Therapy only works when you feel safe to speak openly, so privacy sits at the heart of It's Complicated. Your sessions are confidential, and we have built strong security into every part of the platform to protect what you share. This article explains how your conversations and your data are kept private.
Your sessions are confidential
What you discuss with your practitioner stays between you and them. The one exception is where there is a serious risk of harm to you or someone else. In that situation, your practitioner may need to involve the relevant people or services to keep you safe, in line with their professional and legal duty of care. This is standard practice in therapy everywhere, not something specific to It's Complicated.
Your video sessions are private and encrypted
Our video calls are powered by Stream, a provider that is both HIPAA and GDPR compliant, meaning it meets strict standards for handling sensitive health and personal data. Every call uses the WebRTC protocol, which encrypts all data in transit and negotiates fresh encryption keys for each session. Nothing travels over an unprotected connection, so your sessions stay private even if you join from public wifi. Your sessions are never recorded or stored without your knowledge. Once a call ends, no video is kept on any server.
You also control who is in the room. You join through a confirmed appointment link or your practitioner's waiting room, and your practitioner admits you when it is time, so no one else can drop into your session. For help getting into a call, see Joining an online appointment.
Your messages and data are encrypted
Everything you do on the platform, from messaging your practitioner to updating a journal, sharing a document, booking a session or making a payment, travels over a secure, SSL-encrypted connection. No content is ever sent over an unprotected connection.
All of your stored data, including messages, notes, appointments, documents and account information, is encrypted and held in GDPR-compliant data centres in Europe, with multiple layers of protection between your information and the outside world. You can read the specifics in our Privacy Policy.
Protecting your own account
Alongside the protections we provide, there are a few tools you can use to keep your own account safe. Under Settings then Security you will find alerts when a new device signs in, an extra verification step at login, automatic sign-out after inactivity, passkeys for faster and safer sign-in, and the option to link your Google account. Depending on your account, some of these may already be switched on for you.