Privacy
Privacy statement
This notice explains how Canvasara handles information about visitors, account holders, invited guests and people receiving therapy. It distinguishes our own responsibilities from those of your therapist or practice.
Who is responsible for which data?
Nick Kouwenhoven, operating as Canvasara at the address above, is the controller for account administration, website enquiries, beta-access requests, service security and our own legal administration. A controller decides why and how personal data is used.
For clinical information, appointments and practice activities, your independent therapist or practice normally acts as controller. Canvasara acts as its processor under a data processing agreement (DPA), using the information on documented instructions. Your provider must explain its purposes, lawful basis, condition for processing health data and any medical-record retention duties. Accepting our DPA is not consent to treatment or a substitute for that explanation.
What information comes from whom?
You provide account details such as name, email, country, role, language, password and optional profile photo; preferences; enquiries; and beta-access requests. We collect technical information such as IP address, browser/device details, session identifiers, timestamps, authentication and security events, and delivery status.
A therapist, practice or colleague may provide your contact details, invitation, appointment, practice association or shared material. Session participants may contribute drawings, images or transcripts containing health or other sensitive information. We also receive technical delivery and security information from service providers. You can ask us about the source of information you did not provide yourself.
Our purposes and legal bases
To create your account and provide services you request, we rely on performance of a contract or steps you request before a contract (GDPR Article 6(1)(b)). Where a practice supplies access and you are not personally a contracting party, our basis for administering that access is our legitimate interest in delivering and managing the practice service (Article 6(1)(f)).
For preventing abuse, protecting people and systems, troubleshooting and maintaining reliability, our basis is legitimate interests (Article 6(1)(f)). This also covers responding to enquiries and maintaining the beta-access list you asked to join. We limit the information to what is necessary and consider its impact on you.
We use information to meet applicable legal duties, including handling privacy rights, under Article 6(1)(c), and to establish or defend legal claims under Article 6(1)(f). If we request consent for an optional purpose, Article 6(1)(a) applies; you can withdraw it without affecting earlier lawful use. Clinical processing follows your provider’s instructions and legal bases, including an applicable Article 9 condition for health information.
Calls, transcription and saved material
Canvasara does not record live calls. Audio for transcription is processed in the browser on the therapist’s device and is not sent to Canvasara or a cloud AI transcription service for that purpose. The browser downloads transcription models only from Canvasara’s static mirror, delivered through its hosting and proxy providers; it does not fall back to Hugging Face. Hugging Face is the upstream source for controlled server-side model synchronization and may receive server/operator download metadata, not conversation audio or transcripts. Earlier direct browser downloads may have disclosed connection metadata to Hugging Face; this change does not establish its historical retention or transfer safeguards. Session drawings and transcripts are not automatically saved as a server-side clinical record. A therapist can download them to their own device or choose secure email sharing, which stores an encrypted share copy for the periods explained below. Appointments, invitations and session metadata have separate retention rules.
Live collaboration uses participant connections and technical synchronization state; browser-only work is not a permanent server clinical record. Direct connections can disclose IP addresses to peers. Canvasara’s self-hosted STUN/TURN and LiveKit media services run at netcup in Nuremberg, Germany; relayed media and connection metadata pass through that infrastructure. Material saved on another person’s device is outside Canvasara’s deletion control.
If you separately choose to save or import a reusable board template in your personal or practice library, Canvasara stores that template and its thumbnail on the server. A template can include the contents of the drawing you choose to save. Library templates remain until permanent deletion or the applicable account/practice erasure; ordinary deletion allows restoration. The 30-day expiry for emailed board copies does not apply to this separate template library.
Who can receive information?
Depending on the feature and permissions, information is available to your selected recipients, authorized session participants or authorized practice colleagues. Practice membership does not automatically grant access to every session or calendar. Authorized Canvasara administrators may access information where necessary for support, security or legal duties, subject to confidentiality and access controls. Authorities or professional advisers may receive information where legally required or necessary for a claim.
New shared exports are encrypted in the browser and protected by recipient checks. The email delivery provider processes the full access link and decryption key during delivery; this is not provider-blind end-to-end encryption. Older exports use server-managed encryption. Recipient mailbox and downloaded copies cannot be recalled. We do not sell personal data or use client content for advertising or AI-model training.
Service providers and locations
netcup GmbH hosts the application and self-hosted media services in Nuremberg, Germany. Hetzner Online GmbH stores encrypted backups in Helsinki, Finland. SMTP2GO (Sand Dune Mail Ltd) provides the email service; email is sent, stored and processed in its EU infrastructure.
