Faresay
Therapy, matched.

UK Launch — Pre-meeting Pack

Prepared for solicitor review · 24 June 2026 · Confidential

These materials are founder-prepared preparatory drafts, not legal advice. The policy documents are marked DRAFT — for professional sign-off and are intended as a starting point for your review and redlining. US/expansion matters are deliberately excluded.
  1. 1. UK Business OverviewOne-page context — what Faresay is and how it works.
  2. 2. UK Legal & Regulatory BriefOur positions and the open questions, area by area.
  3. 3. Questions for SolicitorThe agenda / checklist for the meeting.
  4. 4. UK Privacy PolicyDRAFT for sign-off.
  5. 5. UK Terms of ServiceDRAFT for sign-off.
  6. 6. UK Therapist AgreementDRAFT for sign-off.
  7. 7. UK Clinical Governance PolicyDRAFT for sign-off.
  8. 8. UK Crisis & Safeguarding PolicyDRAFT for sign-off.
  9. 9. UK Security & Data Protection PolicyDRAFT for sign-off.
Faresay
Therapy, matched.

UK Business Overview

Confidential Faresay Ltd·24 June 2026

One-page context for advisers. Preparatory material — not legal advice. UK launch scope only; US plans are deliberately excluded from this document.

What Faresay is

Faresay is a two-sided online marketplace that connects people seeking therapy with vetted, independent, UK-registered mental-health professionals. The platform provides discovery, matching, scheduling, secure video sessions, and payment handling. Therapists deliver the clinical work; Faresay provides the technology and the introduction.

  • What it is: a technology + marketing platform between independent therapists and self-pay clients.
  • What it is not: not a healthcare provider; not an employer of the therapists; not a crisis service; no insurance billing; no prescribing; no NHS contract.

How it works

  1. Client searches and is matched to a suitable therapist.
  2. Client books and pays through the platform (card, via Stripe).
  3. Therapist and client meet over secure video.
  4. Faresay retains a 15% platform fee (10% for founding therapists) and pays the remainder to the therapist. The fee is characterised as a platform/technology + marketing fee, not a share of the clinician's professional fee.

Who the therapists are

Independent, self-employed practitioners who must hold membership of an appropriate UK professional body / PSA-accredited register (e.g. BACP, UKCP, NCPS) or statutory registration where relevant (e.g. HCPC for practitioner psychologists), and carry their own professional indemnity insurance. Faresay vets credentials before a profile goes live.

Commercials (directional)

Item Value Note
Platform fee 15% 10% for founding therapists
Model Self-pay / private No insurance billing
Client payment Per session, upfront Stripe Connect
Therapist status Self-employed Not employed by Faresay
Stage Pre-launch (UK) Companies House + counsel in progress

Current technology stack (relevant to data questions)

  • Auth: Clerk · Database: Neon Postgres (EU region) · Video: Daily.co · Email: Resend · Payments: Stripe.
  • Several processors are US-headquartered — see the data-protection section of the UK Legal & Regulatory Brief for the international-transfer question.

The single biggest open dependency

UK regulatory and contractual structuring — confirmed by a solicitor — before taking live payments. This document set is the input to that conversation.

Faresay
Therapy, matched.

Questions for Solicitor — UK Launch

Confidential Faresay Ltd·24 June 2026

Agenda + checklist for the meeting. Bring the UK Legal & Regulatory Brief (full detail) and the UK Business Overview (context). Capture answers and any follow-up actions in the right column. Not legal advice — these are the questions we're asking.

Engagement basics

  • [ ] Is multi-area UK regulatory + commercial structuring within your firm's remit, or do we need specialists (data protection, employment) alongside?
  • [ ] Can we start with a fixed-fee scoping phase? What does it cover and cost?
  • [ ] Likely total cost and timeline to "safe to take live payments in the UK".

1. Structure & "marketplace not provider"

  • [ ] Does our "platform, not healthcare provider" position hold given we set price, take payment and control booking? What would tip us into being the provider?
  • [ ] Recommended entity / group structure and SIC codes.

2. CQC / regulated activity

  • [ ] Confirm Faresay does not need CQC registration. What facts would change that?

3. Therapist status (priority)

  • [ ] Worker/employee risk for self-employed therapists — what contract terms and operating practices keep them genuinely independent (substitution, exclusivity, who sets price)?
  • [ ] Our tax exposure on status; any off-payroll/agency rules that bite.

4. Data protection (priority)

  • [ ] Correct Article 6 + Article 9 bases for health data (explicit consent vs health/social-care).
  • [ ] Controller vs joint-controller model between Faresay and therapists; which agreement(s) to sign.
  • [ ] International transfers: we use some US processors (auth/video/email). What mechanism does each need (IDTA / SCCs + Addendum, TRA)? Should we move to UK/EU-region vendors instead?
  • [ ] DPIA sign-off; ICO registration / fee; breach-reporting setup.

5. Vetting & liability

  • [ ] Is requiring PSA-accredited-register membership (or HCPC) sufficient vetting? Add DBS / ID / qualification checks?
  • [ ] How to limit our liability if a vetted therapist later causes harm or is struck off.

6. Consumer law (B2C)

  • [ ] 14-day cancellation right and the checkout waiver wording for immediate service.
  • [ ] Allocation of "reasonable care and skill" between platform and therapist.
  • [ ] Are our limitation-of-liability and cancellation terms enforceable (no unfair-terms risk)?

7. Clinical safety & safeguarding

  • [ ] Our duty of care as intermediary and how to bound it; "not a crisis service" framing.
  • [ ] Minimum safeguarding duties to impose on therapists; our escalation obligations.
  • [ ] Complaints process; any ADR/ombudsman obligations.

8. Advertising (ASA/CAP)

  • [ ] Review homepage + marketing claims (efficacy, "accredited", competitor price comparisons).

9. Payments / FCA

  • [ ] Confirm no FCA authorisation / client-money obligations given Stripe is the PSP.

10. Tax / VAT

  • [ ] VAT treatment of the 15% platform fee; registration threshold/timing (coordinate with accountant).

11. Documents to get reviewed

  • [ ] Client Terms of Service + Privacy Notice
  • [ ] Therapist Agreement + data-sharing/DPA
  • [ ] Cancellation/refund, complaints, safeguarding policies

Outputs we want from the engagement

  • [ ] A clear "to go live in the UK, you must do X, Y, Z" list.
  • [ ] Confirmed therapist contract + client terms + privacy notice.
  • [ ] Data-protection position (bases, controller model, transfers) signed off.
  • [ ] Confirmation on CQC and FCA.
Faresay
Therapy, matched.

UK Privacy Policy

DRAFT — for professional sign-off Faresay Ltd·24 June 2026

⚠️ DRAFT v0.1 — for legal/privacy counsel review. NOT legal advice. Counsel must finalise before use. Last updated: [PLACEHOLDER: date]

Faresay Privacy Policy (UK)

Faresay operates an online therapy / mental-health marketplace that connects clients with UK-registered mental-health professionals. This Privacy Policy explains how we collect, use, share and protect your personal information, and the rights you have over it.

Because Faresay is a mental-health service, much of the information we handle is special-category health data. We treat this information with a correspondingly high standard of confidentiality and security. Please read this policy carefully.

This policy should be read alongside our Terms of Service, our Security & Data Protection Policy, and (where applicable) the separate clinician-provided privacy notices.


1. Who we are & data controller ⚠️ COUNSEL

Faresay ("Faresay", "we", "us", "our") provides the technology platform through which clients discover, book and pay for sessions with independent UK-registered mental-health professionals ("therapists" or "clinicians").

  • Controller legal entity: [PLACEHOLDER: registered controller legal name]
  • Registered address: [PLACEHOLDER: registered address]
  • Company registration number: [PLACEHOLDER: company number]
  • ICO registration number: [PLACEHOLDER: ICO registration number]
  • Data Protection Officer / privacy contact: [PLACEHOLDER: DPO or privacy contact name and email]

⚠️ COUNSEL — controller vs processor / joint-controller mapping. Faresay provides the platform; the clinician provides the clinical service and owns the clinical relationship and clinical record (see [CONTEXT.md] / Therapist Agreement). The respective data-protection roles must be confirmed: - For account, marketplace, payment, device and usage data, Faresay is likely the controller. - For clinical / session-note data created by the clinician, the clinician may be the independent controller (with Faresay acting as processor, or as joint controller for certain activities). - Counsel must finalise the controller / processor / joint-controller analysis under UK GDPR, and ensure the resulting roles are reflected consistently across this policy, the Terms, the Therapist Agreement and any data-sharing agreements and Data Processing Agreements (DPAs) between Faresay and clinicians.


2. Scope

This policy applies to Faresay's services as offered in the United Kingdom.

  • Faresay's processing of personal data is governed by the UK GDPR and the Data Protection Act 2018, and regulated by the Information Commissioner's Office (ICO).
  • Faresay is registered with the ICO and pays the applicable data-protection fee (see Section 1).

This policy covers our website, web and mobile applications, and related services (together, the "Platform"). It does not cover third-party websites or services we link to, which have their own privacy practices.


3. What data we collect

We collect the following categories of personal information.

3.1 Account & identity data

  • Name, email address, telephone number, username and password (stored hashed).
  • Date of birth / age confirmation.
  • Address or location (where relevant).
  • Profile information you provide.
  • For clinicians: professional identity, registration details with a relevant professional body (e.g. BACP, UKCP, NCPS, HCPC, BPS or another PSA-accredited register), qualifications, and verification information.

3.2 Health & special-category data ⚠️ COUNSEL

This is the most sensitive information we handle. It may include: - The fact that you are seeking or receiving mental-health support (itself sensitive health data). - Intake / assessment information, presenting concerns, symptoms, history and goals. - Session-related clinical information and notes (typically created and held by your clinician — see Section 1). - Messages and communications relating to your care. - Any health, disability, or other special-category information you choose to share.

Under UK GDPR this is special-category data (Article 9). We apply a high confidentiality and security bar to all such data.

⚠️ COUNSEL — confirm the precise boundary between data Faresay processes and clinical-record data the clinician controls, and ensure consent / lawful-basis mechanisms meet UK GDPR Article 9 requirements (including, where relied upon, separate valid explicit consent for collection, use and sharing of health data).

3.3 Payment data

  • Billing details and transaction history.
  • Payment is processed by third-party payment providers; we do not store full card numbers on our own systems. [PLACEHOLDER: confirm exactly what payment data Faresay stores vs. what the payment processor stores.]

3.4 Device & usage data

  • IP address, device identifiers, browser type, operating system.
  • Log data, pages/screens viewed, features used, and timestamps.
  • Approximate location derived from IP address.
  • Cookies and similar technologies (see Section 10).

3.5 Communications data

  • Messages you send to us (support, enquiries) and, where applicable, in-platform messages with clinicians.
  • Records of your communications with our support team.
  • Feedback, reviews and survey responses.

We collect this information directly from you, automatically through your use of the Platform, and in some cases from third parties (e.g. clinicians regarding your bookings, identity/registration verification providers regarding clinicians, and payment providers regarding transactions).


The table below summarises our main purposes and the legal bases we rely on under UK GDPR. For health / special-category data we identify both an Article 6 basis and an Article 9 condition.

⚠️ COUNSEL — the legal bases below are a first draft and must be confirmed. In particular, the Article 9 condition for health data must be finalised by counsel.

# Purpose Data used UK GDPR Art 6 basis UK GDPR Art 9 condition (health data)
1 Create and manage your account Account/identity Contract (Art 6(1)(b)) n/a
2 Match you with clinicians and enable booking/scheduling Account/identity, limited health context Contract (Art 6(1)(b)) ⚠️ COUNSEL — likely Art 9(2)(h) (health/social care) or explicit consent Art 9(2)(a)
3 Facilitate the provision of mental-health care via clinicians Health & special-category Contract / Legitimate interests ⚠️ COUNSEL — Art 9(2)(h) provision of health care, and/or Art 9(2)(a) explicit consent
4 Process payments and operate the 15% platform fee Payment, account Contract (Art 6(1)(b)) n/a
5 Provide support and respond to enquiries Communications, account Contract / Legitimate interests Art 9(2)(a) / 9(2)(h) where health data is involved ⚠️ COUNSEL
6 Safety, safeguarding and crisis response Health, communications Legitimate interests / Legal obligation / Vital interests ⚠️ COUNSEL — Art 9(2)(c) vital interests and/or 9(2)(h); see Crisis & Safeguarding Policy
7 Security, fraud prevention, and protecting the Platform Device/usage, account Legitimate interests / Legal obligation n/a
8 Service improvement and analytics Device/usage (minimised/aggregated where possible) Legitimate interests ⚠️ COUNSEL — avoid using health data for analytics without an appropriate condition
9 Marketing communications (where permitted) Account, usage Consent / Legitimate interests n/a
10 Legal compliance, regulatory and dispute handling As needed Legal obligation / Legitimate interests Art 9(2)(f) legal claims; 9(2)(g)/(h) as applicable ⚠️ COUNSEL

We will not use your special-category health data for a new, incompatible purpose without identifying an appropriate lawful basis and, where required, obtaining your explicit consent.


5. How we share your data

We share personal information only as described below.

  • Therapists / clinicians. To enable and deliver your care, relevant information is shared with the clinician you book or are matched with. The clinician is an independent professional responsible for the clinical relationship and clinical record (see Section 1).
  • Service providers / processors & sub-processors. We use third-party providers to host, operate and support the Platform (e.g. cloud hosting, communications, analytics, identity/registration verification, customer support). They process data on our instructions under written contracts (Data Processing Agreements). [PLACEHOLDER: sub-processor list / link to sub-processor list.]
  • Payment providers. Payment processors handle transactions and operate under their own privacy notices. [PLACEHOLDER: name(s) of payment provider(s).]
  • Legal & safety. We may disclose information where necessary to comply with law, respond to lawful requests, enforce our Terms, prevent fraud, or protect the rights, safety and vital interests of you or others (including in safeguarding / crisis situations — see Crisis & Safeguarding Policy).
  • Business transfers. If Faresay is involved in a merger, acquisition, financing or sale of assets, personal information may be transferred as part of that transaction, subject to appropriate confidentiality and continued protection of your data.

