Privacy Policy

1. Introduction

MySafeTherapy Ltd ("MySafeTherapy", "we", "our", "us") is committed to protecting your privacy and handling your personal data with care, transparency, and respect.

This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use the MySafeTherapy platform, including our website, web application, and related services (together, the "Platform").

We process personal data in accordance with:

• The UK General Data Protection Regulation (UK GDPR)
• The Data Protection Act 2018
• The EU GDPR (where applicable)
• Applicable international data protection laws

Because we provide mental health–related services, we apply heightened safeguards appropriate to sensitive health data.

2. Who We Are (Data Controller)

MySafeTherapy Ltd is the Data Controller responsible for your personal data.

Contact details:

• Email: privacy@mysafetherapy.com
• Support: support@mysafetherapy.com

If required, we may appoint a Data Protection Officer (DPO) and will publish their details here.

3. Who This Policy Applies To

This policy applies to:

• Platform users and clients
• Prospective users
• Therapists and practitioners
• Visitors to our website and app

Our services are intended for individuals aged 18 and over.

4. Personal Data We Collect

We collect only the data necessary to provide our services safely and effectively.

4.1 Information You Provide Directly

• Account details: name, email address, date of birth
• Health information: intake responses, therapy goals, mood logs, journal entries, self-reported wellbeing data
• Therapy communications: messages exchanged with therapists within the platform
• Payment information: billing details (payments are processed securely by third-party providers such as Stripe; we do not store full card details)
• Support communications: emails or messages sent to our support team

4.2 Information Collected Automatically

• Technical data: IP address, browser type, device type, operating system
• Usage data: pages accessed, features used, timestamps, session duration
• Cookies and similar technologies: as described in our Cookie Policy

5. Special Category (Health) Data

MySafeTherapy processes special category personal data, including mental health–related information.

We process this data only where permitted under Article 9 UK GDPR, including where:

• Processing is necessary for the provision of health or wellbeing services
• You have provided explicit consent
• Processing is required to protect vital interests in serious safeguarding situations

You may withdraw consent at any time, subject to legal and safeguarding obligations.

6. How We Use Your Data

We use your data for the following purposes:

• Service delivery: providing access to therapy, wellbeing tools, and platform features
• Therapy support: enabling communication between you and your therapist
• Platform functionality: mood tracking, journaling, worksheets, optional AI-supported features
• Payments & billing: managing subscriptions and session payments
• Safety & safeguarding: responding to risk disclosures and meeting legal duties
• Customer support: responding to enquiries or complaints
• Service improvement: analysing anonymised or aggregated data
• Legal & regulatory compliance: meeting statutory and professional obligations

7. Lawful Basis for Processing

7.1 Article 6 UK GDPR (General Data)

We process personal data on the following lawful bases:

• Contract: to provide the services you request
• Consent: for optional features and communications
• Legitimate interests: platform security, fraud prevention, service improvement
• Legal obligation: safeguarding and regulatory compliance
• Vital interests: where there is a serious risk to life

7.2 Article 9 UK GDPR (Health Data)

Special category data is processed under:

• Health or social care provision
• Explicit consent
• Vital interests (where applicable)

8. AI-Supported Features

MySafeTherapy offers optional AI-supported wellbeing tools (e.g. insights, prompts, chat support).

• AI tools are supportive only and do not provide diagnosis, treatment, or medical advice
• AI outputs are not used to make automated decisions with legal or significant effects
• You can opt out of AI features at any time
• Identifiable therapy content is not used to train general-purpose AI models

Further details are available in our AI Policy.

9. Data Sharing

We share personal data only where necessary and proportionate.

9.1 Who We Share With

• Therapists: information required to provide therapy
• Service providers: secure hosting, payment processors, analytics (under Data Processing Agreements)
• Safeguarding or legal authorities: where required by law or where there is serious risk of harm

We do not sell your personal data.

10. International Data Transfers

Where personal data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place, including:

• UK International Data Transfer Agreements (IDTAs)
• Standard Contractual Clauses (SCCs)
• Adequacy decisions where applicable

11. Data Retention

We retain personal data only for as long as necessary:

• Account data: until account deletion, plus retention required by law
• Health records: retained in line with professional and legal requirements
• Payment records: retained for tax and accounting purposes
• AI outputs: retained as part of your account unless deleted

Retention may be extended where required for safeguarding or legal claims.

12. Your Rights

Under UK GDPR, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request erasure (subject to legal limits)
• Restrict processing
• Object to certain processing
• Data portability
• Withdraw consent at any time

Requests can be made by emailing privacy@mysafetherapy.com.

We aim to respond within one month.

13. Data Security

We apply appropriate technical and organisational measures, including:

• Encryption in transit and at rest
• Role-based access controls
• Secure authentication
• Incident response procedures
• Regular security reviews

No system is completely secure, but we work continuously to protect your data.

14. Safeguarding & Confidentiality

Therapy content is treated as confidential. However, confidentiality may be limited where:

• There is an immediate risk of serious harm
• Safeguarding concerns arise
• Disclosure is required by law or professional duty

15. Children's Data

MySafeTherapy is intended for users aged 18 and over. We do not knowingly collect personal data from children.

16. Complaints

If you have concerns about how we handle your data:

• Contact us at privacy@mysafetherapy.com
• If unresolved, you may lodge a complaint with the UK Information Commissioner's Office (ICO) at www.ico.org.uk

17. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the platform or email.

18. Contact Us

For privacy or data protection enquiries:
📧 privacy@mysafetherapy.com