Privacy Policy

Effective date: February 2026

HoldSpace ("we," "us," or "our") is a practice management service operated by HoldSpace, accessible at holdspace.pro. This Privacy Policy explains how we collect, use, store, share, and protect your information when you use our service. It applies to all users of HoldSpace, including practitioners who create accounts and the client data they enter into the system.

By creating an account or using HoldSpace, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.

1. Information We Collect

1.1 Account Information

When you create an account, we collect your name, email address, and authentication credentials. If you sign in with Google, we receive your name, email, and profile picture from Google OAuth — we do not receive or store your Google password.

1.2 Practice and Client Data

You may enter information about your professional practice and your clients, including:

• Client names, contact details, and biographical notes.
• Session records: dates, times, session types, and booking status.
• Session notes: free-text notes and structured content you create about your sessions.
• Uploaded files: documents and images attached to client records or session notes.

Important: You act as the Data Controller for your client data under the EU/UK General Data Protection Regulation (GDPR). HoldSpace acts as the Data Processor on your behalf, as set out in our Data Processing Agreement. You are responsible for obtaining appropriate consent from your clients before entering their information into HoldSpace, and for complying with applicable privacy laws in your jurisdiction. Where your data includes special category data under GDPR Article 9 (including data concerning health, religious or philosophical beliefs, or sexual orientation), you warrant that you have obtained explicit consent from each client meeting the requirements of GDPR Article 9(2)(a).

1.3 Information Collected from Clients of Practitioners

If you are a client of a practitioner using HoldSpace, we may collect information directly from you:

• Booking information: when you book a session through a practitioner's booking page, we collect your name, email address, and selected appointment time.
• Intake form responses: your practitioner may create custom intake forms with various field types (text fields, checkboxes, radio buttons, etc.). The questions and structure of these forms are designed by your practitioner, not by HoldSpace. The information you provide may include health-related information, depending on the questions your practitioner asks.

Your practitioner is the data controller for the information collected through their booking page and forms. HoldSpace acts as a data processor on their behalf. For questions about how your practitioner handles your data, please contact them directly.

1.4 Voice Dictation and Transcription

HoldSpace allows you to dictate session notes using your voice. When you use this feature:

• Audio is captured in your browser and streamed directly to our transcription provider (Deepgram) for real-time conversion to text.
• Audio is never stored on our servers. Only the resulting text transcription is saved as part of your session record.
• Deepgram processes audio in real-time and does not retain it after transcription. Model improvement opt-out is enabled for all HoldSpace requests.

You are solely responsible for ensuring that your dictation environment is appropriate and for informing your clients if you dictate notes about your sessions with them.

1.5 AI-Processed Content

HoldSpace uses AI to process your session data in four ways:

• Transcription: voice dictation is converted to text in real-time by Deepgram (see Section 1.4 above).
• Note structuring: your transcription or session notes are sent to Google Gemini, which generates a structured version with key points, themes, and action items.
• Session status summary: when you view a client's record before a session, AI may generate a brief status based on previous session notes for that client. This helps you quickly recall where you left off.
• Deep analysis: at your request, AI reads all session notes for a specific client and generates an analytical summary. This is an assistive tool — it is not a clinical assessment and should always be reviewed by the practitioner.

For note structuring, status summaries, and deep analysis, your session note text is sent to Google Gemini for processing. Both your input and the AI-generated output are stored on our servers as part of your session record. AI providers do not retain your data after processing (see Section 4).

1.6 Payment Information

Payment processing is handled entirely by our Merchant of Record, Polar. When you subscribe to HoldSpace Pro, Polar collects and processes your payment details (credit card number, billing address). We do not have access to or store your full payment card information. We receive only a subscription status, billing period, and transaction identifiers from Polar.

1.7 Technical and Usage Data

We automatically collect:

• IP address, browser type and version, operating system, and device type.
• Pages visited, features used, and general interaction patterns within the Service.
• Error logs and performance data to maintain and improve the Service.

We also maintain an activity log that records actions performed within the Service (such as signing in, creating or editing records, and configuration changes). Each entry includes a timestamp, the type of action, your IP address, browser information, and a session identifier that links actions within a single login. This log is used for security monitoring, incident investigation, and regulatory compliance. It does not contain the content of your notes or client records — only the fact that an action occurred.

We do not use third-party analytics services or advertising trackers. All telemetry and activity log data is stored on our own servers.

