and additional processing not strictly necessary for the service.

Transfer abroad (Art. 9)

Because the Platform and its database are hosted within the European Union — in a data center in the Netherlands (Oracle Cloud) — the personal data of users located in Türkiye is transferred outside Türkiye (to the EU). In addition, to generate AI responses, session content and prompts may be transferred to the AI service provider (Anthropic), whose processing infrastructure may be located outside the EU/EEA (e.g. the United States).

These transfers abroad fall under KVKK Art. 9 and rely on appropriate safeguards — such as the standard contract / undertaking published by the Board — or, where required, on your explicit consent. Data processing agreements (DPAs) are concluded with the hosting and service providers.

Data-subject rights (Art. 11)

• To learn whether your personal data is processed and, if so, to request information.
• To learn the purpose of processing and whether it is used in accordance with that purpose.
• To know the third parties to whom data is transferred domestically or abroad.
• To request rectification of incomplete/incorrect processing and, where conditions are met, deletion/destruction.
• To object to a result against you arising solely from automated analysis.
• To claim compensation for damage suffered due to unlawful processing.

Applications

You may submit requests concerning your rights through the contact channel announced by the Data Controller. Applications are concluded within the periods prescribed by the KVKK and its secondary legislation.

I declare that I have read and understood the KVKK Information Notice, and that I freely, in an informed and explicit manner, consent to the processing described below. (Pursuant to KVKK Board decision No. 2018/90, explicit consent is obtained separately from the duty to inform.)

Processing consented to

• Transfer of my personal data outside Türkiye, and its storage and processing there, because the Platform is hosted in the European Union (Netherlands / Oracle Cloud) (KVKK Art. 9).
• Transfer and processing of my session transcripts and prompts at the AI service provider (Anthropic), whose processing infrastructure may be located outside the EU/EEA, for the purpose of generating AI responses (KVKK Art. 9).
• Processing for product improvement and analytics that is not strictly necessary to provide the service.
• Receiving service-related notifications.

Withdrawal of consent

I understand that I may withdraw my explicit consent at any time; however, since transfer abroad to the AI provider is technically required for the service to function, I accept that withdrawing this consent may result in my being unable to use the relevant features or the service as a whole. Withdrawal does not affect the lawfulness of processing carried out up to the date of withdrawal.

The Platform uses cookies and similar local-storage technologies (localStorage) to maintain your session and remember your preferences.

Technologies used

• Strictly necessary: session/authentication token, security. The service does not work without these.
• Functional: language/locale preference (NEXT_LOCALE), interface preferences (e.g. theme).
• Performance/security: technical logs for rate-limiting and abuse detection.

Preference management

You can delete or block cookies in your browser; however, blocking strictly necessary cookies will prevent sign-in and core functionality. In line with GDPR / ePrivacy principles and the KVKK Cookie Guide, non-essential cookies are used only on the basis of your explicit preference/consent.