Privacy and your data · Ever Peaceful

Who we are

Ever Peaceful is an online mental-health platform for people in Kenya. We connect you with licensed therapists for video sessions, and we offer tools like check-ins, a journal and a personal garden. Questions about this notice: contact us.

What we collect

Account details: name, email, password (stored as a hash), and optionally a phone number if you verify it for reminders or phone-fallback sessions.
Care information you choose to share: check-in answers, mood logs, journal entries, messages with your therapist, and session notes written by your therapist.
Bookings and payments: session times, therapist, amounts, and M-Pesa receipt references. We do not store your M-Pesa PIN.
Therapist applications: licence number, ID and credential documents, bio and specialties, used only for verification and your public profile.
Technical data: signed-in devices, security events, and basic server logs needed to keep the service running.

Why we use it

To create and secure your account, including two-step verification where required.
To match you with therapists, book sessions, take payment and send reminders.
To support your care: assessments, messaging, resources and crisis follow-up.
To verify therapists before they appear in the directory.
To meet legal duties, including tax records for payments and safety records for crisis flags.

We process health-related information only with your consent, which you give at sign-up and can withdraw by deleting your account.

How we protect it

Video sessions are never recorded.
Journal entries, messages, assessment answers and session notes are encrypted at rest with application-level encryption.
Access to clinical records is logged in an audit trail.
Therapists only see check-ins and journal entries you choose to share. Opening a shared record is logged.
Passwords are hashed. We never ask for your M-Pesa PIN on the site.

We do not sell your data. We only share what is needed to run the service:

Your therapist, for bookings, sessions, messages and anything you share with them.
Payment and SMS providers, to complete M-Pesa charges and send booking reminders.
Hosting and storage providers that run our servers and file storage. Those systems may sit outside Kenya; we use them under contracts that require appropriate protection.
Authorities, if Kenyan law requires it.

Your rights

Under Kenya’s Data Protection Act, 2019, you can ask for a copy of your data, correct it, or ask us to delete it. In the app:

Download my data in Settings gives you a copy of what we hold about you.
Delete my account removes your identity and personal content. We keep anonymised booking and payment records for tax, and crisis-flag records unlinked from your deleted answers for safety. Therapist clinical notes stay encrypted under their own retention rules.

For other requests, email us from the address on your account. We aim to respond within 30 days.

Crisis and safety

If a check-in answer suggests you may be at risk of harm, we show Kenyan crisis numbers immediately and may alert our care team and, where you have one, your therapist. That alert is for safety, not marketing.

Ever Peaceful is not an emergency service. If you are in danger right now, use the numbers in Contact or the “Need help now” button on every page.

Age

Ever Peaceful is for people aged 18 and over. We do not knowingly create accounts for children.

Changes

If we change this notice in a material way, we will update the date at the top and, where the law requires, ask for your consent again.