Privacy Policy

At Bliss, we take your privacy seriously and are committed to protecting your personal data in accordance with the EU General Data Protection Regulation (GDPR) 2016/679 and the Finnish Data Protection Act (Tietosuojalaki 1050/2018). This policy explains how we collect, use, store, and protect your personal information and sets out your rights as a data subject.

We collect the following categories of standard personal data:

• First and last name;
• Email address;
• Phone number;
• Demographic information.

Bliss does not collect, process, or store health records or any other special category data as defined under GDPR Article 9.

We process your personal data on the following legal bases:

• Account registration and service delivery — Art. 6(1)(b): processing is necessary for the performance of a contract with you;
• Communications and support — Art. 6(1)(b) (contract performance) and Art. 6(1)(f) (legitimate interest in responding to user queries);
• Legal compliance and fraud prevention — Art. 6(1)(c): processing is necessary for compliance with a legal obligation;
• Analytics and service improvement — Art. 6(1)(f): legitimate interest in understanding and improving our platform;
• Marketing — Art. 6(1)(a): based on your prior consent, which may be withdrawn at any time without affecting the lawfulness of prior processing.

Personal information may be collected through:

• Platform registration;
• Completing online forms;
• Communications via email, phone, or other communication platforms;
• Services provided during online therapy sessions.

Your personal data will be used for the following purposes:

• To provide and improve our services;
• To communicate with you;
• To conduct statistical analysis and research;
• To ensure platform protection and security;
• To fulfil legal and regulatory obligations;
• To verify identity;
• To monitor and improve the services we offer.

We retain your personal data for the following specific periods:

• Account and profile data: 2 years after account closure;
• Financial and billing records: 6 years (Finnish Accounting Act 1336/1997);
• Marketing consent logs: retained until withdrawal of consent, plus 3 years;
• Technical and access logs: 12 months;
• Support and complaint records: 3 years (Finnish limitation period).

After the applicable retention period, your data is securely deleted or anonymised.

We will not share your personal information with third parties, except in the following cases:

• With your express consent;
• When required by applicable law.

We use various measures to protect your personal information, including:

• Data encryption;
• Restricted access to your personal information;
• Continuous monitoring of our systems to prevent and detect any unauthorised access.

Bliss uses cookies in compliance with GDPR and the Finnish Electronic Communications Services Act (917/2014). Essential cookies, which are necessary for the platform to function, do not require your consent. Non-essential cookies (such as analytics or marketing cookies) require your prior consent, which you may withdraw at any time via your browser settings.

Your personal data is stored and processed within the European Economic Area (EEA). If any of our processors are located outside the EEA, any such transfer of personal data is covered by EU Standard Contractual Clauses (Commission Implementing Decision 2021/914) or another appropriate safeguard under GDPR Chapter V.

Under GDPR, you have the following rights regarding your personal data:

• The right of access (Art. 15) — to obtain a copy of your personal data we hold;
• The right to rectification (Art. 16) — to correct inaccurate or incomplete data;
• The right to erasure (Art. 17) — to request deletion of your data where no overriding legal basis applies;
• The right to restriction of processing (Art. 18) — to limit how we use your data in certain circumstances;
• The right to data portability (Art. 20) — to receive your data in a structured, commonly used, machine-readable format;
• The right to object (Art. 21) — to object to processing based on legitimate interest or carried out for direct marketing;
• The right to withdraw consent (Art. 7(3)) — to withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal;
• Rights related to automated decision-making (Art. 22) — to not be subject to decisions based solely on automated processing that produce significant legal or similarly significant effects.

To exercise any of these rights, please contact us at info@bliss.al.

You have the right to lodge a complaint with the competent supervisory authority at any time. The supervisory authority for Finland is:

• Finnish Data Protection Ombudsman (Tietosuojavaltuutettu);
• Website: tietosuoja.fi;
• Email: tietosuoja@om.fi;
• Phone: +358 29 566 6700;
• Address: PO Box 800, FI-00531 Helsinki, Finland.

We may update this privacy policy from time to time to reflect changes in our practices or applicable law. We will notify you of any significant changes through our platform or by email.

If you have questions or concerns about this privacy policy or how we handle your personal data, please contact us at: Bliss, Laukkaniementie 1, 00200 Helsinki, Finland. Email: info@bliss.al.

This Privacy Policy is reviewed periodically and updated to reflect changes in our practices or applicable law. Where changes are material, we will notify you by email or through the platform before they take effect.