How does OneSomatic protect your data?
Our privacy policy follows the GDPR, and you can ask us to delete your data at any time. Practitioners sign in with a single-use email link, and Stripe handles every card payment.
What GDPR compliant means here
Our privacy policy follows the GDPR, the EU’s data protection law. We name a representative in the EU under Article 27. Transfers out of the EU rest on the EU-US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.
You can ask us to delete your data. We answer within one month, and we delete account data within 30 days after you close your account, unless the law requires us to keep it.
How you sign in
Practitioners sign in with a link we send by email, so there is no password to guess or reuse. Each link works once and expires after 30 minutes. We also limit how often anyone can ask for a new link.
When a client confirms an email address with a code, the code stops working after five tries.
Session video
Video rooms are set up with recording turned off. A client waits in a lobby until you let them in, so a forwarded link does not open the room on its own.
Card payments
Clients enter their card in Stripe’s checkout, and Stripe processes the payment. Stripe is certified to PCI-DSS Level 1. OneSomatic does not store card numbers.
Certificates and other documents
Certificates you upload for verification are never public. They have no public link, and only OneSomatic’s reviewers can open them. Your page names the training, not the document.
Who processes data for us
We work with service providers under data processing agreements where required, and share only what each one needs. Examples are Vercel for hosting, Supabase for the database, Stripe for payments and Resend for email.
The privacy policy names these providers and what each one does.
What we do not claim
OneSomatic makes no HIPAA compliance claim today. It does not sign business associate agreements (BAAs) yet. OneSomatic does not bill insurance and does not handle insurance claims.
Report a security issue
Write to hello@onesomatic.com. Please name the page and the steps that show the issue.
Questions people ask.
Is OneSomatic HIPAA compliant?
OneSomatic makes no HIPAA compliance claim today. It does not sign business associate agreements (BAAs) yet.
Are video sessions recorded?
No. Video rooms are set up with recording turned off.
Can I have my data deleted?
Yes. Write to hello@onesomatic.com. We answer within one month and delete account data within 30 days after you close your account, unless the law requires us to keep it.
How long does a sign-in link work?
Thirty minutes, and only once. If it has expired, ask for a new link on the login page.
Does OneSomatic see my clients’ card numbers?
No. Clients enter their card in Stripe’s checkout. OneSomatic does not store card numbers.
Read the full privacy policy.
It names our providers and explains your rights.