Who is responsible for your data
The controller of personal data processed through nearbytherapy.com is the administrator of the nearbytherapy.com service. For any question about privacy or your data, write to [email protected].
Provider registry data
Listings in our directory are built from the NPPES NPI Registry, a public federal record maintained by the Centers for Medicare and Medicaid Services. For individual behavioral health providers with an active NPI, we process name, credential, taxonomy, practice address, city, state, ZIP code, practice phone, NPI, license number and license state when present, and the last update date of the record. We do not store mailing addresses from the registry, photos or emails of providers who have not claimed their profile.
Therapist account data
When a therapist creates an account or claims a profile, we process the account email, a password stored as a one way hash, the NPI and license data used for verification, the plan and billing period, and everything the therapist adds to the profile, such as a photo, specialties, approaches, insurance accepted, fees, session format and a short statement. Payment card details are entered with our payment processor and do not reach our servers. We keep the billing records that the processor returns to us, such as the plan, amount, date and payment status.
Patient inquiry data
When a patient sends an inquiry to a claimed profile, we process the first name, email address, optional phone number, preferred contact time, in person or online preference, how the person plans to pay, and an optional short message. The form asks senders not to include medical details. Patients do not need an account to search.
Correction and removal requests
When someone requests a correction or removal of a listing, we process the NPI, the request type, the email address and the details provided, and the dates of confirmation and handling.
Technical data
Our servers record technical logs, such as IP address, browser type, the page requested and the time of the request, to run the service securely and to prevent abuse. Our analytics are cookieless and show aggregated usage.
Cookies
We use only cookies that are necessary for the site to work: a session cookie, a security token that protects forms, and cookies that remember your preferences. We do not use advertising cookies or tracking pixels, and we do not show a cookie banner because no consent based cookies are set.
Why we process data and on what basis
- To publish a complete directory of licensed providers from public registry data, based on our legitimate interest in helping people find licensed care, taking into account that the registry is published by the federal government for public use.
- To create and run therapist accounts, verify licenses and provide the subscribed plan, based on the performance of a contract.
- To deliver patient inquiries to the chosen therapist, based on the request of the person who sends the inquiry.
- To handle correction and removal requests and other privacy requests, based on legal obligations and our legitimate interest in accurate listings.
- To keep billing and tax records, based on legal obligations.
- To secure the service, prevent abuse and understand aggregated usage, based on our legitimate interest.
For visitors in the European Union and similar jurisdictions, these bases correspond to Article 6(1)(b), (c) and (f) of the General Data Protection Regulation.
Who receives data
We share data only with service providers that help us run the service, and only with the data each one needs.
- A hosting provider, which stores the site and its data on servers in the United States or the European Union
- An email delivery provider, which sends confirmation codes, inquiries and account emails
- A payment processor, which handles subscription payments from therapists
- A cookieless analytics provider, which receives aggregated technical data
Patient inquiries are delivered to the therapist or practice the patient chose, and on group accounts to the staff the practice owner has given access. We do not sell personal data and we do not share it for targeted advertising. We disclose data to authorities only when the law requires it.
Transfers outside your country
If you visit from outside the United States, your data may be processed in the United States. Where transfers from the European Union take place, they rely on the safeguards the law provides, such as adequacy decisions or standard contractual clauses.
How long we keep data
- Registry data is kept while the NPI record is active and refreshed monthly. Deactivated NPIs are hidden. Listings removed on request stay hidden on every refresh, and we keep only the NPI and the request record needed to keep them hidden.
- Therapist account data is kept while the account is active and deleted within a reasonable period after the account is closed, except billing records we must keep under tax law.
- Undelivered inquiries are deleted after 90 days. Delivered inquiries stay available to the receiving clinician while the account is active.
- Correction and removal requests are kept as long as needed to document how they were handled.
- Technical logs are kept for a limited period and then deleted.
Your privacy rights
You can ask us to give you access to your data, correct it, delete it, or stop processing it where you object to processing based on our legitimate interest. You can also ask for a copy of data you provided in a portable format. Write to [email protected] and we reply within the time the law requires.
Providers listed from the registry can correct their listing or have it removed from our directory on the request a correction or removal page. Requests are handled within 2 business days, and a removal hides the listing after the email is confirmed and the NPI matches. Changes to the registry record itself are made with NPPES.
Rights under US state privacy laws
Residents of several US states, including California, have rights under state privacy laws, such as the right to know what personal information is collected, to delete it, to correct it, and to opt out of its sale or sharing for targeted advertising. We do not sell personal information and do not share it for targeted advertising. You can use any of these rights by writing to [email protected], and we will not treat you differently for doing so.
Rights in the European Union
Visitors in the European Union also have the right to restrict processing and to lodge a complaint with their local data protection authority.
Children
NearbyTherapy is intended for adults. Parents and guardians may search for a therapist for their child, but we do not knowingly collect personal data from children under 13. If you believe a child has sent us personal data, write to [email protected] and we delete it.
Not a crisis service
NearbyTherapy is a directory, not a healthcare provider or a crisis service. Please do not send health information through the site. If you are in crisis, call or text 988 (Suicide and Crisis Lifeline). In an emergency, call 911.
Changes to this policy
We may update this policy when the service or the law changes. The date below shows the latest version. If a change is significant, we tell account holders by email before it takes effect.
Last updated October 19, 2026.
Contact
The administrator of the nearbytherapy.com service, [email protected].