Cloudflare, Inc. proxies and protects web traffic and provides Turnstile abuse prevention on the contact form. This can involve connection metadata, browser/security signals and web request/response content. Its global network includes the USA; we do not promise EEA-only processing. Providers process information for their contracted activities; professional processing is also governed by the DPA’s subprocessor terms.
Transfers outside the EEA
SMTP2GO sends, stores and processes email in its EU infrastructure. Other providers, including Cloudflare, may process personal data outside the European Economic Area. Where required, these transfers use appropriate safeguards, such as the Commission’s Standard Contractual Clauses and supplementary measures; Cloudflare’s DPA includes transfer clauses. Regional DPA supplements do not themselves authorize every onward transfer.
Contact us for information about the safeguards applicable to your data or a copy of relevant safeguards, with unrelated confidential information protected. Provider locations and contractual arrangements must continue to match the processing actually performed.
How long is information kept?
Account, enquiry and beta-request information is kept while needed to provide the requested service, handle the request or maintain the requested waiting list. Contact us to remove a request or ask about a particular record. Drawing boards and transcripts shared by secure email follow the periods below. Practice information follows practice instructions; a practice may have separate legal duties to retain clinical records.
Board-share links expire after 30 days; transcript links after the selected 7, 30 or 90 days. Scheduled daily cleanup removes expired or revoked share files and records. Legacy temporary whiteboard downloads expire after 30 minutes. Personal/practice data-download archives expire after seven days. Expiry blocks access but does not mean immediate erasure from backups or recipient copies.
Security audit logs use a configured retention of 1–36 months (36 by default). Completed privacy-request receipts are kept for up to 36 months; unused deletion-code requests are cleaned up after a day and codes expire after 10 minutes. A minimal erasure journal records internal identifiers and timestamps, without email addresses or clinical content, to reapply deletions after database restoration. Its retention is tied to possible restoration and evidence of deletion.
Backups retain 7 daily, 4 weekly and 12 monthly generations. Generation counts alone are not a fixed maximum age. For professional service termination, the DPA provides a requested export within 30 days, active-data deletion within 30 days after return or a deletion instruction, and remaining-backup erasure no later than 13 months after active deletion. Copies remain protected and prior deletions must be reapplied on restoration. Any mandatory legal retention must have a stated basis and period.
How is information protected?
Safeguards include TLS for web traffic, encrypted WebRTC transport, account/practice/session/recipient authorization, password hashing, login limits, optional two-factor authentication, revocation and protected backups. Data-download archives use server-managed encryption with keys outside the application. Browser-encrypted shared files remain encrypted in an archive; retain the original link/key to open them. No system can guarantee absolute security.
Your rights and choices
Subject to the legal conditions, you can request access and a copy, correction, erasure, restriction and portability. You can object to processing based on legitimate interests for reasons relating to your situation. Where consent is the basis, you can withdraw it at any time without affecting earlier lawful processing. Rights may be limited by legal duties or other people’s rights; we explain any refusal.
Use Profile → Security → Your data for a personal download or email-verified account deletion. Practice owners can request a separate practice download and use the existing practice deletion flow. Deleting a login does not itself erase practice-controlled records, signed practice agreements or copies on other devices. Sole owners must transfer ownership or close their practice first; practice-managed accounts must first be released by their owner.
Requests, contact and complaints
Use the contact form or the email address above; you do not need an account. For clinical records, contact your therapist or practice first. If a request concerns data we process for them, we forward it and assist them under their instructions. We may request proportionate identity verification; do not send an identity document or clinical material unless we explain why and arrange a suitable method.
For requests for which Canvasara is controller, we respond without undue delay and within one month. If complexity or the number of requests requires an extension, we inform you within that month and explain why up to two further months are needed. Requests are normally free. You can complain to the Dutch Autoriteit Persoonsgegevens or another competent supervisory authority, including where you live or work, without first contacting us.
Required information and browser storage
Account and security details needed for registration, login and the selected professional role are necessary to provide that account. Without them, we cannot supply the relevant account or feature. Profile photos and optional features are choices. Guest participation without an account is available only where enabled by the provider.
We use cookies and browser storage for login/security, language/timezone choices, local tools and downloaded model caches. Cloudflare security checks process browser and request signals. Browser controls let you clear or block storage, but login or features may stop working and browser-only work may be lost. A new optional purpose requiring consent will be explained before it is enabled.
Automated decisions and changes
Canvasara does not use personal data for solely automated decisions with legal or similarly significant effects. Automated security limits can temporarily restrict access; contact us if you believe a restriction is incorrect.
We update the date of this notice when it changes and communicate material changes affecting you before the new processing begins. This notice explains processing; reading it is not consent to additional uses and does not replace your provider’s privacy notice or the DPA.