We do not sell your personal information. ⚠️ COUNSEL — confirm our disclosures and any required controls match actual data flows (including any analytics/advertising trackers), and that any sharing of health-related data via trackers is avoided or appropriately consented.


6. International data transfers ⚠️ COUNSEL

Faresay is based in the UK, but some of our service providers may process data outside the UK (including in the US — for example certain communications, video-session and email providers such as Clerk, Daily and Resend). Where we transfer personal data internationally, we will put in place an appropriate safeguard, which may include:

  • the UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses (SCCs) with the UK Addendum;
  • reliance on an adequacy decision / the UK Extension to the EU–US Data Privacy Framework, where applicable; or
  • other lawful transfer mechanisms.

⚠️ COUNSEL — finalise the transfer mechanism(s) for each data flow, confirm current adequacy / Data Privacy Framework status, and complete transfer risk assessments (TRAs) where required. Several current processors are US-based (e.g. Clerk, Daily, Resend); each such transfer must be assessed and documented, and UK/EU hosting regions should be selected where available. Given the sensitivity of mental-health data, transfer safeguards warrant particular scrutiny.


7. Data retention ⚠️ COUNSEL

We keep personal information only for as long as necessary for the purposes set out in this policy, and to meet legal, regulatory, accounting, clinical-record and dispute-resolution requirements. Retention periods are set out in our retention schedule.

  • Account & identity data: [PLACEHOLDER: retention period]
  • Health & clinical-record data: [PLACEHOLDER: retention period] ⚠️ COUNSEL — clinical-record retention is governed by professional/clinical standards and law. Confirm who (Faresay vs clinician) is responsible for retaining clinical records and for how long.
  • Payment & transaction data: [PLACEHOLDER: retention period, typically driven by tax/accounting law]
  • Device, usage & log data: [PLACEHOLDER: retention period]
  • Communications & support data: [PLACEHOLDER: retention period]

When data is no longer required, we will securely delete or anonymise it. ⚠️ COUNSEL — finalise the full retention schedule and reconcile it with clinical-record obligations.


8. Security

We implement technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse or alteration, with enhanced controls for sensitive health data. These measures are described in our Security & Data Protection Policy, which this policy incorporates by reference.

No system can be guaranteed 100% secure, but we maintain a high security bar appropriate to the sensitivity of mental-health data.


9. Your rights

Subject to applicable law, you have the right to: - access the personal data we hold about you (a subject access request / DSAR); - request rectification of inaccurate data; - request erasure ("right to be forgotten") in certain circumstances; - restrict or object to certain processing; - data portability; - withdraw consent at any time where processing is based on consent (without affecting prior processing); and - not be subject to solely automated decisions with legal/similarly significant effects (see Section 12).

To exercise these rights, contact us using the details in Section 14. We will respond within the timeframes required by law — generally within one month of receiving your request (extendable in limited circumstances). ⚠️ COUNSEL — note that some rights (e.g. erasure) may be limited where data forms part of a clinical record or must be retained for legal/regulatory reasons.


10. Cookies & tracking

We use cookies and similar technologies to operate the Platform, remember your preferences, keep you signed in, maintain security, and understand and improve how the Platform is used.

  • Strictly necessary cookies are required for the Platform to function.
  • Analytics / performance and functional cookies are used [PLACEHOLDER: confirm categories and providers].
  • We will obtain consent for non-essential cookies where required (e.g. under PECR / UK law), and provide controls to manage your preferences.

⚠️ COUNSEL — given the sensitivity of mental-health data, scrutinise any third-party trackers/SDKs (especially advertising/analytics) for potential disclosure of health-related data. Confirm the cookie banner/consent mechanism. [PLACEHOLDER: link to detailed cookie notice / preference centre.]


11. Children's data

The Platform is intended for adults. [PLACEHOLDER: confirm minimum age — e.g. 18, or 16/13 with conditions, and whether services to minors are offered at all.]

We do not knowingly collect personal information from children below the applicable age without appropriate consent. If you believe a child has provided us with personal information contrary to this policy, please contact us and we will take appropriate steps.

⚠️ COUNSEL — confirm the age policy and any provision of services to minors, which raises additional requirements (UK GDPR child-consent rules and the ICO Age Appropriate Design (Children's) Code; parental/guardian consent; and clinical considerations). If minors are ever supported, this section and the underlying processes must be substantially expanded.


12. Automated decision-making

Faresay does not currently make decisions producing legal or similarly significant effects about you based solely on automated processing without human involvement. We may use limited automated processing (e.g. to suggest clinician matches), but clinical decisions are made by your clinician.

⚠️ COUNSEL — confirm this remains accurate as matching/recommendation features evolve; if any solely-automated significant decisions are introduced, additional UK GDPR Article 22 safeguards and disclosures will be required.


13. Data breaches

We maintain procedures to detect, investigate and respond to personal-data breaches. Where a breach is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) without undue delay and, where required, within 72 hours of becoming aware. Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify affected individuals without undue delay.

Our incident-response approach is detailed in the Security & Data Protection Policy.


14. How to complain ⚠️ COUNSEL

If you have a concern about how we handle your personal data, please contact us first (Section 14, contact details below) so we can try to resolve it.

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) — https://ico.org.uk — though we ask that you contact us first.

⚠️ COUNSEL — confirm the complaint-handling process and contact routes, and whether any EU/EEA lead supervisory authority analysis is needed if EU residents are served.

If you need urgent help. This policy is about data protection, not crisis support. If you or someone else is in immediate danger, call 999. For mental-health support you can also contact the Samaritans on 116 123, NHS 111, or the SHOUT text service by texting 85258.


15. Contact & updates

Privacy / data-protection contact: [PLACEHOLDER: privacy contact name, email, postal address] Data Protection Officer (if appointed): [PLACEHOLDER: DPO name and contact]

We may update this Privacy Policy from time to time. We will post the updated version with a revised "Last updated" date and, where changes are material, take additional steps to notify you as required by law.


This is a DRAFT document prepared for legal/privacy counsel review. It is not legal advice and must be reviewed and finalised by qualified UK counsel before publication or use.

Faresay
Therapy, matched.

UK Terms of Service

DRAFT — for professional sign-off Faresay Ltd·24 June 2026

⚠️ DRAFT v0.1 — for legal counsel review. NOT legal advice. Counsel must finalise before use. Last updated: [PLACEHOLDER: date]

Faresay — Terms of Service (United Kingdom)

These Terms of Service ("Terms") govern your access to and use of the Faresay marketplace platform, including our website, applications, and related services (together, the "Platform"). The Platform is operated by [PLACEHOLDER: registered entity name], a company registered in England & Wales with company number [PLACEHOLDER: company number] and registered office at [PLACEHOLDER: registered address] ("Faresay", "we", "us", "our").

Please read these Terms carefully. They apply to you when you access or use the Platform in the United Kingdom.

⚠️ COUNSEL — Confirm the UK operating entity details (registered name, number, and address) and that the Platform's territorial scope is correctly stated as the United Kingdom.


1. Acceptance of these Terms

1.1 By creating an account, accessing, or using the Platform, you confirm that you have read, understood, and agree to be bound by these Terms and by any documents expressly incorporated by reference (including our Privacy Policy — see uk-privacy-policy.md). If you do not agree, you must not use the Platform.

1.2 If you are using the Platform on behalf of another person, you represent that you are authorised to accept these Terms on their behalf. ⚠️ COUNSEL — confirm whether use on behalf of another adult is permitted at all, and how it interacts with consent and confidentiality.

1.3 We may require you to affirmatively accept these Terms (for example, by clicking "I agree") before you can use certain features. Your continued use of the Platform constitutes ongoing acceptance.


2. Description of the Service

2.1 Faresay is a marketplace. The Platform connects clients ("you", "Client") with independent, UK-registered mental-health professionals ("Therapists") and provides technology and supporting services that facilitate discovery, scheduling, communication, and payment.

2.2 Faresay does NOT itself provide clinical, therapy, counselling, medical, or healthcare services. Faresay is not a healthcare provider, a medical practice, or a provider of mental-health treatment. Faresay does not practise psychology, psychotherapy, counselling, social work, or medicine, and does not supervise, direct, or control the clinical judgement of any Therapist.

2.3 Therapists are independent practitioners. They are not employees or agents of Faresay. The clinical relationship — including all assessment, diagnosis, treatment, advice, and the clinical record — is between you and your Therapist, not between you and Faresay. See Section 7.

2.4 The services Faresay provides are technology and marketing platform services: software, a searchable directory and matching tools, scheduling, secure messaging, video-session facilitation, payment processing, and client-acquisition and support functions. ⚠️ COUNSEL — this platform-not-provider characterisation is material to Faresay's liability position; confirm the wording aligns with what Faresay actually does and does not control.

2.5 We do not guarantee that any particular Therapist will be available, suitable, or a good match for you, that any course of therapy will achieve any particular outcome, or that you will be matched at all.


3. NOT AN EMERGENCY OR CRISIS SERVICE

⚠️ THE PLATFORM IS NOT FOR EMERGENCIES OR CRISES.

Faresay and the Platform are NOT an emergency service, crisis line, or suicide-prevention service. Therapists on the Platform are not available for emergency, urgent, or crisis response, and messages or bookings made through the Platform are not monitored for emergencies.

If you are experiencing a medical or mental-health emergency, are in crisis, or are at risk of harming yourself or others, do NOT use the Platform. Get help immediately:

  • Call 999 for any life-threatening emergency
  • Call NHS 111 for urgent mental-health help (select the mental-health option)
  • Call the Samaritans free on 116 123 (24 hours a day)
  • Text SHOUT to 85258 (free, confidential, 24/7 text support)

⚠️ COUNSEL / ⚠️ CLINICAL — Verify all numbers and service descriptions before publication, and confirm they match the uk-crisis-safeguarding-policy.md. Confirm 999, NHS 111 (urgent mental health), Samaritans 116 123, and SHOUT 85258 details.

3.1 You acknowledge that the Platform is intended for non-urgent mental-health support delivered by Therapists on a scheduled basis, and that response times for messages and bookings are not immediate.


4. Eligibility and Age

4.1 The Platform is intended for adults. You must be at least 18 years old to create an account and use the Platform.

4.2 Minors. ⚠️ COUNSEL / ⚠️ CLINICAL — Confirm whether services to minors will be offered at all and, if so, the consent model (parental/guardian consent and, for a child's own capacity to consent, Gillick competence and the Fraser guidelines), verification, and safeguarding requirements. Until finalised, this draft assumes adults only and minors are out of scope.

4.3 By using the Platform, you represent and warrant that you meet the eligibility requirements and that the information you provide is accurate.

4.4 Location. Therapists must be appropriately registered and entitled to practise in the United Kingdom and to provide services to you where you are located at the time of a session. You agree to provide accurate location information and to inform your Therapist if your location changes, because this may affect whether they can lawfully provide services to you. ⚠️ COUNSEL — confirm how location is verified and the position where a Client travels outside the UK during a course of therapy.


5. Accounts and Registration

5.1 To use most features you must create an account. You agree to provide accurate, current, and complete information and to keep it up to date.

5.2 You are responsible for safeguarding your login credentials and for all activity that occurs under your account. Notify us promptly at [PLACEHOLDER: security/support contact] if you suspect any unauthorised use.

5.3 You may not share your account, create an account using false information, or create an account on behalf of another person without authorisation.

5.4 We may refuse, suspend, or terminate accounts in accordance with Section 17.


6. The Therapist Relationship

6.1 Therapists are independent, self-employed registered professionals who use the Platform to offer their services. They are solely responsible for the mental-health and clinical services they provide, including their professional judgement, the suitability and quality of care, their compliance with applicable registration, professional, and ethical standards (including those of their professional body, such as BACP, UKCP, NCPS, or HCPC), and the maintenance of their clinical records.

6.2 The clinical relationship is between you and your Therapist. Faresay is not a party to that relationship. Faresay's role is limited to facilitating discovery, matching, scheduling, communication, and payment, and providing the supporting technology.

6.3 Faresay does not control or guarantee the qualifications, registration status, conduct, advice, or performance of any Therapist beyond any onboarding and verification steps we describe. ⚠️ COUNSEL / ⚠️ CLINICAL — confirm what verification and credentialing Faresay does perform and represent (see uk-clinical-governance-policy.md and uk-therapist-agreement.md); align the representations here with what is actually done, to avoid creating liability.

6.4 Any agreement for clinical services, including any therapist-specific terms, informed-consent forms, or notices, is between you and the Therapist. Where there is a conflict between these Terms and a Therapist's clinical engagement documents on a clinical matter, the Therapist's clinical documents govern that clinical matter.


7.1 The Platform supports the delivery of services by remote means (for example, video, voice, or messaging). Remote therapy has benefits and limitations and may not be appropriate for every person or condition.

7.2 Before or at the start of services, your Therapist is responsible for obtaining your informed consent to remote therapy as required by applicable law and professional standards, including explaining the nature, benefits, risks, and limitations of remote care, alternatives, confidentiality, and what to do in an urgent situation.

7.3 By using the Platform to receive remote services, you acknowledge that care may be delivered remotely and that you may be asked to provide separate informed consent to your Therapist.

⚠️ COUNSEL / ⚠️ CLINICAL — Confirm whether consent to remote therapy is captured by the Therapist, by the Platform, or both; whether a Platform-level consent is required; and the exact required disclosures under UK law and the relevant professional bodies' standards. Do not finalise this section without counsel and a clinical advisor.


8. No Professional Relationship with Faresay; Medical Disclaimer

8.1 No clinician–client relationship is formed with Faresay. Nothing on the Platform, and no interaction with Faresay or its staff, creates a clinician–client, doctor–patient, therapeutic, or other professional relationship between you and Faresay.

8.2 Faresay does not provide medical or clinical advice. Content made available by Faresay (such as general information, directory listings, or self-help material) is for general informational purposes only and is not a substitute for professional diagnosis, advice, or treatment. Always seek the advice of a qualified professional regarding any mental- or physical-health condition. Never disregard or delay seeking professional advice because of something accessed through the Platform.

