Legal

Privacy Notice

Lucento is being built for the Swiss market and treats therapy-related information as sensitive health data. This notice explains the current landing and early-access processing and the controls required before live therapy services handle sensitive client data.

Last updated: 15 June 2026

Version: early-access-draft-2026-06-15

This is an early-access privacy notice, not the final counsel-approved production notice. The production legal entity, German, French, Italian, and English legal texts, final provider list, consent wording, and retention schedule must be approved before live booking, chat, or video-session data is processed. This early-access legal copy is currently provided in English on every locale route until approved translations are complete.

Controller and contact

The controller will be the Lucento operating entity responsible for the service. Final company registration details must be inserted before production launch. Privacy requests can be sent to [email protected].

What we collect

Landing and waitlist data

Email address, selected language, optional care reason, source/campaign fields, consent choices, and timestamps.

Professional application data

The current therapist application CTA collects an email address, selected language, source, and timestamp so we can start onboarding contact. A future full therapist onboarding workflow may collect professional profile information, credentials, licence or registry information, insurance status, practice preferences, and verification notes after separate review.

Account and therapy-service data

When platform accounts go live, this can include account details, authentication events, intake answers, matching preferences, appointment metadata, chat messages, payment or billing metadata, and support requests.

Technical and security data

IP address, user agent, device/browser information, request metadata, audit events, error reports, and fraud or abuse-prevention signals. Therapy content must not be placed in analytics, support tooling, or routine logs.

Marketing analytics

If optional analytics are enabled, they load only after consent where required. Marketing events must remain neutral and must not include care reasons, chat content, intake answers, diagnoses, or clinical notes.

Why we use personal data

Operate the waitlist, therapist application flow, and launch communications.
Create and secure user accounts, authenticate sessions, and prevent abuse.
Match clients with suitable therapists, manage bookings, process payments, and provide support once the connected platform is live.
Meet legal, accounting, professional, safety, and dispute-resolution obligations.
Maintain audit trails, investigate security events, and receive, triage, and fulfill applicable access, correction, deletion, restriction, objection, portability, and consent-withdrawal requests subject to legal, professional, security, processor, and backup limits.
Improve the service with aggregated or de-identified product analytics that do not contain therapy content.

Legal basis

Depending on the feature and the person using it, processing may be based on pre-contractual or contractual necessity, consent where required, compliance with legal obligations, legitimate interests such as security and service operation, and the explicit handling requirements that apply to sensitive health data. Where EU GDPR applies, special-category health data must have a separate lawful condition before it is processed.

Therapists and providers

When therapy services are live, relevant information is shared with the therapist selected for care, payment or billing providers, video-session providers, email or notification providers, infrastructure providers, security and support vendors, professional advisers, and authorities where required by law. Providers that process personal data for Lucento must be reviewed, documented, and covered by a data-processing agreement before live sensitive data is sent to them.

International transfers

Swiss or EU hosting and processors are preferred for therapy data. Any transfer to a country without an adequate level of protection must have a documented transfer mechanism, subprocessor review, residual-risk assessment, and legal sign-off before production use.

Current early-access controls

The current landing and therapist-application flows collect limited lead data and send it to the Rust API persistence path instead of storing it only in the landing app.
Public landing form and marketing-event routes validate input, apply route rate limits, reject explicit cross-origin browser submissions, and mark JSON responses no-store.
Marketing analytics are optional and must use neutral event fields that exclude care reasons, chat content, intake answers, diagnoses, and clinical notes.
The live sensitive-data flag in the Rust API remains blocked unless approved legal, DPIA, DPA, privileged-auth, audit-log, retention/deletion, backup/restore, and breach-response evidence references are configured.

Controls required before live therapy data

Role-based access control with least-privilege defaults for live client, therapist, support, and admin workflows.
Strong therapist and administrator authentication, including verified email, MFA, short privileged sessions, recovery evidence, and credential review.
Audit logging for sensitive reads and administrative actions, with metadata that excludes therapy content and clinical details.
Processor review and data-processing agreements for providers that touch personal or therapy data.
A completed retention, export, deletion, legal-hold, processor-request, and backup-expiry process.
Encrypted backups, access controls, restore testing, and restore-environment safety checks before storing live therapy content.
No recording, transcription, AI summarisation, analysis, or training on therapy content without separate explicit consent and legal review.

Retention and deletion

Personal data is kept only for as long as needed for the purpose collected, legal or professional obligations, dispute handling, security, and accounting records. Waitlist and marketing data should be deleted or anonymised when it is no longer needed for launch communications. Therapy, booking, payment, and audit data require a formal retention schedule before launch, including legal holds, therapist clinical-record obligations, deletion request handling, and backup expiry.

Your rights

Subject to applicable law and legal, professional, security, processor, and backup limits, you may request information about your personal data, access, correction, deletion, restriction, objection, portability where available, and withdrawal of consent for future processing. You may also contact the Swiss Federal Data Protection and Information Commissioner or another competent supervisory authority.

Children, emergencies, and clinical notes

Lucento is designed for adults and is not an emergency service. If there is immediate danger, call 144, 117, 112, or go to the nearest emergency service. Detailed therapist clinical notes are not part of the MVP platform record unless a separate legal review, consent model, retention rule, and access-control design approves that module.

Changes

We may update this notice as the platform moves from early access to live therapy services. Material changes that affect sensitive therapy data require product, security, and legal review before release.