Legal
Privacy policy
Last updated: 17 October 2026
Who we are
Therapywork is a trading name of Sylloge Ltd, a company registered in England and Wales, company number 17461399. Our registered office is 124 City Road, London EC1V 2NX.
We are registered with the Information Commissioner's Office under registration number ZC256611.
You can reach us at hello@therapywork.space.
The short version
Therapywork is software you install and run on your own device. Your clients' records are created on your device, encrypted on your device, and stored on your device. They are never sent to us, and we have no way to read them.
What we hold about you is small: an email address, a licence key, and whatever your payment provider tells us about your subscription.
What the app stores on your device
Everything clinical. Client records, session notes, appointments, documents, invoices, payments — all of it is held in your browser's local database on the device you use.
This data is encrypted at rest using AES-256-GCM. The key that encrypts it is protected by a passphrase you choose, using PBKDF2-SHA256.
Encryption is not optional. A device may hold client-linked records only if encryption is switched on. The app will not let you create a client record until you have set a passphrase.
We cannot recover your passphrase. We do not have it and we do not hold anything derived from it. If you lose it, the data on that device cannot be decrypted — by you, by us, or by anyone else. Keep a backup.
Backups
You can export an encrypted backup file. That file is encrypted with your passphrase and can be restored onto any device, including a new one.
The file is yours. It is written to wherever you choose to save it, and we never see it. If you store it somewhere — a cloud drive, a USB stick, an email to yourself — it is as safe as the place you put it and the passphrase that protects it.
One thing is deliberately left out of a backup: your licence key. It belongs to a device rather than to a practice, so restoring a backup does not carry a licence from one machine to another.
What we collect about you
| What | Why | How long |
|---|---|---|
| Your email address | To issue and reissue your licence key, and to reply when you write to us | While you are a customer, and for seven years afterwards |
| Your licence key and its history | To know what you have bought | As above |
| Correspondence you send us | To answer it | As above |
That is the whole list. We do not run analytics, we do not track your use of the app, and we do not know how often you open it or what you do in it.
Payments
Payments are handled by Stripe. When you buy or renew a subscription, Stripe collects your card details and processes the payment. We never see or hold your card number.
Stripe tells us your email address and whether a payment succeeded. That is what triggers a licence key being issued to you.
Stripe's own privacy policy is at stripe.com/privacy.
Your licence
Your licence key is verified entirely on your own device. The app checks a cryptographic signature against a key built into the software. It does not contact us or any server to activate or validate a licence, so we learn nothing about when or where you use the app.
If a licence lapses, the app does not lock you out of your records. You can still open, read, export and back up everything. Creating and sending new material is what stops.
Video sessions
Video calls run on a server we operate at video.therapywork.space, using Jitsi Meet.
Audio and video pass through that server in order to reach the other person. Nothing is recorded and nothing is stored. When a call ends, nothing about it remains on the server.
The server is hosted by Hetzner Online GmbH in Germany.
Join links are generated by your device and sent by you, using your own email or messaging app. We do not send them and do not know who you send them to.
Your device keeps a record of each call's connection quality, with no names, addresses or room names, for no more than your last 10 calls or 14 days. It never leaves your device unless you save a copy yourself.
Cookies
The app itself sets no cookies and uses no tracking of any kind.
The video server may set a small number of cookies necessary to run a call. These are functional, not analytical.
Your clients' data — you are the controller
For your clients' records, you are the data controller. You decide what to record, how long to keep it, and what to do when a client asks about it. Your professional body and your insurer will have views about retention, and those apply.
We are not a processor of your clients' data, because it never reaches us. We supply software that runs on your device; we do not host, receive, transmit or store anything clinical.
The exception is video: while a call is in progress, audio and video pass through our server. Nothing is retained, but for that period we are processing it on your behalf.
Your rights
You have the right to ask us what we hold about you, to have it corrected, to have it deleted, to object to how we use it, and to receive a copy. Write to hello@therapywork.space and we will respond within one month (or tell you within that month if we need longer).
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.
Who else is involved
| Who | What they do | Where |
|---|---|---|
| Stripe | Processes payments | Ireland and the USA |
| Netlify | Hosts this website and the app files | USA |
| Hetzner | Hosts the video server | Germany |
| Zoho | Hosts our email | EU |
None of these ever receives your clients' records.
Changes
If we change this policy we will update the date at the top. If a change is significant we will tell customers by email.