8.3 Faresay does not recommend or endorse any specific Therapist, treatment, opinion, or course of action. Reliance on any information made available through the Platform is at your own risk.


9. Pricing and Payments

9.1 Session fees. Therapists set or agree the fees for their sessions, which are displayed to you before you book. You pay out of pocket for sessions. ⚠️ COUNSEL — confirm fee-setting mechanics (Therapist-set vs Platform-set vs banded).

9.2 Self-pay. Faresay does not bill insurers in the initial model. You are responsible for the full session fee. If you wish to seek reimbursement from a private medical insurer, that is a matter between you and your insurer.

9.3 Platform fee. Faresay's marketplace take rate is 15%, which is built into the model as a technology and marketing platform fee for the software, discovery, scheduling, payment, and client-acquisition services we provide. The 15% is consideration for the platform services we provide. ⚠️ COUNSEL — confirm exactly how the 15% is presented to Clients (e.g., embedded in the displayed price vs shown as a separate line) and that the presentation is fair and transparent.

9.4 Payment processing. Payments are processed through a third-party payment provider. By providing payment details, you authorise us (or our payment provider) to charge the applicable fees. You agree to the payment provider's terms. ⚠️ COUNSEL — identify provider and confirm flow of funds.

9.5 Taxes. Prices are inclusive or exclusive of VAT as stated at the point of booking. You are responsible for any taxes that apply to you. ⚠️ COUNSEL — confirm the VAT treatment of session fees and of the platform fee, including whether therapy services or any element of them are VAT-exempt.

9.6 Cancellations and rescheduling. You may cancel or reschedule a booked session up to [PLACEHOLDER: cancellation window, e.g. 24 hours] before the session start time and receive a full refund. Cancellations or reschedules made within the cancellation window may be subject to a charge of up to [PLACEHOLDER: cancellation fee / full session fee], as disclosed at booking. ⚠️ COUNSEL — confirm the policy and that it is fairly disclosed (UK consumer-protection considerations below).

9.7 No-shows. If you fail to attend a booked session without cancelling within the permitted window, you may be charged up to the full session fee. ⚠️ COUNSEL — confirm.

9.8 Refunds. Refunds are handled as follows: a full refund is provided where you cancel more than 24 hours before the session start time; [PLACEHOLDER: any further refund policy]. Where a session is not delivered due to the Therapist's or the Platform's fault, you will not be charged or will be refunded the session fee. ⚠️ COUNSEL — confirm the refund policy and reconcile it with your statutory cancellation rights described in Section 9.9.

9.9 Your statutory cancellation rights. Where you book as a consumer, you may have a statutory right under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 to cancel a distance contract for services within 14 days (the "cooling-off period") and receive a refund. If you ask us to begin providing the service during the cooling-off period, you acknowledge that you may lose the right to cancel once the service has been fully performed, and that if the service is only partly performed when you cancel you may be charged for what has been provided. Nothing in these Terms affects your statutory rights. ⚠️ COUNSEL — confirm the cancellation-rights wording, the express request/acknowledgement mechanism, and how the cooling-off right interacts with the booking and cancellation flow.


10. Client Responsibilities and Acceptable Use

10.1 You agree to: - (a) provide accurate information, including accurate location and any information reasonably needed for safe care; - (b) treat Therapists and Faresay staff with respect; - (c) attend booked sessions or cancel in accordance with Section 9; and - (d) use the Platform only for lawful purposes and in accordance with these Terms.

10.2 You agree not to: - (a) use the Platform for any emergency or crisis (see Section 3); - (b) impersonate any person or misrepresent your identity, age, or location; - (c) record, copy, or distribute sessions or communications without consent and lawful basis; - (d) harass, abuse, threaten, or harm any person; - (e) attempt to gain unauthorised access to the Platform, interfere with its operation, introduce malicious code, or scrape or harvest data; - (f) circumvent the Platform to arrange or pay for services off-platform in order to avoid fees, where prohibited; ⚠️ COUNSEL — confirm enforceability and wording of any anti-circumvention provision; - (g) use the Platform to infringe the rights of others or to post unlawful, defamatory, or infringing content; or - (h) use the Platform in violation of any applicable law or regulation.

10.3 We may remove content and suspend or terminate access for breach of this Section.


11. Intellectual Property

11.1 The Platform and all software, text, graphics, logos, trademarks, and other content provided by Faresay (excluding Therapist content and your content) are owned by or licensed to Faresay and protected by intellectual-property laws. "Faresay" and our logos are our trademarks.

11.2 We grant you a limited, non-exclusive, non-transferable, revocable licence to access and use the Platform for your personal, non-commercial use in accordance with these Terms. No other rights are granted.

11.3 Your content. You retain ownership of content you submit. You grant Faresay a non-exclusive, worldwide, royalty-free licence to host, store, and use your content solely as necessary to operate and provide the Platform and as described in our Privacy Policy. ⚠️ COUNSEL — ensure this licence does not extend to clinical-record content in a way that conflicts with the Therapist owning the clinical record, or with data-protection and health-confidentiality law.

11.4 You must not use Faresay's intellectual property without our prior written consent.


12.1 The Platform relies on and may link to third-party services (for example, payment processors, video providers, and other vendors). Therapists are themselves independent third-party providers (see Sections 2 and 6).

12.2 We are not responsible for the acts, omissions, content, products, or services of any third party, including Therapists, and your dealings with them are at your own risk and subject to their terms. Inclusion of a link or provider is not an endorsement.


13. Disclaimers of Warranties

13.1 To the fullest extent permitted by law, the Platform is provided "as is" and "as available", without warranties of any kind, whether express, implied, or statutory, except as set out in Section 13.4.

13.2 We do not warrant that the Platform will be uninterrupted, error-free, secure, or free of harmful components, or that any defect will be corrected.

13.3 Faresay makes no warranty regarding clinical services. Because Faresay does not provide clinical services, we make no representation or warranty as to the quality, suitability, safety, or outcome of any service provided by any Therapist.

13.4 Statutory rights. Nothing in these Terms excludes or limits any rights you have as a consumer that cannot lawfully be excluded or limited, including your rights under the Consumer Rights Act 2015. In particular, where Faresay supplies the platform services to you as a consumer, those services will be provided with reasonable care and skill. ⚠️ COUNSEL — confirm the statutory-rights wording and that this Section does not purport to exclude any non-excludable consumer right.


14. Limitation of Liability

14.1 To the fullest extent permitted by law, Faresay and its officers, directors, employees, and agents will not be liable for any indirect, incidental, special, consequential, or exemplary losses, or for any loss of profits, revenue, data, goodwill, or other intangible losses, arising out of or relating to your use of (or inability to use) the Platform.

14.2 To the fullest extent permitted by law, Faresay's total aggregate liability arising out of or relating to these Terms or the Platform will not exceed the greater of (a) the total platform fees you paid to Faresay in the [PLACEHOLDER: e.g. 12] months before the event giving rise to the claim, or (b) [PLACEHOLDER: monetary cap]. ⚠️ COUNSEL — set the cap and confirm enforceability against consumers under the Consumer Rights Act 2015 fairness rules.

14.3 Clinical services. Faresay is not liable for the clinical services provided by Therapists, who are independent and solely responsible for their services (Section 6).

14.4 Carve-outs. Nothing in these Terms limits or excludes liability that cannot lawfully be limited or excluded, including liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, for breach of the terms implied by the Consumer Rights Act 2015 to the extent they cannot be excluded, and for any other liability that cannot be excluded or limited under applicable law. ⚠️ COUNSEL — confirm the precise carve-outs.


15. Indemnification

15.1 To the fullest extent permitted by law, you agree to indemnify and hold harmless Faresay and its officers, directors, employees, and agents from and against any claims, liabilities, damages, losses, and expenses (including reasonable legal fees) arising out of or related to (a) your breach of these Terms, (b) your misuse of the Platform, or (c) your violation of any law or the rights of any third party. ⚠️ COUNSEL — confirm scope and enforceability against consumers (consumer indemnities are constrained by the Consumer Rights Act 2015 fairness rules).


16. Dispute Resolution; Governing Law

16.1 Informal resolution. Before bringing a formal claim, you agree to contact us at [PLACEHOLDER: disputes contact] and attempt to resolve the dispute informally for at least [PLACEHOLDER: e.g. 30] days. This does not affect your right to bring proceedings.

16.2 Governing law and jurisdiction. These Terms and any dispute arising out of them are governed by the laws of England & Wales, and the courts of England & Wales will have jurisdiction. If you are a consumer resident elsewhere in the United Kingdom, you retain the benefit of any mandatory protections of the law of the part of the UK in which you live and may bring proceedings in your local courts. ⚠️ COUNSEL — confirm governing law and jurisdiction and that consumers retain the protection of mandatory laws of their home jurisdiction.

16.3 Consumer rights preserved. Nothing in this Section requires you to give up any right to bring proceedings in the courts, and we will not seek to impose mandatory arbitration or any waiver of your right to bring or participate in collective proceedings. The fairness rules in the Consumer Rights Act 2015 apply to these Terms. ⚠️ COUNSEL — confirm that no dispute-resolution provision is unfair or unenforceable against UK consumers.


17. Suspension and Termination

17.1 You may stop using the Platform and close your account at any time, subject to settling any amounts due and to your Therapist's separate clinical/discharge arrangements.

17.2 We may suspend or terminate your access, with or without notice, if (a) you breach these Terms, (b) we are required to do so by law, (c) we reasonably believe your use poses a risk to others or to the Platform, or (d) we discontinue the Platform or a feature.

17.3 On termination, the licences granted to you end. Sections that by their nature should survive (including Sections 8, 11, 13, 14, 15, 16, and 18) survive termination.

17.4 ⚠️ COUNSEL / ⚠️ CLINICAL — Termination must not abruptly cut off care in a clinically unsafe way. Coordinate with uk-clinical-governance-policy.md and the Therapist's continuity-of-care obligations so that clients are signposted appropriately.


18. Changes to these Terms

18.1 We may update these Terms from time to time. If we make material changes, we will provide reasonable notice (for example, by email or an in-Platform notice) before they take effect.

18.2 Changes take effect on the date stated in the updated Terms. Your continued use of the Platform after the effective date constitutes acceptance. If you do not agree, you must stop using the Platform. ⚠️ COUNSEL — confirm change-of-terms mechanics meet UK consumer-protection requirements.


19. Miscellaneous

19.1 Entire agreement. These Terms, together with documents incorporated by reference, are the entire agreement between you and Faresay regarding the Platform and supersede prior agreements on that subject. This does not exclude liability for fraudulent misrepresentation.

19.2 Severability. If any provision is held unenforceable, the remaining provisions remain in effect, and the unenforceable provision will be modified to the minimum extent necessary.

19.3 No waiver. Our failure to enforce any provision is not a waiver of it.

19.4 Assignment. You may not assign these Terms without our consent. We may assign these Terms in connection with a merger, acquisition, or sale of assets, subject to applicable law and provided your rights are not adversely affected.

19.5 No agency. Nothing in these Terms creates any partnership, joint venture, agency, or employment relationship between you and Faresay, or between Faresay and any Therapist.

19.6 Force majeure. We are not liable for any failure or delay caused by events beyond our reasonable control.

19.7 Notices. We may provide notices to you by email or through the Platform. You may contact us as set out in Section 20.

19.8 Language. These Terms are provided in English, which is the governing language. ⚠️ COUNSEL — confirm whether any localised/translated versions are needed.


20. Contact

If you have questions about these Terms, contact us at:

  • Entity: [PLACEHOLDER: registered entity name]
  • Address: [PLACEHOLDER: registered address]
  • Email: [PLACEHOLDER: contact email, e.g. enquiries@ / legal@]

For urgent or emergency situations, do not contact us — see Section 3.


End of draft. ⚠️ This document is a first draft for legal counsel review and is not legal advice. Counsel must finalise before use.

Faresay
Therapy, matched.

UK Therapist Agreement

DRAFT — for professional sign-off Faresay Ltd·24 June 2026

⚠️ DRAFT v0.1 — for UK legal counsel review. NOT legal advice. UK counsel must finalise before use. Last updated: [PLACEHOLDER: date]

Faresay UK Therapist Agreement

This Therapist Agreement (the "Agreement") is entered into between Faresay and the independent mental-health professional who accepts it (the "Therapist"). It governs the Therapist's participation in the Faresay marketplace platform in the United Kingdom.

By clicking to accept, signing, or by providing services through the Faresay platform, the Therapist agrees to be bound by this Agreement.


1. Parties and Definitions

1.1 Parties

1.1.1 "Faresay" means [PLACEHOLDER: registered entity name], a company [PLACEHOLDER: company type / registration number] whose registered office is at [PLACEHOLDER: registered address] (also referred to as "we", "us", "our", and the "Platform Operator").

1.1.2 "Therapist" means the individual mental-health professional identified in the onboarding registration, who is contracting in their own capacity (or, where permitted, through their own practice entity) (also referred to as "you" and "your").

1.1.3 Faresay and the Therapist are each a "Party" and together the "Parties".

1.2 Definitions

In this Agreement:

  • "Client" means an individual who books, accesses, or receives clinical services from the Therapist via the Platform.
  • "Clinical Record" means the clinical notes, assessments, treatment plans, and other professional records the Therapist creates in connection with the care of a Client.
  • "Clinical Services" means the mental-health / psychotherapy / counselling services the Therapist provides to Clients.
  • "Faresay Policies" means the policies referenced in clause 17, including the Clinical Governance Policy (uk-clinical-governance-policy.md), the Crisis/Safeguarding Policy (uk-crisis-safeguarding-policy.md), the Privacy Policy (uk-privacy-policy.md), the Security & Data Protection Policy (uk-security-data-protection-policy.md), and the Terms of Service (uk-terms-of-service.md), each as updated from time to time.
  • "Platform" means the Faresay website, applications, software, and related technology, discovery, scheduling, payment, and marketing services.
  • "Platform Fee" means the fee described in clause 5.2.
  • "Session Fee" means the fee payable by a Client for a session of Clinical Services, as set in accordance with clause 5.1.
  • "Territory" means the United Kingdom.