Self-hosted web analytics (Umami). We operate a self-hosted Umami analytics instance on our own infrastructure (Hetzner, Helsinki, Finland) to understand which pages visitors use and which steps of signup people complete. This is an internal processing activity, not a third-party service:

• No cookies, no localStorage, no fingerprinting. The tracker is configured in cookieless mode — nothing is stored on your device.
• IP addresses are processed transiently. When you load a page, your IP is used briefly during the request to determine a country code and to compute a "visitor hash" (a scrambled value combining your IP, browser, and a secret value that we rotate every month). The raw IP is then discarded — we never store it. The visitor hash that remains is pseudonymous (it is treated as personal data under GDPR, but cannot be reversed back to your IP without the rotating secret).
• No personal identifiers. We do not record your user ID, email, or name in analytics events.
• First-party only. The analytics script is served from our own domain (holdspace.pro/_n/q.js); no third-party CDN or analytics SaaS is involved.
• Retention. We aim to keep raw events for up to 12 months and then delete them automatically; aggregated reports (which contain no personal data) are kept indefinitely. Automatic cleanup is being implemented before public launch.

The legal basis is legitimate interest under GDPR Art. 6(1)(f). We do not display a cookie banner because the tracker writes nothing to your device, performs no cross-site profiling, and falls within the analytics exemption recognized by some EU supervisory authorities (such as the French CNIL "Mesure d'audience" guidance and the Italian Garante's four-condition exemption) for cookieless first-party measurement. We acknowledge that regulatory positions on this point continue to evolve.

You can opt out at any time. At the bottom of this page there is a button that turns analytics off in your browser. The same button works for everyone — visitors and signed-in practitioners alike.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Service delivery: to provide, maintain, and improve the HoldSpace platform and its features.
• Transcription: to convert voice dictation to text via Deepgram.
• AI structuring: to generate structured session notes via Google Gemini based on your transcriptions and notes.
• Communications: to send transactional emails such as account verification, password resets, session reminders, and subscription notifications.
• Payments: to process subscriptions and manage billing through Polar.
• Security: to detect and prevent fraud, abuse, and unauthorized access.
• Improvement: to analyze usage patterns (in aggregate, not individual content) to improve the Service.

We do not use your session notes, client data, dictation audio streams, or AI-processed content for advertising, marketing to third parties, or training our own AI models.

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data on the following legal bases:

• Contract performance: processing necessary to provide the Service you requested (account management, session notes, transcription, AI structuring).
• Legitimate interests: processing necessary for our legitimate business interests, such as improving the Service, ensuring security, and preventing abuse — provided these interests are not overridden by your rights.
• Legal obligation: processing required to comply with applicable laws (e.g., tax records for subscriptions).
• Consent: where required, such as sending optional marketing communications (which we currently do not send).

4. Third-Party Services and Data Sharing

We share your data with the following third-party services strictly as necessary to operate HoldSpace. We do not sell, rent, or trade your personal data to any third party.

4.1 Deepgram (Voice Transcription)

• What is shared: audio stream from voice dictation (not stored, processed in real-time only).
• Purpose: real-time speech-to-text transcription using the Deepgram Nova-3 model.
• Data handling: Deepgram processes audio data in real-time and does not retain your audio after transcription is complete. Audio is transmitted over encrypted connections (TLS).
• Deepgram's privacy policy: deepgram.com/privacy

4.2 Google Gemini (AI Processing)

• What is shared: transcription text and/or session note content. No raw audio is sent to Google Gemini.
• Purpose: note structuring (generating organized summaries from your notes), session status summaries (brief recap based on previous notes), and deep analysis (analytical summary across all notes for a client).
• Data handling: we use the Google AI API (Gemini). Google is contractually prohibited from using your data for model training. Data is transmitted over encrypted connections.
• Google's privacy policy: policies.google.com/privacy
• Google AI terms: ai.google.dev/gemini-api/terms

4.3 Google OAuth (Authentication)

• What is shared: your authentication request when you choose to sign in with Google.
• What we receive: your name, email address, and profile picture.
• We do not access your Google contacts, calendar, files, or any other Google services beyond basic profile information.

4.4 Polar (Payments)

• What is shared: your email address and subscription selection.
• Purpose: payment processing, invoicing, tax compliance, and subscription management.
• Polar acts as our Merchant of Record and handles all payment card data directly. We never see or store your full card number.
• Polar's privacy policy: polar.sh/legal/privacy

4.5 Resend (Email)

• What is shared: your email address and email content for transactional messages (verification, password reset, session reminders).
• We do not send marketing emails through Resend or any other provider.

5. HIPAA and Health Information Disclaimer

HoldSpace is NOT a HIPAA-compliant platform.

The Health Insurance Portability and Accountability Act (HIPAA) applies to "covered entities" — primarily healthcare providers, health plans, and healthcare clearinghouses in the United States that transmit health information electronically in connection with certain transactions.

HoldSpace is designed for holistic and alternative practitioners (bodyworkers, energy healers, acupuncturists, tarot readers, astrologers, and similar professionals) who in many cases are not covered entities under HIPAA. However:

• If you are a HIPAA-covered entity (e.g., a licensed healthcare provider who bills insurance), you must not use HoldSpace to store, process, or transmit Protected Health Information (PHI) as defined under HIPAA.
• We do not offer a Business Associate Agreement (BAA) at this time.
• Our third-party service providers (Deepgram, Google Gemini) are not engaged under BAAs for HoldSpace data processing.
• While we are not yet HIPAA-certified, we apply industry-standard security protections — see our Security page for details of the specific measures in place.

