Who we are
For this website, the data controller is Dr MG Lazarus, trading as ProvenTherapy, based in Ireland. “ProvenTherapy”, “we”, “us”, and “our” in this notice refer to that controller.
This policy covers proventherapy.com, website enquiries and booking requests, the Tranquillity mobile app, Bonds & Blessings, the ProvenTherapy desktop application, product support, and information received in connection with purchases. A third-party shop, app store, download platform, optional integration, or linked website may also apply its own privacy policy.
The role of data controller depends on the product and data involved. Dr MG Lazarus / ProvenTherapy is controller for website enquiries, direct support correspondence, customer administration, and operational data it receives. A therapist or practice using the ProvenTherapy desktop app is normally the controller for the client and clinical data entered into that app. Apple, Google, Polar, and other independent services may be separate controllers for information they collect directly under their own terms.
Website, enquiries and purchases
Information you give us
- Your name, email address, phone number, and contact preferences.
- The type of enquiry or session you select and the message you send.
- Support correspondence and files or diagnostic information you choose to send.
- Purchase, licence, transaction, and customer-support information needed to supply and support a product. Full payment-card details are handled by the payment provider and are not received or stored by ProvenTherapy.
Email address and message are required to submit a website form; other marked fields may also be required for the selected request. If required information is not provided, we may be unable to respond, arrange a service, complete a purchase, validate a licence, or provide the requested support. Unless we tell you otherwise, providing website information is not a statutory requirement.
Information processed automatically
- Basic request, log, and security information such as IP address, approximate region inferred from it, browser or device type, requested page, date and time, referring page, and signals used to prevent abuse.
- Cloudflare Turnstile security signals when you use a protected form.
- Information necessary to serve pages, fonts, maps, downloads, and linked checkout services.
Tranquillity mobile app
Tranquillity is an optional self-guided reflection and remembrance app intended only for adults aged 18 or over. No ProvenTherapy account is required. The app does not contain advertising or developer-operated analytics, and it does not intentionally transmit your private writing or photos to ProvenTherapy.
Data used on your device
- Journal entries, prayers, letters, memories, reflections, and other text you create.
- Photos or images you choose to add to the Memory Jar or related features.
- Mood, inner-weather, gratitude, daily-practice, and progress entries.
- App preferences, completion state, favourites, and other settings needed for the app to work.
This content is processed and stored locally by the app. ProvenTherapy does not operate a server that receives this content and cannot view or recover it. Core writing and reflection features can be used offline; optional App Store purchases and external links require an internet connection and are processed by the relevant provider.
App-store and device processing
Apple or Google processes the download and any voluntary in-app purchase or contribution. The store may process account, device, payment, tax, fraud-prevention, and transaction data under its own privacy policy. ProvenTherapy may receive a transaction confirmation or aggregated sales information but not full card details. Apple currently describes Tranquillity’s purchase-related financial information as data that may be collected but is not linked to the user’s identity.
Your device manufacturer, operating system, app store, or backup service may independently create device backups, diagnostics, purchase records, or crash information depending on your settings. Those processes are not the same as collection by the Tranquillity app and are controlled through your device or store account.
Bonds & Blessings
Bonds & Blessings is designed as an offline-first relationship and reflection app. No ProvenTherapy account is required. The app does not contain advertising or developer-operated analytics, and it does not intentionally transmit your private reflections to ProvenTherapy.
Data used on your device
- Reflections, journal-style responses, message drafts, notes, and content you enter into guided tools.
- Inner-weather or emotional check-ins, progress, favourites, and activity completion.
- Preferences and settings needed to personalise the on-device experience.
This content remains locally on the device under the app’s normal operation. ProvenTherapy does not operate a user-content server for Bonds & Blessings and cannot view or recover your entries. The current Apple App Store privacy label states that the developer does not collect data from this app.
Purchases and platform services
Apple or Google processes the app purchase and may process account, payment, device, tax, fraud-prevention, and transaction information under its own privacy terms. ProvenTherapy may receive transaction confirmation or aggregated store reporting, but does not receive full card details. Device backup, family-sharing, store, or operating-system services may process information independently according to your platform settings.
ProvenTherapy desktop application
ProvenTherapy is a local-first working environment for practitioners. Its clinical database is encrypted and stored on the practitioner’s Windows PC or Mac, not in a ProvenTherapy-hosted clinical-record cloud.