2. Nature of the Relationship

2.1 Self-employed independent contractor. The Therapist is a self-employed independent contractor and not an employee, worker, partner, joint venturer, or agent of Faresay. Nothing in this Agreement creates an employment, worker, or agency relationship. The Therapist:

2.1.1 is responsible for their own working methods, scheduling (subject to bookings accepted), and the manner in which Clinical Services are delivered, consistent with applicable professional standards;

2.1.2 is under no obligation to accept any particular booking or to make themselves available for any minimum amount of work, and Faresay is under no obligation to offer any minimum volume of bookings;

2.1.3 is not subject to any exclusivity and is free to provide services to Clients and to other platforms, practices, or organisations on their own account;

2.1.4 may, subject to clause 3 (Eligibility) and with prior notice to Faresay, send a suitably qualified, registered, insured, and credentialed substitute to perform Clinical Services where their professional and ethical obligations permit;

2.1.5 provides their own equipment and professional tools (save for the Platform technology Faresay makes available); and

2.1.6 is solely responsible for their own income tax, National Insurance contributions, VAT (where applicable), and other taxes (clause 5.6).

⚠️ COUNSEL: Employment-status risk under UK law (employee / worker / self-employed for both employment-rights and tax/IR35 purposes) turns on the practical reality of the relationship, not just the contract wording. UK counsel must review the substitution, control, mutuality-of-obligation, exclusivity, and integration factors against current case law (and HMRC guidance) before use, and the operational practice must match the drafting.

2.2 The Therapist owns the clinical relationship. The professional relationship between the Therapist and each Client is exclusively the Therapist's. The Therapist exercises independent professional clinical judgement and is solely responsible for all clinical decisions. Faresay does not direct, control, or interfere with the Therapist's clinical judgement or the content of Clinical Services.

2.3 The Therapist owns the Clinical Record. The Therapist is the owner of, and the data controller / custodian of, the Clinical Record, and is responsible for creating, maintaining, retaining, and securing it in accordance with applicable law and professional obligations. Faresay processes Client data as described in clause 9 and the Privacy Policy.

2.4 Faresay is a technology and marketing platform. Faresay provides software, client discovery and acquisition, scheduling, payment processing, and related administrative and marketing services. Faresay does not provide Clinical Services, does not employ the Therapist to provide Clinical Services, and is not a party to the clinical relationship.

2.5 Characterisation of the Platform Fee. The Platform Fee is a fee for the technology and marketing platform and services Faresay provides (software, discovery, scheduling, payments, client acquisition, and administrative support). It is not a division, split, or share of the Therapist's professional or clinical fee.

⚠️ COUNSEL: UK counsel to confirm the platform/technology/marketing-fee characterisation is sound, consistent with professional-body guidance on referral and marketing arrangements (e.g. BACP, UKCP, NCPS, BPS, HCPC standards), and is reflected accurately in Client-facing and Therapist-facing materials. Do not represent this characterisation as settled until confirmed.


3. Eligibility and Credentialing

3.1 Registration and right to practise. The Therapist must hold, and maintain at all times, the registration and entitlement required to provide the relevant Clinical Services in the United Kingdom, namely:

3.1.1 current registration with an appropriate UK professional body or a register accredited by the Professional Standards Authority for Health and Social Care (PSA) — for example BACP, UKCP, or NCPS — as appropriate to the Therapist's profession; or, where the Therapist's title or profession is statutorily regulated, current statutory registration (for example HCPC registration for practitioner psychologists);

3.1.2 a valid, current, and unrestricted entitlement to practise the relevant Clinical Services (with no condition, suspension, or restriction affecting fitness to practise); and

3.1.3 the legal right to work and to provide the Clinical Services in the United Kingdom.

⚠️ COUNSEL: The psychotherapy/counselling professions are largely self-regulated through PSA-accredited registers rather than statutory registration. UK counsel and the clinical lead to confirm the acceptable registers and minimum-membership criteria per profession, and how protected titles (e.g. "practitioner psychologist" under the HCPC) are handled. See uk-clinical-governance-policy.md.

3.2 Insurance. The Therapist must hold and maintain professional indemnity insurance meeting the requirements of clause 13 throughout the term.

3.3 Background and identity checks. The Therapist consents to, and must satisfactorily complete, identity verification, credential verification, and background checks as Faresay reasonably requires, including an enhanced DBS check (or PVG-scheme check in Scotland / AccessNI check in Northern Ireland) where appropriate to the role.

3.4 Ongoing monitoring. The Therapist authorises Faresay to verify and to monitor on an ongoing basis the status of the Therapist's registrations, insurance, and right to practise, and to use third-party verification services for this purpose. The Therapist must notify Faresay within [PLACEHOLDER: notice period, e.g. 3 business days] of any change, lapse, suspension, condition, investigation, complaint, restriction, or revocation affecting any registration, insurance, or fitness to practise.

3.5 Accuracy. The Therapist must ensure all credentialing information and profile content remains accurate, current, and not misleading.


4. Platform Services Provided to the Therapist

Subject to this Agreement, Faresay provides the Therapist with access to:

4.1 a professional profile and listing for client discovery and marketing; 4.2 scheduling, booking, and calendar tools; 4.3 secure messaging and an online video-session environment, or integration with one; 4.4 payment collection from Clients and payout processing to the Therapist; 4.5 administrative tooling to support record-keeping (noting the Therapist remains owner of the Clinical Record per clause 2.3); 4.6 customer-support and dispute-handling functions; and 4.7 such other features as Faresay may make available from time to time.

Faresay provides the Platform on an "as available" basis and may modify, add, or remove features, subject to clause 11.


5. Fees and Payment Flow

5.1 Session Fee. The Session Fee for each Client session is [PLACEHOLDER: set by the Therapist within Faresay parameters / set by Faresay / agreed]. Clients pay for sessions directly through the Platform.

5.2 Platform Fee (15%; 10% founding). Faresay retains a Platform Fee of fifteen per cent (15%) of the Session Fee for each session delivered through the Platform (or ten per cent (10%) for founding Therapists, where Faresay has confirmed founding status in writing), as consideration for the technology and marketing services described in clause 4. As stated in clause 2.5, the Platform Fee is a platform/technology and marketing fee and not a split of the Therapist's professional fee.

5.3 Payout. Faresay (directly or through its payment processor) collects the Session Fee from the Client, deducts the Platform Fee, and pays the remaining balance (eighty-five per cent (85%), or ninety per cent (90%) for founding Therapists) to the Therapist, less any amounts properly withheld under this clause 5. Payouts are made [PLACEHOLDER: payout schedule / method] to the Therapist's nominated account.

5.4 Payment processor. Payments are processed by [PLACEHOLDER: payment processor, e.g. Stripe]. The Therapist must complete the processor's onboarding (including any required identity/KYC steps) and is subject to the processor's terms.

5.5 Refunds, cancellations, and chargebacks. Refunds and cancellations are handled in accordance with the Terms of Service and Faresay's cancellation policy. Where a Client refund, reversal, or chargeback relates to a session for which the Therapist has been (or is to be) paid, Faresay may deduct or recover the corresponding amount (including any associated processor fees) from current or future payouts. ⚠️ COUNSEL: confirm allocation of chargeback liability and processor fee pass-through.

5.6 Taxes. The Therapist is solely responsible for determining, reporting, and paying all taxes (including income tax, National Insurance contributions, and VAT where applicable) arising from the Therapist's income. Faresay does not operate PAYE or withhold employment taxes. The Therapist must provide any tax information reasonably required for UK tax-reporting purposes.

5.7 No fee for unbooked time. Faresay pays only for Clinical Services actually delivered through the Platform. The Therapist is not paid for availability, profile time, or non-session activity.


6. Therapist Obligations

The Therapist must at all times:

6.1 Standard of care. Provide Clinical Services with the reasonable skill, care, and diligence expected of a competent professional in the relevant discipline, and in accordance with applicable professional, ethical, and regulatory standards.

6.2 Scope of practice and competence. Practise only within the scope of the Therapist's registration, training, and competence, and decline or refer where a Client's needs fall outside that scope (including where in-person or higher-acuity care is clinically indicated).

6.3 Remote-delivery compliance. Comply with all applicable laws, professional guidance, and technical-safety requirements relevant to delivering Clinical Services remotely in the United Kingdom, including verifying the Client's location (within the UK) and identity at each session as required.

6.4 Informed consent. Obtain and document appropriate informed consent for assessment and treatment, including consent to remote/online delivery, before providing Clinical Services.

6.5 Confidentiality. Maintain the confidentiality of Client information in accordance with professional duties of confidence, this Agreement, and applicable data-protection law (clause 9), disclosing only as permitted or required by law or to protect against serious harm.

6.6 Safeguarding and disclosure. Comply with all applicable safeguarding, duty-of-confidence, and lawful-disclosure obligations under UK law and professional standards.

6.7 Crisis and safeguarding. Adhere to Faresay's Crisis/Safeguarding Policy (uk-crisis-safeguarding-policy.md) and Clinical Governance Policy (uk-clinical-governance-policy.md), each incorporated into this Agreement by reference, including escalation and risk-management procedures and the signposting of Clients in crisis to appropriate UK services (for example 999, the Samaritans on 116 123, NHS 111, or the SHOUT text service on 85258).

6.8 Record-keeping. Create and retain Clinical Records in accordance with applicable law and professional standards for the required retention period, and make them available to the Client (and, where lawfully required, to a continuing clinician) as required.

6.9 Conduct. Behave professionally toward Clients and Faresay staff, keep profile and marketing content accurate, and not make any false, misleading, or guaranteed-outcome claims.

6.10 Cooperation. Cooperate with Faresay's quality-assurance, clinical-governance, complaints, and audit processes.


7. Client Relationship and Non-Circumvention

7.1 Introductions. Faresay invests in client acquisition and marketing. Clients introduced to the Therapist through the Platform are introduced in consideration of the Therapist's participation in, and use of, the Platform.

7.2 Non-circumvention. During the term and for [PLACEHOLDER: period, e.g. 12 months] afterwards, the Therapist must not, for any Client first introduced to the Therapist through the Platform, solicit or arrange for Clinical Services to be provided and paid for outside the Platform with the primary purpose of avoiding the Platform Fee.

⚠️ COUNSEL: Non-circumvention / non-solicitation terms must respect (a) the Client's right to choose and continue with their clinician, (b) continuity-of-care and professional-ethics obligations, and (c) restraint-of-trade / enforceability limits under UK law. This clause must not be drafted or enforced so as to compromise patient care or abandon Clients. UK counsel to confirm scope, duration, and carve-outs.

7.3 Continuity carve-out. Nothing in clause 7.2 prevents the Therapist from continuing to treat a Client where required by professional ethics or continuity-of-care obligations, or where the Client independently chooses to continue treatment; clause 7.2 addresses only deliberate fee-avoidance.


8. (Reserved)

This clause number is intentionally reserved.


9. Data Protection and Confidentiality

9.1 Roles. With respect to Client personal data, the Parties acknowledge that the Therapist (as the clinician owning the clinical relationship and the controller of the Clinical Record) and Faresay (as the platform operator) each process personal data, and that their respective roles as controller, joint controller, or processor must be clearly mapped per processing activity and recorded in a data-sharing agreement and/or data-processing agreement between the Parties. The detailed allocation is set out in the Privacy Policy (uk-privacy-policy.md) and the Security & Data Protection Policy (uk-security-data-protection-policy.md).

⚠️ COUNSEL: The controller / joint-controller / processor mapping is legally significant and fact-specific. UK counsel and the DPO must confirm the mapping and put in place the correct UK GDPR Article 26 (joint controller) / Article 28 (processor) arrangements, and a data-sharing agreement where the Parties are independent controllers, before launch.

9.2 UK GDPR. Both Parties must comply with the UK GDPR and the Data Protection Act 2018. Client clinical data is special-category (health) data requiring an appropriate lawful basis and Article 9 condition, and a high standard of security and confidentiality.

9.3 Security. The Therapist must comply with the Security & Data Protection Policy, use only Faresay-approved or otherwise compliant tools to handle Client data, and report any personal-data breach to Faresay without undue delay and in any event within [PLACEHOLDER: e.g. 24 hours] of becoming aware of it.

9.4 Confidential information. Each Party must keep confidential the other's non-public business information and use it only to perform this Agreement. This clause 9.4 does not limit the Therapist's separate professional duty of clinical confidentiality owed to Clients.


10. Intellectual Property and Licence

10.1 Faresay IP. Faresay (and its licensors) own all rights in the Platform, the Faresay name, logos, and marks, and all Faresay-created content. No rights are granted except as expressly set out here.

10.2 Licence to the Therapist. Faresay grants the Therapist a non-exclusive, non-transferable, revocable licence to use the Platform, and to use Faresay marks and materials, solely to provide and promote Clinical Services through the Platform and in accordance with Faresay's brand guidelines.

10.3 Therapist content. The Therapist retains ownership of content they supply (such as profile text and credentials) and grants Faresay a non-exclusive, worldwide, royalty-free licence to host, display, reproduce, and use that content to operate and market the Platform and the Therapist's listing.

10.4 Clinical Record. For the avoidance of doubt, this clause 10 does not affect the Therapist's ownership of the Clinical Record under clause 2.3.


11. Representations and Warranties

11.1 The Therapist represents and warrants that, on an ongoing basis:

11.1.1 they hold all registrations and entitlements required to provide the Clinical Services in the United Kingdom (clause 3); 11.1.2 they are not subject to any unspent disqualification, suspension, exclusion, debarment, or restriction that would prevent them from providing Clinical Services; 11.1.3 they hold the insurance required by clause 13; 11.1.4 all information they provide to Faresay is accurate and not misleading; and 11.1.5 they will comply with all applicable laws, professional standards, and Faresay Policies.

11.2 Except as expressly stated, the Platform is provided "as is" and Faresay disclaims all other warranties to the maximum extent permitted by law.


12. Indemnification

12.1 The Therapist will indemnify and hold harmless Faresay and its affiliates, and their officers and staff, from and against losses, liabilities, damages, claims, and reasonable costs (including legal fees) arising out of or in connection with:

12.1.1 the Therapist's provision of (or failure to provide) Clinical Services, including any clinical negligence, malpractice, or breach of professional duty; 12.1.2 the Therapist's breach of this Agreement, the Faresay Policies, or applicable law; 12.1.3 any claim that the Therapist lacked the required registration, entitlement, or competence; and 12.1.4 the Therapist's breach of data-protection or confidentiality obligations.