Your responsibility: if you are unsure whether HIPAA applies to your practice, consult a qualified legal professional. By using HoldSpace, you represent that either (a) HIPAA does not apply to you, or (b) you will not use HoldSpace to process PHI subject to HIPAA.

Regardless of HIPAA status, we take the security and privacy of all data seriously and apply industry-standard protections as described in this policy. We may pursue HIPAA compliance in the future as the platform evolves.

6. Data Storage and Security

6.1 Infrastructure

• All primary data (database and files; dictation audio is never stored) is stored on a dedicated server located in the European Union.
• The server runs isolated Docker containers with restricted network access between services.
• Database backups are performed regularly and stored in encrypted form.

6.2 Security Measures

• All data in transit is encrypted using TLS 1.2 or higher (HTTPS).
• Passwords are hashed using modern, industry-standard algorithms (bcrypt/argon2). We never store plaintext passwords.
• Database connections are encrypted and restricted to internal container networks.
• Server access is restricted to SSH key-based authentication with fail2ban protection against brute-force attacks.
• Rate limiting is applied to authentication endpoints and API routes to prevent abuse.
• File uploads are stored in isolated object storage (MinIO) with access controls.

6.3 Data Breach Notification

In the event of a data breach that affects your personal data, we will:

• Notify affected users by email within 72 hours of becoming aware of the breach, as required by GDPR.
• Provide details about the nature of the breach, the data affected, and the steps we are taking to address it.
• Report the breach to the relevant supervisory authority where required by law.

7. International Data Transfers

While our primary servers are located in the EU, some data is transferred to third-party services that may process it outside the EEA:

• Deepgram: headquartered in the United States. Audio data is processed on EU-based servers (EU endpoint).
• Google (Gemini, OAuth): headquartered in the United States, with global infrastructure.
• Polar: may process payment data in jurisdictions outside the EEA.

Where data is transferred outside the EEA, we rely on the service providers' compliance mechanisms, which may include Standard Contractual Clauses (SCCs), adequacy decisions, or other lawful transfer mechanisms as recognized under GDPR.

8. Data Retention

• Active accounts: we retain your data for as long as your account is active and you continue to use the Service.
• Account deletion: when you delete your account, all associated data — including session notes, client records, voice transcriptions, AI-generated content, and uploaded files — is permanently deleted from our production systems within 30 days. Encrypted backups may retain deleted data for up to 90 days before being rotated out.
• Client deletion: when a practitioner deletes a client record, all data associated with that client is scheduled for deletion: all sessions, all note versions (original, structured, re-structured), AI-generated status summaries and deep analyses, intake form responses, and booking history. Data is fully removed from our servers within 30 days.
• Free tier inactive accounts: accounts on the free tier that have been inactive for more than 12 months may be scheduled for deletion. We will send a warning email 30 days before deletion.
• Payment records: transaction records may be retained for up to 7 years as required by tax and accounting regulations.
• Activity and consent logs: security audit logs and consent records are retained for up to 6 years to meet regulatory requirements (including HIPAA record retention obligations). These logs contain action metadata (timestamps, IP addresses, action types) but not the content of notes or client records.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: request a copy of all personal data we hold about you.
• Portability: receive your data in a structured, commonly used, machine-readable format (JSON export).
• Rectification: correct inaccurate or incomplete personal data.
• Erasure: request deletion of your account and all associated data ("right to be forgotten").
• Restriction: request that we limit how we process your data in certain circumstances.
• Objection: object to processing based on legitimate interests.
• Withdraw consent: where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. If you are in the EEA and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection supervisory authority.

10. Cookies and Local Storage

HoldSpace uses only essential cookies and browser storage required for the Service to function:

• Session cookie: to maintain your authenticated session (expires when you log out or after a period of inactivity).
• Preferences: to remember your settings such as theme (light/dark) and language preference, stored in browser local storage.

We do not use tracking cookies, advertising cookies, third-party analytics services, or any form of cross-site tracking. Our self-hosted web analytics (Umami) is configured in cookieless mode and stores nothing on your device — see Section 1.7 for details, and the opt-out button at the bottom of this page if you want to turn it off entirely.

11. Children

HoldSpace is designed for professional practitioners and is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a person under 18, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make changes:

• We will update the "Effective date" at the top of this page.
• For material changes that affect how we handle your data, we will notify registered users by email at least 14 days before the changes take effect.
• Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

13. Contact

If you have questions, concerns, or requests related to this Privacy Policy or your personal data, contact us at:

Email: [email protected]

For information about our terms and conditions, see our Terms of Service. If you are a practitioner in the EU/UK, see our Data Processing Agreement.