Data stored locally
- Practitioner, practice, and client identity and contact information.
- Appointments, intake information, session notes, treatment plans, goals, assessments and outcomes, mental-state material, consent and privacy records, resources, correspondence, and audit history.
- Practice-finance records, fees, income, expenses, and payment-method descriptions entered by the practitioner.
- App configuration, calendar preferences, backup status, feature settings, and locally generated dictation or working content.
For this local clinical data, the practitioner or practice is normally the data controller. The practitioner decides what is entered, the lawful basis, who may access it, how long it is retained, and whether an optional external feature is used. ProvenTherapy provides GDPR-supportive tools, but using the software does not by itself make a practice legally or professionally compliant.
Optional and operational connections
- Licence and update services: a licence key, app/version information, device or installation identifiers, IP address, and limited operational data may be processed to validate a licence, deliver updates, prevent misuse, and provide support. These connections do not transmit the local clinical database.
- Cloud-assisted transcription or AI: only when enabled and invoked, selected audio or text needed for the request may be sent to the configured service. The practitioner is responsible for settings, lawful basis, transparency, data minimisation, and recording client consent where required. On-device dictation remains local.
- External assessments: information needed to send, complete, and return an assessment may be processed by the configured assessment and email services before the result is imported into the encrypted local record.
- Email and correspondence: recipient details and the message, resource, assessment, or attachment selected by the practitioner are sent through the configured email service.
- Calendar synchronisation: appointment fields selected or configured by the practitioner are shared with the chosen CalDAV, Google Calendar, or Outlook service. Privacy-aware titles help minimise disclosure but do not eliminate the external provider’s processing.
Backups and recovery
Manual and automatic backups are encrypted and stored in locations chosen or configured by the practitioner. An external-path copy is a backup copy, not live cloud synchronisation. Recovery requires both a valid backup and its 24-word Recovery Phrase. ProvenTherapy cannot recreate a lost phrase or reconstruct records without a valid backup. The practitioner is responsible for access controls, secure backup destinations, testing recovery, retention, device disposal, and responding to any loss or compromise of locally controlled data.
Purposes and legal bases
Enquiries and appointments
To respond, discuss suitability and availability, and take steps you request before a service is agreed.
Purchases and support
To fulfil a contract, provide licences or downloads, support customers, and maintain necessary transaction records.
Security and reliability
To protect forms and services, prevent fraud or misuse, diagnose faults, and keep the website available.
Legal responsibilities
To meet tax, accounting, professional, safeguarding, or other legal obligations where they apply.
Depending on the context, the legal basis under the GDPR is taking steps at your request or performing a contract; complying with a legal obligation; our legitimate interests in operating, securing, improving, and supporting a proportionate service; or consent where it is specifically requested. Legitimate interests are balanced against the person’s rights and expectations. Consent may be withdrawn at any time without affecting earlier lawful processing.
Health information, therapy material, religious or philosophical beliefs, and other special-category data require an additional Article 9 GDPR condition. For direct therapeutic services this may include health or social-care provision subject to professional confidentiality, explicit consent where appropriate, or another condition available under applicable law. Practitioners using the desktop app must identify and document their own lawful basis and special-category condition.
We do not sell personal data and do not use it for automated decision-making or behavioural advertising.
Service providers and external links
We use a small number of providers to operate the website and deliver requested services. They process data under their own terms and, where applicable, on our instructions:
- Cloudflare hosts and protects the website and provides Turnstile security checks for forms.
- SMTP2GO delivers messages submitted through the contact and booking forms to us by email.
- Polar provides secure software checkout and payment processing.
- Google supplies web fonts and an embedded map on the contact page.
- GitHub hosts software release downloads.
- Apple and Google Play distribute the mobile apps, process store purchases and in-app purchases, and may provide platform security, diagnostics, backup, or family-sharing features.
- Optional providers selected or configured by a practitioner may process assessment delivery, email, calendars, cloud-assisted transcription, or AI requests initiated from the desktop app.
Links to Amazon, Apple App Store, Google Play, and other external websites take you to services we do not control. Those organisations decide how they handle data on their own sites.
Some providers may process data outside Ireland or the European Economic Area. Where we are responsible for such a transfer, we use an applicable safeguard or other lawful transfer mechanism.
You may contact us for more information about relevant recipients, transfer locations, and the safeguards available for a particular processing activity.