12.2 Faresay will indemnify the Therapist for losses arising from Faresay's breach of this Agreement or its negligence in operating the Platform, subject to clause 14 (limitation of liability).

⚠️ COUNSEL: Mutual scope, caps, carve-outs, and the interaction with insurance and with the limitation of liability must be reviewed by UK counsel. Certain liabilities (e.g. clinical negligence to a Client) cannot be contracted away and must be backed by insurance.


13. Insurance Requirements

13.1 The Therapist must, at their own cost, hold and maintain professional indemnity insurance with a reputable insurer, with cover of at least [PLACEHOLDER: minimum cover amount and basis, e.g. per-claim / aggregate] appropriate to the Clinical Services provided.

13.2 The Therapist must provide evidence of cover on onboarding and on request, and must notify Faresay promptly if cover lapses, is reduced, or is cancelled.

13.3 Cover must remain in force during the term and, where the policy is claims-made, for [PLACEHOLDER: run-off / tail period] after termination.


14. Limitation of Liability

14.1 Nothing in this Agreement limits or excludes liability that cannot lawfully be limited or excluded, including liability for death or personal injury caused by negligence, for fraud, or any other liability that cannot be limited under applicable law.

14.2 Subject to clause 14.1, Faresay is not liable for indirect or consequential loss, loss of profit, loss of goodwill, or loss of anticipated savings.

14.3 Subject to clauses 14.1 and 14.2, Faresay's total aggregate liability arising out of or in connection with this Agreement is limited to [PLACEHOLDER: cap, e.g. the total Platform Fees paid by/attributable to the Therapist in the [12] months before the claim].

14.4 For the avoidance of doubt, Faresay is not responsible for the Clinical Services or for the Therapist's clinical decisions, which are the Therapist's sole responsibility.

⚠️ COUNSEL: Caps and exclusions must be reviewed by UK counsel for enforceability (e.g. under the Unfair Contract Terms Act 1977) and reconciled with the indemnity (clause 12) and insurance (clause 13).


15. Continuity of Care on Termination

15.1 The welfare of Clients takes priority on any termination or suspension. The Therapist must not abandon a Client and must comply with their professional continuity-of-care obligations.

15.2 On notice of termination (by either Party), the Parties will cooperate in good faith to manage an orderly transition, which may include:

15.2.1 the Therapist completing or safely concluding in-progress care, or arranging an appropriate handover or referral; 15.2.2 the Therapist providing the Client (and any continuing clinician the Client chooses) with access to the relevant Clinical Record as required by law and professional standards; and 15.2.3 Faresay supporting affected Clients in finding an alternative clinician on the Platform where the Client wishes.

15.3 The Therapist must give Clients reasonable notice of their departure where clinically appropriate, in a manner agreed with Faresay so as not to breach clause 7 while fully respecting Client choice and clause 15.1.

⚠️ COUNSEL / ⚠️ CLINICAL: Continuity-of-care, record-handover, and Client-notification mechanics must align with uk-clinical-governance-policy.md, uk-crisis-safeguarding-policy.md, and UK professional ethics rules.


16. Term, Suspension, and Termination

16.1 Term. This Agreement starts when the Therapist accepts it and continues until terminated under this clause 16.

16.2 Termination for convenience. Either Party may terminate on [PLACEHOLDER: notice period, e.g. 30 days'] written notice, subject to clause 15 (continuity of care).

16.3 Termination for cause. Faresay may suspend access or terminate immediately on written notice if the Therapist:

16.3.1 loses, or has restricted, any required registration, entitlement to practise, or insurance; 16.3.2 is subject to a regulatory, safeguarding, or fitness-to-practise concern that Faresay reasonably considers presents a risk to Clients; 16.3.3 commits a material breach of this Agreement or the Faresay Policies (and, if remediable, fails to remedy it within [PLACEHOLDER: cure period]); or 16.3.4 becomes insolvent or ceases to practise.

16.4 Suspension. Faresay may suspend the Therapist's access pending investigation of any matter under clause 16.3 where reasonably necessary to protect Clients, acting in good faith.

16.5 Effect of termination. On termination, the licence in clause 10.2 ends and the Therapist must stop using Faresay marks. Accrued payment rights, and clauses intended to survive (including clauses 2.3, 5.5–5.6, 7, 9, 11–15, 18, and 19), survive termination.


17. Compliance with Faresay Policies

17.1 The Therapist must comply with all Faresay Policies, which are incorporated into this Agreement by reference, including:

  • Clinical Governance Policy — uk-clinical-governance-policy.md
  • Crisis/Safeguarding Policy — uk-crisis-safeguarding-policy.md
  • Privacy Policy — uk-privacy-policy.md
  • Security & Data Protection Policy — uk-security-data-protection-policy.md
  • Terms of Service — uk-terms-of-service.md

17.2 Faresay may update the Faresay Policies from time to time in line with clause 19.2. Where a Policy conflicts with this Agreement on a clinical-safety or legal-compliance matter, the more protective requirement applies; otherwise this Agreement prevails.


18. Dispute Resolution and Governing Law

18.1 The Parties will first attempt in good faith to resolve any dispute through discussion and, if needed, [PLACEHOLDER: escalation / mediation process].

18.2 This Agreement and any dispute arising out of it are governed by the laws of England and Wales [PLACEHOLDER: confirm — England and Wales / Scotland / Northern Ireland as appropriate to the Therapist], and the Parties submit to the [PLACEHOLDER: exclusive / non-exclusive] jurisdiction of the courts of [PLACEHOLDER: venue].

⚠️ COUNSEL: UK counsel to confirm governing law and venue (and to address the position for Therapists in Scotland and Northern Ireland), and any arbitration or alternative-dispute-resolution provisions.


19. Notices

19.1 Notices under this Agreement must be in writing and sent to: (a) Faresay at [PLACEHOLDER: legal/notices email and address]; and (b) the Therapist at the contact details in their account.

19.2 Routine operational communications may be given through the Platform or by email and are deemed received [PLACEHOLDER: e.g. on the next business day].


20. Entire Agreement, Amendments, and General

20.1 Entire agreement. This Agreement and the documents it incorporates by reference are the entire agreement between the Parties on its subject matter and supersede prior discussions.

20.2 Amendments. Faresay may amend this Agreement or the Faresay Policies on [PLACEHOLDER: notice period] notice; continued use of the Platform after the effective date constitutes acceptance. Material changes adverse to the Therapist will be notified, and the Therapist may terminate under clause 16.2 if they do not accept them. ⚠️ COUNSEL: confirm unilateral-amendment mechanics are enforceable under UK law.

20.3 Assignment. The Therapist may not assign this Agreement without Faresay's consent. Faresay may assign to an affiliate or successor.

20.4 No partnership/agency. Nothing creates a partnership or agency (clause 2.1).

20.5 Severance. If any provision is unenforceable, the rest remains in effect and the provision is modified to the minimum extent necessary.

20.6 Waiver. A failure to enforce any right is not a waiver of it.

20.7 Third-party rights. Except as expressly stated, no third party has rights to enforce this Agreement under the Contracts (Rights of Third Parties) Act 1999 [PLACEHOLDER: confirm position].


End of draft. ⚠️ This document is a v0.1 first draft and must be reviewed and finalised by qualified UK legal counsel before use. It is not legal advice.

Faresay
Therapy, matched.

UK Clinical Governance Policy

DRAFT — for professional sign-off Faresay Ltd·24 June 2026

⚠️ DRAFT v0.1 — for clinical advisor + UK legal review. NOT clinical or legal advice. Must be validated by a UK-qualified clinical lead before use. Last updated: [PLACEHOLDER: date]

Faresay UK Clinical Governance Policy

1. Purpose and Scope

1.1 Purpose

1.1.1 This Clinical Governance Policy (the "Policy") sets out the framework through which Faresay seeks to assure the quality and safety of the clinical services delivered by independent mental-health professionals through the Faresay marketplace platform in the United Kingdom.

1.1.2 The Policy describes how clinical standards are set, how practitioners are verified and monitored, how clinical quality and safety are overseen, and how clinical risks, incidents, and complaints are managed. Its objective is to support safe, ethical, evidence-informed care while preserving each practitioner's independent professional clinical judgement.

1.1.3 Faresay provides the technology and marketing platform (software, discovery, scheduling, payments, client acquisition, and administrative support). Faresay does not provide clinical services, does not employ practitioners to provide clinical services, and is not a party to the clinical relationship. The practitioner provides the clinical service and owns the clinical relationship and the clinical record. This Policy is a governance and quality-assurance framework for the marketplace; it is not, and must not be read as, Faresay directing, controlling, or interfering with any practitioner's clinical judgement.

⚠️ COUNSEL: The boundary between (a) legitimate marketplace quality/safety governance and (b) Faresay being treated as the provider of clinical care matters for Faresay's intermediary characterisation, its duty of care and liability exposure, and any CQC regulated-activity question. The whole Policy must be reviewed by UK counsel to confirm it does not, in substance or appearance, make Faresay the provider of, or the controller of, clinical care rather than an intermediary that facilitates it. See uk-therapist-agreement.md and uk-legal-regulatory-brief.md (§1–§3, §7).

1.2 Scope

1.2.1 This Policy applies to:

  • all mental-health practitioners onboarded to and delivering services through the Platform ("Practitioners");
  • Faresay personnel and contractors involved in clinical governance, onboarding, verification, trust and safety, and support;
  • the clinical advisory function described in Section 3.

1.2.2 Territory. This Policy applies to Faresay's operations in the United Kingdom. Where a requirement differs across England, Scotland, Wales, and Northern Ireland (for example, the relevant social-work regulator, or safeguarding frameworks), this is flagged. Such nation-specific requirements are subject to validation by UK counsel and the clinical lead.

1.2.3 This Policy sits alongside and should be read with: the Therapist Agreement (uk-therapist-agreement.md), the Crisis / Safeguarding Policy (uk-crisis-safeguarding-policy.md), the Privacy Policy (uk-privacy-policy.md), the Security & Data Protection Policy (uk-security-data-protection-policy.md), and the Terms of Service (terms-of-service.md).

1.3 Status and ownership of this Policy

1.3.1 This Policy is owned by the Clinical Lead (see Section 3) and approved by [PLACEHOLDER: approving body — e.g. Faresay board / clinical advisory committee].

1.3.2 ⚠️ CLINICAL: This draft has been prepared without a UK-qualified clinical lead in post. Every clinical standard, threshold, and exclusion in this Policy must be reviewed, corrected, and validated by a UK-qualified clinical lead before the Policy is relied upon.


2. Definitions

In this Policy:

  • "Client" means an individual who books, accesses, or receives clinical services from a Practitioner via the Platform.
  • "Clinical Lead" means the qualified, suitably-registered senior clinician accountable for clinical governance at Faresay, as described in Section 3.
  • "Clinical Advisory Function" means the clinical advisory committee, panel, or named advisors supporting the Clinical Lead, as described in Section 3.
  • "Clinical Record" means the clinical notes, assessments, treatment plans, correspondence, and other professional records a Practitioner creates in connection with the care of a Client.
  • "Clinical Services" means the regulated or self-regulated mental-health, psychotherapy, or counselling services a Practitioner provides to Clients.
  • "DBS" means the UK Disclosure and Barring Service (and, where relevant, its equivalents: Disclosure Scotland and AccessNI in Northern Ireland).
  • "Practitioner" means an independent, suitably registered/accredited mental-health professional onboarded to deliver Clinical Services through the Platform.
  • "Professional Body" means the relevant statutory regulator or professional membership / PSA-accredited register for a Practitioner (see Section 18).
  • "PSA-accredited register" means a register accredited under the Professional Standards Authority's Accredited Registers programme.
  • "Routine Outcome Measure" / "ROM" means a validated, standardised measure used to track client symptoms, functioning, or progress over the course of care.
  • "Scope of Practice" means the range of clinical activities a Practitioner is qualified, trained, competent, and registered/accredited to perform.
  • "Telehealth" means the delivery of Clinical Services remotely by video, voice, or messaging.

3. Governance Structure and Accountability

3.1 Principle of clinical leadership

3.1.1 ⚠️ CLINICAL: Clinical governance at Faresay must be led by a qualified clinician, not by commercial or product staff. Faresay will appoint a Clinical Lead who is professionally responsible and accountable for the matters in this Policy.

3.1.2 The Clinical Lead must hold a current, valid, unrestricted UK registration/accreditation with a relevant Professional Body and have appropriate seniority and experience in mental-health practice and clinical governance. [PLACEHOLDER: named Clinical Lead, qualifications, registration number.]

3.2 Role of the Clinical Lead

3.2.1 The Clinical Lead is responsible for: owning and maintaining this Policy and related clinical standards; overseeing Practitioner onboarding, verification, and credentialing criteria (Section 4); defining scope-of-practice and exclusion criteria (Sections 6 and 15); overseeing quality assurance and outcome monitoring (Section 11); chairing or convening the Clinical Advisory Function; overseeing clinical incident review (Section 12) and the clinical complaints route (Section 13); and advising the business on clinical risk.

3.2.2 The Clinical Lead may delegate operational tasks but remains accountable for the clinical governance framework.

3.3 Clinical Advisory Function

3.3.1 ⚠️ CLINICAL: Faresay will establish a Clinical Advisory Function — a committee, panel, or set of named advisors — to support the Clinical Lead. Its composition, terms of reference, quorum, and meeting cadence are to be defined. [PLACEHOLDER: committee structure and members.]

3.3.2 The Clinical Advisory Function should, at minimum, include clinicians representing the main professional disciplines on the Platform (e.g. clinical/counselling psychology, psychotherapy, counselling, clinical social work). ⚠️ CLINICAL: confirm the appropriate disciplinary mix and whether independent (external) advisors are required.

3.3.3 Indicative responsibilities: reviewing and endorsing clinical standards and exclusion criteria; periodic case review and audit (Section 11); reviewing serious clinical incidents and trends (Section 12); and advising on emerging clinical risks and evidence.

