Skip to content

Privacy Policy

This Privacy Policy explains how ActWise Therapy processes your personal data in accordance with the EU General Data Protection Regulation (GDPR).

Last updated: September 24, 2026

1. Who is the data controller?

Sierra Advisory AB (Swedish company registration number 559516-9557), trading as ActWise Therapy.

The data controller is the organisation that determines the purposes and means by which your personal data is processed under the GDPR.

2. What personal data do we collect?

We may collect and process the following categories of personal data when you use our website or services

Visitor data collected regardless of consent

So that the website can run and be operated securely, technical details of your request — such as your IP address and browser type — are processed by our hosting and content delivery providers. Strictly necessary cookies are used for basic functionality, for example to remember your cookie choice and your language preference.

Visitor data that requires your consent

Web analytics — which pages you visit, how long you stay, how you navigate, and recordings of individual visits in Microsoft Clarity — is collected only if you have accepted the analytics category in the cookie banner. If you have accepted analytics, our own statistics also record whether you go on from an article towards a booking — that you followed a link to the booking page, that it opened, and that a booking was submitted — and which article you came from. To connect those steps to the article, the article is kept temporarily in your browser (sessionStorage) for at most one hour. If you decline or have not yet chosen, no analytics tools load and none of this data is collected.

Contact forms / bookings

Name, email address, telephone number, message content and booking details.

Communication

Email correspondence that you send to us.

3. Purpose and legal basis for processing

We process your personal data in accordance with the EU General Data Protection Regulation (GDPR).

Legal bases we use:

  • —Consent (Art. 6.1.a GDPR): When you accept cookies or voluntarily submit information via forms. All web analytics — Google Analytics 4 and Microsoft Clarity — relies solely on this basis and does not start until you have accepted the analytics category.
  • —Contract (Art. 6.1.b GDPR): Processing necessary to provide booked services.
  • —Legitimate interest (Art. 6.1.f GDPR): To ensure the secure operation of the website, for example protection against attacks, abuse and service disruption. This basis does not cover web analytics.

4. Cookies and similar technologies

We use cookies to operate the website, analyse its use and improve functionality. Consent is managed by CookieYes, and you can change or withdraw it at any time using the button below — withdrawing consent is intended to be as easy as giving it. Strictly necessary cookies are required for the website to function and cannot be switched off.

5. Third parties / data processors

We use external service providers to support certain functions of our website. These providers process personal data on our behalf and under our instructions, and appropriate data processing agreements are in place in accordance with the GDPR.

Providers we use:

  • —Web analytics — Google Analytics 4 and Microsoft Clarity. We use them to understand how visitors use this site: which pages are viewed, how long visitors stay, and general navigation patterns. Microsoft Clarity additionally records session replays — playable recordings of individual visits, including mouse movement, clicks and scrolling. Both tools only run after you've given consent through the cookie banner; if you decline or haven't yet chosen, neither loads. Reporting in Google Analytics 4 is aggregated and is not used to identify you personally, and Clarity recordings are not linked to your name or contact details.
  • —Stripe — payment processing at booking. Receives your name, email address and payment details. Card details are provided directly to Stripe and never pass through our own systems.
  • —Supabase — database, authentication and server functions. Stores bookings, contact form messages and newsletter subscriptions. The project database is hosted in the eu-north-1 (Stockholm) region.
  • —Resend — outbound email, such as booking confirmations and the newsletter. Receives your email address and the content of the message.
  • —Google Calendar — booked sessions are added to the therapist's calendar. Receives the time, the service and the details needed to identify the booking.
  • —Vercel — website hosting and delivery. Processes technical details of your request, such as IP address and browser type, in server logs.
  • —CookieYes — cookie consent management. Stores your choice in a cookie so that it can be displayed and withdrawn.
  • —Cloudflare — content delivery and protection against attacks in front of our server functions. Also derives the country your request comes from, which is used for statistics in the booking overview.

Several of these providers are established outside the EU/EEA or may process data there. Where that is the case, transfers rely on the European Commission's Standard Contractual Clauses or on an adequacy decision. Details of each provider's contracting entity and transfer mechanism are available on request.

6. How long is your data stored?

We only store personal data for as long as necessary for the purpose for which it was collected, for example:

  • —Contact forms/bookings: up to 2 years after last contact.
  • —Web analytics: Google Analytics 4 retains event data for 2 months and user-level data for 14 months; Microsoft Clarity retains session recordings for 30 days, while favourited recordings, a randomly selected sample of recordings and heatmap data are retained for up to 9 months. Our own statistics on the path from article to booking are deleted after 14 months.

When data is no longer needed, it is deleted or anonymised.

7. Your rights under the GDPR

As a data subject, you have rights under the GDPR, including:

  • —Right to request access to your personal data (subject access request).
  • —Right to have inaccurate data corrected.
  • —Right to request erasure ("right to be forgotten").
  • —Right to request restriction of processing.
  • —Right to object to processing based on legitimate interest.
  • —Right to data portability.

You can always withdraw consent when processing is based on consent.

8. How to exercise your rights

You can exercise your rights by contacting us via the contact form.

We normally respond within one month of receiving the request, in accordance with the GDPR.

9. Complaints to the supervisory authority

If you believe that our processing of your personal data violates the GDPR, you have the right to file a complaint with the Swedish Authority for Privacy Protection (IMY).

10. Changes to this policy

We may update this privacy policy as needed, for example to comply with changed legal requirements or updated services. The latest version is published on this page.