Mental-health related information is sensitive. Our architecture follows a simple rule: collect the minimum, expose even less.

What we collect

• Account basics (name, email) to run your dashboard and bookings.
• Booking details you explicitly provide (time, professional, optional note).
• Admin-managed public content (programs, resources, credentials).

What we never expose publicly

• Passwords (hashed with scrypt; never logged).
• Private internship assessments, reviewer notes, or internal rankings.
• Other users’ bookings or account data.

How we protect it

• Secure httpOnly session cookies; authorization enforced server-side.
• Public credential pages use a restricted DTO. Private fields never leave the server.
• Sensitive admin actions require confirmation and write audit records.

Questions? Contact us through your dashboard and we’ll respond plainly.