3.4 Non-clinical roles

3.4.1 Faresay's trust-and-safety, onboarding/verification, support, data-protection, and engineering teams support clinical governance operationally (for example, by running verification checks and maintaining systems) but do not make clinical decisions. Clinical decisions about individual clients rest solely with the treating Practitioner.

3.4.2 A roles-and-responsibilities matrix is set out in Section 17.


4. Practitioner Onboarding and Verification

4.1 Principle

4.1.1 No Practitioner may deliver Clinical Services through the Platform until they have completed onboarding and verification and have been approved. Onboarding establishes that a Practitioner is appropriately qualified, registered/accredited, insured, and fit to practise.

4.2 Registration / accreditation verification

4.2.1 Faresay will verify that the Practitioner holds a current, valid, unrestricted statutory registration or accredited membership with the relevant UK Professional Body — e.g. HCPC for practitioner psychologists; membership of a PSA-accredited register (such as BACP, UKCP, or NCPS) for counsellors/psychotherapists, as applicable. ⚠️ CLINICAL: confirm the minimum acceptable registers/accreditations Faresay will accept, and whether unaccredited counsellors are excluded.

⚠️ COUNSEL: "Therapist" and "counsellor" are not statutorily protected titles in the UK. Confirm that mandating statutory registration (HCPC) or PSA-accredited-register membership is a sufficient and defensible vetting standard, and what additional checks counsel would require (DBS, identity, qualification verification). See uk-legal-regulatory-brief.md (§3).

4.2.2 Verification must capture and store, at minimum: the registering/accrediting body, registration/membership number, registration type and scope, issue and expiry/renewal dates, and current standing. [PLACEHOLDER: verification provider / method — e.g. primary-source verification against the regulator's / register's online check.]

4.3 References

4.3.1 Faresay will obtain and review [PLACEHOLDER: number] professional reference(s) appropriate to the role. ⚠️ CLINICAL: confirm reference requirements (number, source, whether clinical-supervisor references are required).

4.4 Background / DBS checks

4.4.1 Faresay will require an appropriate criminal-records / suitability check. ⚠️ COUNSEL / ⚠️ CLINICAL: confirm the correct DBS level for remote, non-regulated-activity mental-health work (basic vs standard vs enhanced), and whether the work meets the definition of "regulated activity" — this affects DBS eligibility and barred-list checks. Confirm the equivalent route in Scotland (Disclosure Scotland / PVG) and Northern Ireland (AccessNI). Do not assert a check level until confirmed.

4.5 Professional indemnity insurance

4.5.1 Each Practitioner must hold and maintain professional indemnity / professional liability insurance appropriate to their discipline and to the telehealth services delivered, at coverage limits no lower than [PLACEHOLDER: minimum limits]. Faresay will verify cover at onboarding and on renewal.

⚠️ COUNSEL / ⚠️ CLINICAL: Minimum coverage limits, whether telehealth is within the policy's scope, and any requirement for Faresay to be named/additional insured must be set with counsel and the clinical lead.

4.6 Fitness and declarations

4.6.1 At onboarding and on renewal, Practitioners must declare any past or pending fitness-to-practise proceedings, registration conditions/restrictions/suspensions, criminal matters, and material complaints or claims. Material non-disclosure may result in removal from the Platform.

4.7 Ongoing registration / sanction monitoring

4.7.1 Verification is not a one-time event. Faresay will operate ongoing monitoring of each Practitioner's continued eligibility, including:

  • monitoring registration/accreditation expiry and requiring evidence of renewal before lapse;
  • periodic re-verification of standing with each relevant Professional Body / register on a defined cadence ([PLACEHOLDER: e.g. at least annually, and on renewal]);
  • monitoring for disciplinary actions, sanctions, conditions, suspensions, or restrictions, including checks against the relevant regulator's / register's published actions. ⚠️ COUNSEL: confirm the permissible/required sources for monitoring sanctions across HCPC, the PSA-accredited registers, and the relevant social-work regulators.
  • monitoring lapses or changes to professional indemnity insurance.

4.7.2 On discovery of an expiry, sanction, restriction, or loss of insurance affecting a Practitioner's eligibility, Faresay will suspend the Practitioner's availability pending review by the Clinical Lead, and manage any client-continuity-of-care implications under Sections 6, 12, and the Crisis / Safeguarding Policy (uk-crisis-safeguarding-policy.md).


5. Standards of Care and Evidence-Based Practice

5.1 Practitioners are expected to deliver care that is consistent with current, recognised, evidence-based or evidence-informed practice for the presenting need and client population, within the limits of telehealth delivery.

5.2 Practitioners must comply with the ethical and practice standards of their Professional Body / register (Section 18), including standards specific to remote/telehealth delivery.

5.3 ⚠️ CLINICAL: Confirm whether Faresay will reference or require adherence to specific clinical guidelines (e.g. NICE guidance) or remain at the level of "consistent with the Practitioner's professional standards and competence." Avoid setting standards that could be read as Faresay directing clinical care.

5.4 Practitioners must keep their knowledge and skills current (see Section 10) and practise within their competence (Section 6).


6. Scope of Practice and Competence

6.1 Practising within competence

6.1.1 Practitioners must only provide Clinical Services that fall within their Scope of Practice — that is, services they are qualified, trained, competent, registered/accredited, and (where required) supervised to provide — and only with client populations and presentations they are competent to treat.

6.1.2 Practitioners must not work beyond their competence and must refer or signpost a Client elsewhere where the Client's needs fall outside the Practitioner's competence or outside what can be safely delivered on this Platform.

6.2 Presentations unsuitable for the Platform

6.2.1 ⚠️ CLINICAL: Faresay operates a private-pay telehealth marketplace. Certain presentations and acuity levels are not appropriate for this setting and must be excluded from, or escalated out of, Platform-based care. These include (indicatively, to be finalised by the Clinical Lead):

  • active suicidal or homicidal crisis, or imminent risk of serious harm to self or others;
  • presentations requiring urgent, emergency, or in-person crisis intervention or hospitalisation;
  • conditions requiring a level or intensity of care that telehealth cannot safely provide (e.g. acute psychosis requiring stabilisation, severe/high-risk eating disorders requiring medical monitoring, acute withdrawal/detoxification);
  • circumstances where the Client cannot be safely treated remotely (e.g. no safe, private environment; age limits).

6.2.2 The detailed clinical thresholds, screening, and the response when an excluded presentation is identified before or during care (including safe referral, escalation, and signposting to emergency services — 999, Samaritans 116 123, NHS 111, SHOUT 85258) are governed by the Crisis / Safeguarding Policy (uk-crisis-safeguarding-policy.md), which this Policy cross-references and must be read with. ⚠️ CLINICAL: ensure the exclusion list here and the screening/escalation pathways in the Crisis / Safeguarding Policy are mutually consistent.


7.1 Before Clinical Services begin, the Practitioner is responsible for obtaining the Client's informed consent to treatment, consistent with the Practitioner's professional and legal obligations.

7.2 Informed consent should cover, at minimum: the nature, format, and limits of telehealth delivery; the likely approach and any material risks/benefits and alternatives; confidentiality and its limits (including safeguarding disclosures — see uk-crisis-safeguarding-policy.md); how clinical records are kept and by whom; fees and the private-pay model; and arrangements for crisis/out-of-hours situations and what to do in an emergency.

7.3 ⚠️ CLINICAL / ⚠️ COUNSEL: Informed-consent content and documentation requirements differ by discipline. Confirm any UK-specific consent requirements and whether consent must be documented in a prescribed form. (Faresay serves adults only; if minors are ever served, capacity to consent must be assessed under Gillick competence / the Fraser guidelines — see Section 13.)

7.4 Consent to clinical treatment (the Practitioner's responsibility) is distinct from consent to data processing by Faresay as a platform, which is addressed in the Privacy Policy (uk-privacy-policy.md).


8. Clinical Record-Keeping Standards

8.1 The Practitioner holds the clinical record

8.1.1 The clinical record is owned and held by the Practitionernot by Faresay. The Practitioner is the controller/custodian of the Clinical Record and is responsible for creating, maintaining, retaining, securing, and (where required) disposing of it in accordance with law and professional standards. See uk-therapist-agreement.md.

8.1.2 Faresay processes Client and platform data as a technology provider as described in the Privacy Policy (uk-privacy-policy.md) and Security & Data Protection Policy (uk-security-data-protection-policy.md); this is distinct from holding the Clinical Record.

⚠️ COUNSEL: The controller/processor (UK GDPR / DPA 2018) characterisation of Faresay versus the Practitioner for the Clinical Record and associated data must be confirmed with counsel, and may require a data-sharing / data processing agreement (and consideration of a joint-controller or controller-to-controller arrangement). See uk-security-data-protection-policy.md and uk-legal-regulatory-brief.md (§5).

8.2 Minimum record-keeping standards

8.2.1 Practitioners must keep clinical records that are, at minimum:

  • accurate, contemporaneous, and legible — created at or close to the time of the contact;
  • adequate — sufficient to support continuity and the clinical decisions made, including presenting issues, assessment, risk assessment, formulation/treatment plan, consent, session notes, and any referrals or safeguarding actions;
  • secure and confidential — stored to the security standard required by law and uk-security-data-protection-policy.md;
  • retained for the period required by the Practitioner's Professional Body and applicable UK law, and then securely disposed of.

8.2.2 [PLACEHOLDER: minimum retention periods] ⚠️ CLINICAL / ⚠️ COUNSEL: retention periods differ by discipline and client age (e.g. records for minors). Confirm the applicable UK standards, and whether Faresay's platform tooling stores any clinical content (and if so, under what agreement).


9. Clinical Supervision and Continuing Professional Development

9.1 Practitioners must maintain clinical supervision and continuing professional development (CPD) consistent with the requirements of their Professional Body / register, and must be able to evidence this on request.

9.2 ⚠️ CLINICAL: Some UK modalities/bodies require ongoing supervision (e.g. BACP's supervision requirement for counsellors). Confirm the minimum supervision and CPD standards Faresay will require, and whether trainee/pre-accredited practitioners are admitted at all and, if so, how supervision is evidenced.

9.3 Faresay does not act as the Practitioner's clinical supervisor and does not provide clinical supervision; responsibility for arranging adequate supervision rests with the Practitioner.


10. Quality Assurance and Outcome Monitoring

10.1 ⚠️ CLINICAL: Faresay will operate a clinical quality-assurance programme, overseen by the Clinical Lead and Clinical Advisory Function. The detailed design — including which measures, thresholds, and review cadences are appropriate and clinically valid — must be set by the clinical lead. Indicative components:

  • Routine Outcome Measures (ROMs): use of validated, standardised measures (e.g. [PLACEHOLDER: instruments — to be selected by clinical lead]) to track client progress, used as a clinical tool by Practitioners rather than as a performance metric imposed by Faresay.
  • Client feedback: structured post-session/episode feedback and satisfaction measures, and a clear route for clients to raise clinical concerns (Section 13).
  • Periodic case review / clinical audit: sampling and review of de-identified cases or anonymised practice data against agreed standards, by the Clinical Advisory Function.
  • Practitioner quality signals: monitoring of indicators such as cancellation/no-attend patterns, complaints, and incidents, used supportively and proportionately.

10.2 ⚠️ COUNSEL / ⚠️ CLINICAL: Outcome and case-review activity must be designed so it does not (a) make Faresay the provider of clinical care or override clinical judgement, or (b) breach client confidentiality / UK data-protection law. Confirm the lawful basis, de-identification approach, and consent position for any clinical-data use with counsel; confirm clinical validity with the clinical lead.

10.3 Quality-assurance findings feed into Practitioner support, this Policy's periodic review (Section 16), and the risk register (risk-register.md).


11. Incident Reporting and Management

11.1 A clinical incident is any event in connection with Clinical Services that caused, or had the potential to cause, harm to a Client or another person — including safeguarding concerns, serious adverse events, suspected boundary or ethical breaches, data incidents affecting clinical information, and "near misses."

11.2 Practitioners and Faresay personnel must report clinical incidents promptly through [PLACEHOLDER: reporting channel / form]. Faresay will maintain an incident log and triage incidents to the Clinical Lead.

11.3 The Clinical Lead (with the Clinical Advisory Function for serious incidents) will ensure each incident is reviewed, immediate client safety is addressed, root causes and learning are identified, and corrective actions are tracked to completion. Trends are reported into quality assurance (Section 10) and the risk register (risk-register.md).

11.4 ⚠️ CLINICAL / ⚠️ COUNSEL: Certain incidents trigger external reporting or notification duties — for example to a regulator / professional body, a local-authority safeguarding lead, an insurer, or (for personal-data breaches) the ICO and affected individuals. The mandatory external reporting matrix must be confirmed with counsel and the clinical lead, including any variation across England, Scotland, Wales, and Northern Ireland. Crisis events (e.g. risk to life) are governed by the Crisis / Safeguarding Policy (uk-crisis-safeguarding-policy.md).

11.5 Faresay will not retaliate against good-faith reporting of incidents or concerns.


12. Complaints Handling — Clinical Route

12.1 Faresay operates a clear route for Clients (and others) to raise concerns or complaints. Complaints are triaged into:

  • Clinical complaints — concerning the quality, safety, or conduct of clinical care — which are routed to the Clinical Lead / Clinical Advisory Function; and
  • Platform complaints — concerning the technology, billing, scheduling, or service — handled by Faresay's support/operations function.

12.2 Clinical complaints will be acknowledged within [PLACEHOLDER: timeframe] and investigated by, or under the oversight of, the Clinical Lead, with the Practitioner given a fair opportunity to respond. Outcomes, learning, and any actions (including referral to fitness-to-practise processes where warranted) will be recorded and fed into incident management (Section 11) and quality assurance (Section 10).

12.3 Clients retain the right to complain directly to the Practitioner's Professional Body / register, and Faresay will not obstruct this. Faresay will signpost the relevant body where appropriate. [PLACEHOLDER: complaints contact / address.]

12.4 ⚠️ COUNSEL: Confirm any complaint-handling requirements, timeframes, and record-keeping obligations applicable in the UK (including whether any ADR/ombudsman scheme applies), and how clinical complaints interact with Faresay's terms (terms-of-service.md). See uk-legal-regulatory-brief.md (§7).


