This is a translation provided for convenience. In case of any discrepancy, the Russian version prevails.
Privacy Policy
Date of publication: April 19, 2026
Version: 1.1 of July 2, 2026
1. General Provisions
1.1. This Privacy Policy (the "Policy") sets out the procedure for the processing and protection of personal data carried out by Konstantin Dmitrievich Shvedov (INN: 771543554663), an individual applying the special tax regime "Tax on Professional Income" (Federal Law No. 422-FZ of 27.11.2018), hereinafter the "Operator", when the SessionFlow platform (the "Platform") is used.
1.2. The Policy has been prepared in accordance with:
- Federal Law No. 152-FZ of 27.07.2006 "On Personal Data";
- other applicable regulatory acts of the Russian Federation.
1.3. By registering on the Platform, the User confirms that they have read this Policy and consents to the processing of personal data on the terms set out herein.
1.4. The terms used in this Policy have the meanings given in the User Agreement, unless otherwise stated in the Policy.
2. Personal Data Operator
Operator: Konstantin Dmitrievich Shvedov
Tax regime: NPD (self-employed), 422-FZ
INN: 771543554663
E-mail (for personal data matters): support@sessionflow.one
Website: https://web.shvedovpro.com
3. Categories of Data Subjects and Data Collected
3.1. Platform Users (therapists, coaches, consultants)
| Data category | Specific data | Mandatory |
|---|---|---|
| Identification | Last name, first name, patronymic | Mandatory |
| Contact | E-mail address | Mandatory |
| Professional | Specialization, qualifications (if the profile is filled in) | Optional |
| Payment | Bank card data (processed by the payment provider YooKassa; the Operator does not store full card details) | For paid plans |
| Technical | IP address, browser type, operating system, cookie data | Automatic |
| Usage data | Login frequency, features used, number of sessions | Automatic |
3.2. Users' Clients (persons undergoing therapy/counseling)
| Data category | Specific data | Basis for collection |
|---|---|---|
| Identification | Name (or a pseudonym assigned by the User) | Consent of the data subject |
| Contact | E-mail address (for sending the session link and consent) | Consent of the data subject |
| Audio/video recording | Recording of a therapy/counseling session | Explicit consent of the data subject |
| Transcript | Text transcription of the audio recording | Explicit consent of the data subject |
| AI reports | Structured analysis of the content of the session | Explicit consent of the data subject |
| Session metrics | Duration, date, frequency of sessions | Consent of the data subject |
Important: Audio/video recordings, transcripts and AI reports may contain information relating to special categories of personal data (data on health and psychological condition). Such data is processed solely on the basis of the explicit consent of the data subject.
4. Purposes of Personal Data Processing
4.1. Users' data is processed for the following purposes:
a) providing access to the Platform and its functions;
b) identifying the User on login to the account;
c) processing payments and keeping accounting records;
d) technical support;
e) notifications about the operation of the Platform (technical notices, changes to terms);
f) improving the quality of the Platform (in anonymized form);
g) compliance with the requirements of the legislation of the Russian Federation.
4.2. Data of Users' Clients is processed for the following purposes:
a) conducting the video session;
b) recording the audio/video of the session;
c) AI transcription of the recording;
d) AI analysis and generation of reports;
e) storing transcripts and reports for the User's access.
4.3. The Operator does not use the content of sessions (audio recordings, transcripts, reports) for training artificial intelligence models, for marketing purposes, or for any other purposes not specified in clauses 4.2 and 4.4.
4.4. The Operator may anonymize session transcripts, that is, irreversibly delete and transform information that allows the User and their clients to be identified (names, places, contacts, unique circumstances, exact dates and session parameters). The resulting anonymized materials are not personal data (clause 9 of Article 3 of 152-FZ), cannot be linked to a specific User or client, and may be used by the Operator for scientific, statistical and methodological research, and to improve the quality of the Platform.
5. Legal Grounds for Processing
| Purpose | Ground (152-FZ) |
|---|---|
| Providing services to the User | Contract (clause 5, part 1, Article 6) |
| Payment processing | Contract (clause 5, part 1, Article 6) |
| Processing of health data (Clients) | Consent of the data subject (part 1, Article 10) |
| Recording and AI processing of sessions | Consent of the data subject (clause 1, part 1, Article 6) |
| Notifications about the operation of the Platform | Legitimate interest (clause 7, part 1, Article 6) |
| Improvement of the Platform (anonymized data) | Legitimate interest (clause 7, part 1, Article 6) |
| Anonymization of transcripts and research on anonymized data | Legitimate interest (clause 7, part 1, Article 6); anonymized data is not personal data (clause 9, Article 3) |
| Tax accounting under the NPD regime | Law (clause 2, part 1, Article 6) |
6. Transfer of Data to Third Parties
6.1. The Operator transfers personal data to the following third parties (processors) solely for the purpose of providing services:
| Recipient | Data | Purpose | Jurisdiction |
|---|---|---|---|
| YooKassa (YooMoney LLC) | Users' payment data | Payment processing | Russian Federation |
| Hosting provider (VPS) | Application data, audio/video stream of sessions | Application and video communication servers | Russian Federation |
6.2. The content of sessions is not used for training artificial intelligence models, for marketing purposes, or for other purposes unrelated to providing services to the User. Anonymized materials that do not allow the User or their clients to be identified may be used for research purposes in accordance with clause 4.4 of this Policy.