Retention, deletion and security
We keep personal data only for as long as it is needed for the purpose collected, to provide services and support, and to satisfy applicable legal, accounting, professional, or dispute-resolution requirements. Retention therefore varies by record type. An enquiry that does not proceed may be deleted sooner than a transaction record or a record we are legally required to keep.
We use proportionate technical and organisational safeguards, including encrypted connections, access controls, anti-abuse checks, and carefully selected service providers. No internet transmission or storage system can be guaranteed completely secure.
Local app data
Mobile-app content remains until you delete it through an available app function, clear the app’s storage, or uninstall the app, subject to any device or operating-system backup you control. Deletion and uninstall behaviour can vary by platform; removing an app may permanently remove content. Back up only where the app and your privacy requirements permit.
Desktop clinical data remains under the practitioner’s control until deleted under the practice’s retention policy. Copies may persist in encrypted backups until those backups expire or are securely destroyed. A rights or deletion request about a practitioner’s client record should be directed to that practitioner or practice.
Security limits and incident responsibility
Local-first design reduces central collection but cannot protect against every risk. Device theft, malware, weak passwords, shared accounts, insecure backups, screenshots, exports, email, calendar services, user error, or compromised third parties can expose data. Users and practitioners must secure their devices, accounts, recovery phrase, exports, and backup locations and install security updates. Where ProvenTherapy becomes aware of a breach involving data for which it is controller, it will assess and act on applicable notification duties. Practitioners remain responsible for incidents involving records under their control.
Your rights and who should respond
Subject to the GDPR and applicable Irish law, you may have the right to:
- access your personal data and receive a copy;
- correct incomplete or inaccurate data;
- ask for erasure or restriction in certain circumstances;
- object to processing based on legitimate interests;
- receive certain data in a portable format; and
- withdraw consent where processing relies on consent.
These rights are not absolute, and a legal or professional obligation may require some information to be retained. We may need to verify your identity before acting on a request.
We will respond without undue delay and normally within one month. The GDPR permits an extension of up to two further months for a complex request or multiple requests; if an extension is needed, the controller should explain this within the initial one-month period.
Contact ProvenTherapy about website, direct support, licence, or customer information it holds. Contact the relevant practitioner or practice about client or clinical information held in their desktop app. For mobile content that never left your device, exercise control through the app and device; ProvenTherapy cannot search for or action a request against data it never received. Contact Apple, Google, Polar, or another independent provider about data it controls.
Important healthcare, children and app-use notices
Not an emergency or replacement for professional care
Tranquillity and Bonds & Blessings offer optional self-guided reflection and remembrance activities. They are not medical or mental-health services and do not provide professional care, diagnosis, or advice. They are not substitutes for a qualified clinician, emergency service, safeguarding response, or professional relationship advice. ProvenTherapy is a record and workflow tool for qualified practitioners; it does not replace clinical judgement, professional supervision, legal advice, or the practitioner’s duties.
If you or another person may be in immediate danger, contact local emergency services. In Ireland call 999 or 112; Samaritans can be reached on 116 123. Do not rely on an app, website form, email, or AI-assisted feature in an emergency.
Children and family devices
Tranquillity is intended only for adults aged 18 or over. The services are not designed to create online accounts for children and ProvenTherapy does not knowingly seek to collect children’s personal data through the mobile apps. Parents and guardians should control device access, purchases, family sharing, and backups. Do not enter information about another person unless you have a lawful and fair reason to do so.
User responsibility and availability
You are responsible for deciding whether an app is appropriate for your circumstances, for protecting access to the device, and for keeping any needed copies. Software and content are provided subject to applicable consumer law and may be updated, changed, interrupted, or withdrawn. No statement in this policy excludes rights or liabilities that cannot lawfully be excluded. Privacy and security controls reduce risk but cannot guarantee absolute confidentiality, uninterrupted availability, data recovery, or freedom from all defects and third-party actions.
Contact and complaints
For a privacy question or rights request, contact:
Dr MG Lazarus / ProvenTherapyEmail: mg@proventherapy.com
Phone: +353 (87) 6770447
Suirside Medical Centre, Cooleens, Clonmel, Co. Tipperary, E91 E339, Ireland
You also have the right to complain to Ireland’s supervisory authority, the Data Protection Commission.
We may update this notice when our services or legal responsibilities change. The date at the top shows the latest revision.