Privacy & Security

How we protect you

What you share in this portal is personal. Here, in plain language, is exactly how we keep it safe.

Encryption

Every connection to the portal uses HTTPS with modern TLS encryption, and browsers are told to never connect without it.
Your data is stored encrypted at rest by our hosting provider.

Passwords must be at least 12 characters, and passwords known from public data breaches are rejected.
After repeated failed attempts, sign-in for that email is paused for a while, and the delay grows with each further failure.
Two-factor authentication with an authenticator app is required for the HBT team and our partner therapists, and available to every member under Profile → Security.
You're signed out automatically after a period of inactivity (15 minutes for staff, 30 minutes for members), with a warning first. Every sign-in also expires after 12 hours.
Changing your password signs you out of every other device. You can also choose "Sign out of all devices" at any time.

Access is based on your role. Members see only their own account. Partner therapists see only their own sessions, with just the client's name, session time and type, and contact email.
Partners can't see your purchases, MasterClass progress or Mend Chat.
The portal stores only scheduling details for sessions — who, when, which therapist, and the status. We never store clinical notes or reasons for a session.
Important actions — sign-ins, staff viewing a client record, session changes, credit changes, exports and settings changes — are written to an audit log that can't be edited or deleted.

Your conversations are private to you. The HBT team and partners can't read them; admins see only total usage counts.
Please don't share medical or identifying details about yourself or others. Before a message is sent to the AI service, obvious identifiers like email addresses, phone numbers and SSN-like numbers are replaced with placeholders.
Conversations are deleted automatically after the retention period HBT sets (90 days by default). You can delete all of your history yourself at any time under Profile → Privacy.
Mend Chat is an AI guide, not a therapist. In a crisis, call or text 988.

Download your data — your profile, access, sessions, credits and progress — as JSON or CSV from Profile → Privacy.
Request account deletion from Profile → Privacy. The HBT team confirms the request, then we delete your profile, photo and Mend Chat history. Session records needed for therapist pay are kept without your name.
Payments happen on HBT's checkout, not in this portal.

Questions about your privacy? Use "Get Help" in the portal or book a call with the HBT team.