13. Suitability / Exclusion Criteria for Onboarding Clients

13.1 The Platform is suitable for adults seeking telehealth mental-health care for presentations that can be safely treated remotely on a private-pay, planned-care basis. Faresay serves adults only.

13.2 ⚠️ CLINICAL: Client suitability screening and exclusion criteria must be defined by the clinical lead and aligned with Section 6 and the Crisis / Safeguarding Policy. Indicative exclusion/triage criteria for onboarding a Client:

  • individuals in acute crisis or at imminent risk of harm to self or others (route to emergency services / crisis pathways — 999, Samaritans 116 123, NHS 111, SHOUT 85258 — per uk-crisis-safeguarding-policy.md);
  • presentations requiring emergency, in-person, or higher-intensity care than telehealth can safely provide (see 6.2);
  • minors — the Platform currently serves adults only. [PLACEHOLDER: confirm whether under-18s are ever served; if so, age thresholds, parental/guardian consent, and additional safeguards.] ⚠️ CLINICAL / ⚠️ COUNSEL: serving minors materially increases clinical and legal complexity (capacity and consent assessed under Gillick competence / the Fraser guidelines, safeguarding, mandatory reporting). Confirm explicitly that the Platform does not serve minors at launch.

13.3 Where a prospective or current Client is identified as unsuitable, Faresay and/or the Practitioner will signpost to more appropriate services and follow the escalation steps in the Crisis / Safeguarding Policy where risk is present.


14. Audit and Periodic Review

14.1 Faresay will periodically audit compliance with this Policy, including: a sample audit of Practitioner verification and ongoing-monitoring records (Section 4); review of incident and complaint logs and actions (Sections 11–12); and review of quality-assurance outputs (Section 10).

14.2 This Policy will be reviewed at least [PLACEHOLDER: e.g. annually], and additionally on any material change to law, regulation, professional standards, the business model, or following a serious incident. Review is led by the Clinical Lead and approved by [PLACEHOLDER: approving body].

14.3 Material clinical risks identified through audit and review are recorded in the risk register (risk-register.md).


15. Roles and Responsibilities Matrix

⚠️ CLINICAL / ⚠️ COUNSEL: Indicative only. The allocation below must be confirmed with the clinical lead and counsel, in particular the boundary that keeps Faresay's role to non-clinical quality/safety governance rather than the provision or direction of clinical care. [PLACEHOLDER: named roles/owners.]

Area Practitioner Clinical Lead Clinical Advisory Function Faresay (non-clinical: trust & safety / ops / engineering)
Clinical decisions for individual clients Owns / accountable — (no individual-case direction)
This Policy & clinical standards Comply Owns / maintains Advises / endorses Supports operationally
Onboarding & verification (Section 4) Provide evidence Sets criteria; approves exceptions Advises Runs checks operationally
Ongoing registration/sanction monitoring (4.7) Keep credentials current; disclose Reviews flags; suspends eligibility Advises Runs monitoring; suspends availability operationally
Scope of practice / exclusions (Sections 6, 13) Works within competence Defines criteria Endorses Implements platform controls
Informed consent (Section 7) Obtains & documents Sets standard Advises Provides supporting tooling
Clinical records (Section 8) Owns / holds / retains Sets minimum standards Advises Provides secure platform tooling only
Supervision & CPD (Section 9) Arranges & evidences Sets minimum requirement Advises Verifies evidence
Quality assurance & outcomes (Section 10) Participate Owns programme Conducts case review Provides data tooling
Incidents (Section 11) Report; act on client safety Reviews / oversees Reviews serious incidents Logs; triages
Complaints — clinical (Section 12) Respond Oversees clinical route Reviews Triages; handles platform complaints
Audit & review (Section 14) Cooperate Leads Participates Supports

16. References to Professional and Ethical Frameworks

16.1 ⚠️ CLINICAL / ⚠️ COUNSEL: The list below is indicative and must be confirmed and completed by the clinical lead and counsel — including which bodies/registers Faresay will recognise, and the correct, current standards for each discipline.

16.2 United Kingdom (indicative).

  • HCPC (Health and Care Professions Council) — statutory regulator of practitioner psychologists (and others).
  • BACP (British Association for Counselling and Psychotherapy) — PSA-accredited register, ethical framework, and accreditation for counsellors/psychotherapists.
  • UKCP (UK Council for Psychotherapy) — PSA-accredited register and standards for psychotherapists.
  • NCPS (National Counselling and Psychotherapy Society) — PSA-accredited register for counsellors/psychotherapists.
  • BPS (British Psychological Society) — professional body / practice guidance for psychologists.
  • Social Work England — statutory regulator of social workers in England, with equivalents in the other UK nations: SSSC (Scottish Social Services Council) in Scotland, Social Care Wales in Wales, and NISCC (Northern Ireland Social Care Council) in Northern Ireland.
  • PSA-accredited registers — more broadly, registers accredited under the Professional Standards Authority's Accredited Registers programme.
  • [PLACEHOLDER: other relevant bodies — e.g. BABCP — and which Faresay recognises.]

16.3 Practitioners remain bound by the ethical and practice standards of the body that registers/accredits them, in addition to this Policy. Where this Policy and a Practitioner's professional standards conflict, the Practitioner must comply with their professional/legal obligations and raise the conflict with the Clinical Lead.


  • CONTEXT.md — shared fact sheet (source of truth).
  • uk-legal-regulatory-brief.md — UK legal & regulatory brief (structuring reference and open questions for counsel).
  • uk-therapist-agreement.md — Practitioner contractual terms (credentialing, records, fee characterisation).
  • uk-crisis-safeguarding-policy.md — crisis, risk, safeguarding, and escalation pathways (cross-referenced throughout).
  • uk-privacy-policy.md and uk-security-data-protection-policy.md — data protection and security.
  • terms-of-service.md — client-facing terms.
  • risk-register.md — risk capture and tracking.

End of DRAFT v0.1. ⚠️ This document must be validated by a UK-qualified clinical lead (and, for the points flagged ⚠️ COUNSEL, by UK counsel) before use.

Faresay
Therapy, matched.

UK Crisis & Safeguarding Policy

DRAFT — for professional sign-off Faresay Ltd·24 June 2026

⚠️ DRAFT v0.1 — for clinical advisor + legal review. NOT clinical or legal advice. Must be validated by a qualified clinical/safeguarding lead before use. Last updated: [PLACEHOLDER: date]

Faresay — UK Crisis & Safeguarding Policy

This policy sets out how Faresay and the Therapists who use the Faresay marketplace platform (the "Platform") identify, respond to, escalate, and learn from situations involving risk to a Client's safety or the safety of others, and how Faresay discharges its safeguarding responsibilities. It applies to Faresay's operations in the United Kingdom.

It must be read alongside the Clinical Governance Policy, the Terms of Service, the Privacy Policy, the Therapist Agreement, and the Security & Data Protection Policy. Where this policy and another Faresay document conflict on a safety-critical point, the more protective interpretation applies pending resolution by the Safeguarding Lead.

⚠️ CLINICAL — This document is a structural first draft. Every clinical threshold, screening criterion, escalation step, and exclusion criterion below must be reviewed, corrected, and signed off by a qualified clinical/safeguarding lead before any operational use. Do not rely on it as written.


1. Purpose & Scope

1.1 Purpose. This policy aims to: - (a) protect Clients, Therapists, third parties, and the public from foreseeable serious harm; - (b) make clear that Faresay is not an emergency or crisis service, and ensure that message is communicated consistently; - (c) give Therapists a clear, predictable framework for identifying and escalating risk; - (d) define safeguarding roles, responsibilities, and on-call expectations within Faresay; and - (e) ensure incidents are documented, reviewed, and used for learning, consistent with legal and professional obligations.

1.2 Who this applies to. This policy applies to: - all Therapists providing Clinical Services via the Platform (it is incorporated into the Therapist Agreement by reference — see clauses 6.6–6.7 of that agreement); - all Faresay staff and contractors involved in operations, trust & safety, support, or clinical governance; and - the design and operation of Platform features that touch on safety.

1.3 Territorial scope. Faresay operates in the United Kingdom. This policy covers UK obligations across England, Scotland, Wales, and Northern Ireland. ⚠️ COUNSEL / ⚠️ CLINICAL — A number of safeguarding and reporting obligations below differ between the four UK nations (for example, the adult-safeguarding statutory framework differs in England, Scotland, Wales, and Northern Ireland); nation-specific addenda will be required where this policy notes such variation.

1.4 Population scope. This draft assumes the Platform serves adults only and that minors are out of scope, consistent with the current assumption in the Terms of Service and Therapist Agreement. ⚠️ CLINICAL / ⚠️ COUNSEL — If services to minors are ever offered, this policy requires substantial additional child-safeguarding content (consent models, age and capacity assessment — including Gillick competence and the Fraser guidelines — verification, and dedicated child-protection escalation). The "safeguarding of children" provisions below currently address (a) risk disclosed about a child who is a third party (e.g. a Client's own child) and (b) future-proofing, not direct treatment of minors.

1.5 Relationship to clinical responsibility. Faresay provides the technology and marketing platform; the Therapist provides the clinical service and owns the clinical relationship, clinical judgement, and clinical record (see Terms of Service §2). Nothing in this policy transfers clinical responsibility for an individual Client to Faresay or makes Faresay a healthcare provider. The Therapist remains the decision-maker on the clinical care of their Clients, within the framework this policy sets.


2. Faresay Is Not an Emergency or Crisis Service

2.1 Core statement. Faresay and the Platform are not an emergency service, crisis line, or suicide-prevention service. Bookings, messages, and other communications sent through the Platform are not monitored in real time for emergencies, and Therapists are not available for emergency, urgent, or crisis response. The Platform is intended for non-urgent, scheduled mental-health support.

2.2 How this is communicated to Clients. This message must be surfaced clearly and repeatedly, not buried. At minimum (⚠️ CLINICAL / ⚠️ COUNSEL — confirm placement, wording, and frequency): - (a) in the Terms of Service (see ToS §3, "NOT AN EMERGENCY OR CRISIS SERVICE"), which Clients accept at onboarding; - (b) on the onboarding / intake flow, as a distinct, acknowledged screen — not a buried clause; - (c) persistently within the messaging interface (e.g. a standing banner or footer stating the Platform is not monitored for emergencies and listing crisis resources — see §8); - (d) within any "report a concern" or help surfaces; and - (e) reiterated by the Therapist at the start of the therapeutic relationship as part of informed consent (see Clinical Governance Policy).

2.3 Wording must be consistent. The crisis-resource wording and numbers used across the Platform, the Terms of Service, and this policy must match. The authoritative list of resources is in §8 of this policy. ⚠️ COUNSEL / ⚠️ CLINICAL — Verify all numbers and service descriptions and keep them synchronised with Terms of Service §3.

2.4 What "not an emergency service" does not mean. This disclaimer does not relieve a Therapist of their professional duty of care to a Client during the course of a session or active treatment relationship (see §4), nor of safeguarding, public-interest-disclosure, and reporting obligations (see §6–§7). It governs Client expectations of the Platform's availability and monitoring; it does not switch off a clinician's professional and legal duties.


3. Risk Types Covered

This policy covers the following risk presentations. ⚠️ CLINICAL — definitions, indicators, and thresholds for each must be set by the Safeguarding Lead; the descriptions below are placeholders for scope, not clinical guidance.

3.1 Suicidality — suicidal ideation (passive or active), intent, plan, means, and history; acute and chronic risk.

3.2 Self-harm — non-suicidal self-injury and related risk, including escalation patterns and medical risk.

3.3 Risk of harm to others — threats or risk of violence toward identifiable or non-identifiable third parties, including homicidal ideation. May engage a Therapist's discretion to disclose confidential information in the public interest to prevent serious harm to an identifiable third party (see §7).

3.4 Domestic abuse — a Client experiencing or perpetrating domestic abuse (physical, sexual, psychological, coercive control, economic, or technology-facilitated abuse). ⚠️ CLINICAL / ⚠️ COUNSEL — Special caution: documentation, safety planning, and any external contact must not increase risk to a Client experiencing abuse; covert tech-facilitated monitoring of the victim must be assumed possible.

3.5 Safeguarding of children — concern that a child (typically a third party, e.g. a Client's child, in this adults-only model) is suffering or at risk of significant harm, abuse, or neglect. Engages UK child-safeguarding frameworks and referral to local-authority children's services (see §6 and §7).

3.6 Safeguarding of adults at risk — concern that an adult with care-and-support needs is experiencing or at risk of abuse or neglect ("adult safeguarding"). Engages UK adult-safeguarding frameworks, which differ across the four nations (see §6 and §7).

3.7 Other acute risk — e.g. acute psychosis, severe disordered eating with medical risk, acute intoxication/overdose risk, severe deterioration. May indicate the presentation is unsuitable for the Platform (see §5 exclusion criteria).


4. Therapist Duty of Care & Responsibilities

4.1 Professional duty. Each Therapist remains bound by the duty of care, ethical codes, and standards of their regulator and professional body. In the UK these include, as applicable to the Therapist's profession: the Health and Care Professions Council (HCPC), the British Association for Counselling and Psychotherapy (BACP), the UK Council for Psychotherapy (UKCP), the British Psychological Society (BPS), and Social Work England (together with the devolved social-work regulators: the Scottish Social Services Council, Social Care Wales, and the Northern Ireland Social Care Council). ⚠️ CLINICAL — confirm the applicable bodies and standards for each Therapist's profession and nation of practice.

4.2 Therapists must: - (a) screen for and remain alert to the risk types in §3 at onboarding and on an ongoing basis (see §5); - (b) hold and maintain competence in risk assessment and management appropriate to the populations they serve, and complete Faresay's required training (see §11); - (c) follow the escalation protocol in §5–§6 when risk is identified; - (d) comply with all safeguarding, public-interest-disclosure, and reporting obligations applicable in the UK nation where the Client is located (see Therapist Agreement §6.6); - (e) maintain confidentiality, disclosing only as permitted or required by law or, in the public interest, to protect against serious harm (see §7 and Therapist Agreement §6.5); - (f) document risk, concerns, decisions, and actions contemporaneously in the clinical record (see §9); - (g) carry their own professional indemnity insurance as required by the Therapist Agreement; and - (h) not take on, and promptly escalate/offboard, Clients whose presentation falls within the exclusion criteria (§5).