6.3. The Operator concludes agreements with processors that ensure an adequate level of personal data protection.
6.4. The Operator may disclose personal data upon a lawful request of state authorities of the Russian Federation in the manner provided by legislation.
6.5. The Operator does not sell personal data and does not transfer it to third parties for marketing purposes.
7. Storage and Processing of Data
7.1. Personal data is stored and processed on servers located in the territory of the Russian Federation.
7.2. Cross-border transfer of personal data is not carried out, except in cases provided for by the legislation of the Russian Federation.
8. Data Retention Periods
| Data | Retention period | Note |
|---|---|---|
| Audio/video recording of a session | Deleted automatically after processing is completed | Not stored on the Operator's servers on a permanent basis |
| Session transcript | Until deleted by the User or until the account is deleted | Available to the User in the account |
| AI report | Until deleted by the User or until the account is deleted | Available to the User in the account |
| User account data | Until the account is deleted + 30 days | Deletion period |
| Data of Users' Clients | Until deleted by the User, until the account is deleted, or until the Client withdraws consent | — |
| Receipts and information on NPD transactions | 4 years from the date of the transaction | Requirement of 422-FZ |
| Cookie data | Up to 1 year or until deleted by the user | — |
9. Rights of Personal Data Subjects
9.1. The personal data subject has the right to:
a) Right of access — to obtain information on what data about them is processed, and on the purposes and methods of processing;
b) Right to rectification — to demand correction of inaccurate or incomplete data;
c) Right to erasure — to demand deletion of personal data in cases provided for by legislation (including upon withdrawal of consent);
d) Right to restriction of processing — to demand restriction of data processing in certain cases;
e) Right to withdraw consent — to withdraw consent to the processing of personal data at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal;
f) Right to object — to object to the processing of data on the basis of legitimate interest.
9.2. For Users: requests are sent to support@sessionflow.one or through the account settings. The review period is 30 calendar days.
9.3. For Users' Clients: a request may be sent:
- through the User (therapist), who will forward it to the Operator;
- directly to support@sessionflow.one.
The review period is 30 calendar days.
9.4. The data subject has the right to file a complaint with Roskomnadzor (https://rkn.gov.ru).
10. Data Security
10.1. The Operator applies the following organizational and technical protection measures:
- Encryption in transit: all data is transmitted over the secure TLS 1.2+ protocol;
- Encryption at rest: data in databases is stored in encrypted form (AES-256);
- Authentication: multi-factor authentication for administrative access;
- Access control: each User has access only to the data of their own clients; access between Users is excluded;
- Logging: a data access log is maintained;
- Backup: regular creation of encrypted backups;
- Audio deletion: audio recordings are deleted automatically after processing and are not stored permanently.
10.2. In the event of a security incident (data breach), the Operator notifies:
- Roskomnadzor — within 24 hours;
- the affected data subjects — within 72 hours;
- in the manner provided by the legislation of the Russian Federation.
11. Cookies
11.1. The Platform uses the following cookies:
| Type | Purpose | Duration |
|---|---|---|
| Strictly necessary | Authentication, session | Until the browser is closed or 30 days |
| Functional | Language preferences, interface settings | Up to 1 year |
| Analytical | Anonymized usage analytics (not shared with third parties) | Up to 1 year |
11.2. The Platform does not use advertising cookies and does not transfer cookie data to advertising networks.
11.3. The User can manage cookies through the browser settings. Disabling strictly necessary cookies may affect the operation of the Platform.
12. Roles in Data Processing
12.1. With respect to Users' data, the Operator is the data controller (operator).
12.2. With respect to the data of Users' Clients:
- The User (therapist) is the controller of their clients' data (they determine the purposes and decide on recording the session);
- The Operator (SessionFlow) is the data processor (acting on the instructions of the User).
12.3. The Operator processes the data of Users' Clients solely on the instructions of the User and for the purposes defined by this Policy.
13. Changes to the Policy
13.1. The Operator may amend this Policy. The current version is published on the Platform.
13.2. The Operator notifies Users of material changes by e-mail or by a notification on the Platform at least 14 (fourteen) calendar days in advance.
13.3. Continued use of the Platform after the changes take effect constitutes consent to the new version of the Policy.
14. Contact Information
For questions regarding the processing of personal data, please contact:
E-mail: support@sessionflow.one
Operator: Konstantin Dmitrievich Shvedov, INN 771543554663
Date of publication: April 19, 2026