Privacy Policy

This Privacy Policy sets out what personal data the Fanus platform (website, panels, and related services) collects about clients and specialists, why, how it is used, who it is shared with, and how it is protected. Using the platform requires familiarity with this policy; processing of special-category data requires the explicit consent given at registration. This document applies together with the Platform Terms of Use.

Account data: first name, last name, email, phone number, password (stored only as a cryptographic hash), selected language.

Client profile: date of birth, an optional emergency contact person and home address (stored encrypted), timestamps of registration consents.

Service data: session bookings and history, packages, payment records (amount, method, status), correspondence and request notes with the specialist, reviews, psychological test answers and results, session notes kept by the specialist.

Special-category health-related data: reason for the request, session notes, test results, and the specialist's clinical notes — processed solely for delivering the service and on the basis of explicit consent.

Specialist data: identity, education and qualification documents, certificates, work experience, profile content, information required for billing.

Technical data: login history, IP address, device and browser information, security audit log.

Data is used only for these purposes: delivering the service (organising sessions, matching specialists with clients, operator support); recording payments and billing; account security and abuse prevention; fulfilling legal obligations; analysing service quality; and, where explicit consent has been given, sending product and campaign notifications.

Marketing notifications are sent only on the basis of consent given at registration or separately afterward, and you may opt out at any time.

Data processing is carried out in accordance with the Law of the Republic of Azerbaijan "On Personal Data" and other applicable legislation. Legal bases: performance of the contract concluded with the user (the Terms of Use); legal obligations; the user's explicit consent (for special-category health data and for marketing); and Fanus's legitimate interest in the security of the platform.

Session notes and other sensitive clinical content are stored encrypted in the database. Under normal circumstances only the treating specialist can access this content.

Platform administration may access clinical content only in exceptional cases, with written justification, for a limited period (24 hours), and under full audit; the client's specialist is notified of any such access.

The operator team sees only the minimum information necessary to organise the service (contact details, booking, payment status); it does not see session content.

Fanus does not sell personal data and does not transfer it to third parties for marketing purposes. Sharing is limited to: the chosen specialist (to the extent necessary to deliver the service); technical providers used to operate the service — hosting, email delivery and similar services (only to the necessary minimum extent and under a confidentiality obligation); courts and authorised state bodies where required by law; and situations involving a serious risk to life or safety.

A psychologist may voluntarily connect their own Google Calendar to Fanus. This feature is for psychologists only and is enabled by the user's explicit consent on Google's permission screen. Two permissions are requested: to view, create, edit and delete calendar events (calendar.events), and to see the email address of the Google account so that the connected account can be displayed.

With these permissions Fanus: (a) creates the psychologist's Fanus appointments as events in their Google Calendar, updates them when the appointment changes and deletes them when it is cancelled — the event title contains the patient's name and the description contains only the appointment number and status; the patient's email, phone number and appointment note are not sent to Google, the patient is not added as an attendee, and no invitation emails are sent; (b) reads the title, time and status of the other events in the psychologist's Google Calendar solely to show them to that psychologist in the calendar inside the Fanus panel. These events are not stored in the Fanus database.

The Fanus database stores only an encrypted refresh token needed to talk to Google, the email of the connected account, and the identifier linking an appointment to its Google event. Information received from Google is not used for advertising, is not sold and is not transferred to third parties; it is used only to provide this feature in the psychologist's calendar. Exceptions: where required by law, for security or abuse investigations, and with the user's explicit consent.

A psychologist can disconnect the integration at any time from the Google Calendar card on their profile page — Fanus then deletes the stored token and also revokes it on Google's side. Access can also be revoked directly at https://myaccount.google.com/permissions. Events created before disconnecting remain in the psychologist's Google Calendar and can be deleted there manually.

Fanus's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Data is kept only for as long as necessary for its purpose: account data — for the duration of membership; session and payment records — for the period required by accounting and legal requirements; security logs — for a limited period. Once the period expires, data is deleted or irreversibly anonymised.

Users may request deletion of their account from their personal account settings. Upon deletion, personal identification data is anonymised; records that legislation requires to be retained (e.g. payment and accounting documents) are kept for the required period. Re-registration and account recovery using a deleted account's email address is possible only by contacting support.

The platform uses only cookies necessary for operation: session and login tokens (secure, HttpOnly) and language preference. No third-party advertising or tracking cookies are used.

Data is transmitted over an encrypted channel (HTTPS); passwords are hashed, and sensitive clinical content and emergency-contact data are stored encrypted; access is restricted on a role basis; critical operations are recorded in an audit log. No system can guarantee absolute security; if an incident is detected, Fanus takes action in accordance with the law and notifies users where necessary.

Users have the following rights regarding their personal data: to access their data; to request correction of inaccurate or outdated data; to request deletion (except where a legal retention obligation applies); to withdraw consent given at any time (without affecting the lawfulness of processing carried out before withdrawal); and to opt out of marketing notifications.

These rights may be exercised through the settings in your personal account or via the official support channel. Requests are answered within a reasonable time.

Data of persons under 18 is processed only on the basis of the valid consent of a legal representative and in accordance with the requirements of applicable legislation.

Specialists undertake to process client data only to the extent necessary for the service, not to keep it outside the platform, and not to share it with third parties. Detailed requirements are set out in Section II of the Platform Terms of Use.

Fanus may update this policy in line with legislation and its service model. Significant changes are announced before they take effect, via the website, personal account, or email. Continued use of the service after a change constitutes acceptance of the new version.

For questions and requests related to privacy, please use Fanus's official support channel: [email protected] or the contact form on the website. This policy is governed by the legislation of the Republic of Azerbaijan.