4.3 Scope of the Therapist's role in crisis. The Therapist is responsible for clinical risk decisions for their own Clients. The Therapist is not expected to provide emergency response in place of statutory emergency services; the appropriate action in an acute emergency is to direct the Client to emergency services and, where duties require and it is safe and lawful, to make contact with emergency or relevant authorities (see §5).

4.4 Availability and limits. Therapists must make their availability and response-time limits clear to Clients (the Platform is not monitored for emergencies; messages are not answered in real time). ⚠️ CLINICAL — define expected message-response windows and how Therapists communicate their boundaries.


5. Client Risk Screening, Ongoing Assessment & Exclusion Criteria

5.1 Screening at onboarding. Before or at the start of the therapeutic relationship, risk-relevant information should be gathered to determine whether the Platform and the matched Therapist are an appropriate setting for the Client. ⚠️ CLINICAL — The Safeguarding/Clinical Lead must define the screening instrument(s), questions, scoring, and decision rules. At minimum, screening should consider current and historical suicidality/self-harm, risk to others, acute psychiatric presentation, substance use, and the Client's location within the UK (for emergency routing and to confirm entitlement to practise — see §8.3).

5.2 Ongoing assessment. Risk is dynamic. Therapists must reassess risk throughout the relationship, in particular at transitions (intake, deterioration, major life events, medication changes, ending of therapy) and whenever risk indicators appear in session or in messages.

5.3 Exclusion criteria — presentations unsuitable for remote, non-urgent therapy. Certain presentations are not suitable for delivery via a remote marketplace that is not monitored in real time and should be excluded or referred to a higher level of care. ⚠️ CLINICAL — the Clinical/Safeguarding Lead must finalise this list; this cross-references and must remain consistent with the suitability/exclusion provisions in the Clinical Governance Policy. Indicative (placeholder) examples to be confirmed: - (a) acute, high, or imminent risk of suicide or serious self-harm requiring crisis or inpatient care; - (b) current intent or plan to seriously harm another person; - (c) acute psychosis, mania, or severe decompensation requiring urgent/specialist or in-person care; - (d) severe substance dependence requiring medically supervised detox/withdrawal; - (e) severe eating disorders with medical instability; - (f) presentations requiring a level of monitoring, frequency, or coordination the Platform cannot safely provide; - (g) [PLACEHOLDER: other criteria to be defined by the Clinical/Safeguarding Lead].

5.4 Action where exclusion criteria apply. Where a Client's presentation meets an exclusion criterion, the Therapist must not continue routine treatment as if the setting were appropriate; instead they must (in line with clinical judgement and §6 escalation): support the Client to access an appropriate level of care, signpost crisis/emergency resources (§8), document the decision (§9), and notify Faresay's Safeguarding Lead where required. ⚠️ CLINICAL / ⚠️ COUNSEL — abandonment risk: ending or declining care must be handled to avoid clinical abandonment and to meet professional/ethical "ending of therapy" standards set by the Therapist's professional body (coordinate with Clinical Governance Policy and Therapist Agreement continuity-of-care provisions).

5.5 Matching and entitlement-to-practise gate. A Therapist must be registered with (or otherwise entitled to practise under) the relevant UK regulator or professional body for the service they provide and must be entitled to practise with Clients located in the United Kingdom. Location is also needed for emergency routing (§8.3). ⚠️ COUNSEL — confirm registration/entitlement verification gates and any nation-specific requirements.


6. Crisis Identification & Step-by-Step Escalation Protocol

⚠️ CLINICAL — This protocol is a structural placeholder. The Clinical/Safeguarding Lead must define the actual clinical decision thresholds, who does what, timeframes, and the relevant local contacts before any operational use. The numbered steps below describe the shape of the process, not validated clinical instructions.

6.1 Identify. A Therapist (or, where a Platform safety signal is triggered, Faresay's Trust & Safety function) identifies indicators of acute risk (§3) — disclosed directly, observed in session, or surfaced via a risk flag (§8.2).

6.2 Assess severity and immediacy. The Therapist assesses whether the risk is: - Imminent / life-threatening (e.g. active attempt in progress, immediate intent and means, immediate danger to a child or another person); or - Elevated but not immediately life-threatening; or - Lower-level / chronic but requiring monitoring and planning. ⚠️ CLINICAL — define indicators and thresholds for each tier.

6.3 Immediate-danger pathway (imminent/life-threatening). - (a) Prioritise getting the Client/affected person to emergency help now: direct them to call emergency services on 999 or, where safe and within the Therapist's lawful authority and professional duty, contact emergency services on their behalf using the Client's location (see §8.3). - (b) Surface and provide crisis resources (§8). - (c) Where a public-interest disclosure or a safeguarding referral is engaged, follow §6.5 / §6.6 / §7. - (d) Stay with / maintain contact to the extent clinically appropriate and possible within the session. - (e) Notify Faresay's Safeguarding Lead / on-call per §6.7 and document per §9. ⚠️ CLINICAL / ⚠️ COUNSEL — Contacting emergency services without consent, and using location data to do so, has clinical, legal, and confidentiality implications; confirm the lawful basis (and see the emergency data-sharing carve-out, §8.4).

6.4 Elevated-risk pathway (not immediately life-threatening). - (a) Conduct/complete a structured risk assessment and collaborative safety plan with the Client. - (b) Signpost crisis resources (§8) and agree what the Client will do if risk escalates. - (c) Consider increased session frequency, coordination with the Client's GP/primary care, the local NHS urgent mental health line, or other providers (with consent where required), and whether exclusion criteria (§5.3) now apply. - (d) Document and, where thresholds are met, escalate to the Safeguarding Lead (§6.7) and follow disclosure/referral duties (§6.6/§7).

6.5 Risk-to-others trigger (public-interest disclosure). Where a Client presents a serious risk of harm to an identifiable third party, the Therapist must consider whether a disclosure of confidential information in the public interest is justified and proportionate to prevent that harm, in line with their professional body's guidance and the framework in §7. The UK has no statutory "duty to warn"; disclosure is generally permissive and a matter of professional judgement, not an automatic statutory obligation. ⚠️ COUNSEL / ⚠️ CLINICAL — confirm the threshold, the appropriate recipient (e.g. police, the at-risk person, GP), and how to record the justification.

6.6 Safeguarding-referral trigger (children / adults at risk). Where information indicates a child or an adult at risk is suffering or at risk of significant harm, the Therapist must follow the UK safeguarding-referral framework applicable in the Client's nation (see §7) — typically a referral to local-authority children's services or adult social care (and, where relevant, the Local Authority Designated Officer (LADO) or the police) — and notify the Safeguarding Lead. ⚠️ COUNSEL / ⚠️ CLINICAL — referral recipients, triggers, and timeframes differ across England, Scotland, Wales, and Northern Ireland.

6.7 Internal escalation to Faresay. In parallel with clinical action, the Therapist notifies Faresay's Safeguarding Lead / on-call contact of a serious incident via [PLACEHOLDER: defined reporting channel — e.g. dedicated email, phone, in-app report], within [PLACEHOLDER: timeframe]. Faresay's role here is supportive and governance-focused (logging, support, pattern detection, learning, regulatory/notification obligations) — not to override the Therapist's clinical decisions for an individual Client. ⚠️ CLINICAL — define the threshold for mandatory internal escalation, the channel, and the timeframe.

6.8 Platform safety signals. Where a Platform feature (e.g. a self-harm keyword flag, §8.2) raises a signal independent of a Therapist, define how Trust & Safety triages it, what is automated vs human-reviewed, and how false positives and Client privacy are handled. ⚠️ CLINICAL / ⚠️ COUNSEL — automated risk detection on sensitive mental-health content carries clinical, false-negative/positive, privacy, and liability risks; confirm before building.


7. Confidentiality, Public-Interest Disclosure & Safeguarding Referrals

7.1 General principle. Client confidentiality is a core duty (see Therapist Agreement §6.5, Privacy Policy). It may be lawfully overridden only where the Client consents, where disclosure is permitted in the public interest to prevent or reduce a risk of serious harm, or where the law requires disclosure. Disclosure should be the minimum necessary to address the risk, made to the appropriate recipient, handled consistently with the Caldicott principles on use of confidential information, and documented (§9).

7.2 Disclosure in the public interest — risk to others. ⚠️ COUNSEL / ⚠️ CLINICAL — The UK has no Tarasoff-style statutory "duty to warn". Where a Client poses a real and serious risk of serious harm to an identifiable third party, a Therapist may, in their professional judgement, disclose confidential information in the public interest to prevent that harm. This is generally permissive (a discretion to be exercised proportionately), not a mandatory statutory duty, and is governed by common-law principles of confidentiality, the data-protection conditions for processing special-category data, and the Therapist's professional-body guidance (e.g. HCPC, BACP, UKCP, BPS) together with ICO guidance on data sharing. The Clinical/Counsel leads must define the threshold ("real and serious risk of serious harm"), who may be told (e.g. police, the at-risk person, GP), how to weigh and record the justification, and how to act proportionately.

7.3 Confidentiality-breach thresholds. ⚠️ COUNSEL / ⚠️ CLINICAL — UK practitioners may disclose confidential information without consent to prevent serious harm, broadly under common-law public-interest disclosure, the data-protection conditions for processing special-category data, and professional-body guidance. Counsel/clinical lead must define the threshold, who may be told, and how to record the justification — and note variation in practice and statutory framework across England, Scotland, Wales, and Northern Ireland.

7.4 Safeguarding referrals — children. ⚠️ COUNSEL / ⚠️ CLINICAL — Where information indicates a child is suffering or at risk of significant harm, the Therapist should make a safeguarding referral to local-authority children's services (and, where relevant, the police or the LADO). The framework rests on the Children Act 1989 and Children Act 2004 and the statutory guidance Working Together to Safeguard Children (England), with corresponding frameworks and statutory guidance in Scotland, Wales, and Northern Ireland. Counsel/clinical lead must specify the recipient, trigger, and timeframe for each UK nation.

7.5 Safeguarding referrals — adults at risk. ⚠️ COUNSEL / ⚠️ CLINICAL — Where an adult with care-and-support needs is experiencing or at risk of abuse or neglect, the Therapist should make a safeguarding referral to local-authority adult social care. The statutory framework differs by nation: Care Act 2014 (England); Adult Support and Protection (Scotland) Act 2007 (Scotland); Social Services and Well-being (Wales) Act 2014 (Wales); and the corresponding adult-safeguarding framework and guidance in Northern Ireland. Specify recipients, triggers, and timeframes per nation.

7.6 Domestic abuse. ⚠️ COUNSEL / ⚠️ CLINICAL — Information-sharing in domestic-abuse contexts is sensitive and nation-specific; disclosure can increase danger to a victim. Define safe practice, lawful basis, and any mandatory elements per nation; do not contact a victim's household or share information in ways that could be intercepted by an abuser.

7.7 Conflict of duties. Where the obligations of the relevant UK nation, the Therapist's registration and professional ethics, and this policy appear to conflict, the Therapist should apply the most protective lawful course and seek guidance from the Safeguarding Lead and, where time permits, their own professional/legal advisers. ⚠️ COUNSEL.


8. Emergency Resources & Safety Features

8.1 Crisis resources to surface. The following resources must be displayed in the surfaces described in §2.2. ⚠️ COUNSEL / ⚠️ CLINICAL — Verify and keep synchronised with Terms of Service §3.

United Kingdom - 999 — for any life-threatening emergency. - NHS 111 — for urgent (non-life-threatening) NHS help, including the NHS 111 urgent mental health option in many areas. - Samaritans — free on 116 123 (24 hours a day). - SHOUT — free 24/7 crisis text support: text 85258. - [PLACEHOLDER: nation- or region-specific resources / local urgent mental health helplines to be confirmed before publication.]

If the Client is outside the United Kingdom, direct them to their local emergency services. ⚠️ CLINICAL — define handling for Clients located outside the supported jurisdiction.

8.2 Risk flags. The Platform may provide features to flag risk (e.g. a Therapist-set risk indicator on a Client record, or detection signals on messages). ⚠️ CLINICAL / ⚠️ COUNSEL — Define what flags exist, who sets/sees them, how they affect care and matching, how privacy is protected, and the risk of automated detection (false positives/negatives). Any automated scanning of clinical/message content must have a confirmed lawful basis and be assessed for clinical safety before deployment.

8.3 Location capture for emergencies. To enable emergency routing (ability to direct or send help to the right place; correct UK nation for safeguarding-referral and public-interest-disclosure purposes), the Platform should capture the Client's location / UK nation. ⚠️ COUNSEL / ⚠️ CLINICAL — Confirm what location data is collected (self-declared nation/area vs precise geolocation), when, lawful basis, retention, and how it is used in an emergency; precise real-time geolocation has significant privacy implications and must be assessed in the DPIA / privacy review (see Privacy Policy and Security & Data Protection Policy).

8.4 Emergency data-sharing carve-out. In a life-at-risk emergency, Faresay and/or the Therapist may need to share limited personal data (e.g. identity, location, contact details, nature of risk) with emergency services or relevant authorities without prior consent to protect the vital interests of the Client or another person. This carve-out must be reflected in, and operated consistently with, the Privacy Policy and the Security & Data Protection Policy. ⚠️ COUNSEL — Confirm the lawful basis (e.g. UK GDPR vital-interests / substantial-public-interest / legal-obligation conditions for special-category data), the minimum-necessary principle, and logging requirements.


9. Documentation & Record of Concerns

9.1 Clinical record. The Therapist must contemporaneously document risk assessments, safety plans, disclosures, decisions (including the reasoning for any public-interest disclosure or safeguarding referral), actions taken, and who was contacted, in the clinical record they own (see Therapist Agreement). ⚠️ CLINICAL — define minimum documentation standards and templates.

9.2 Faresay record of concerns. Faresay should maintain a secure safeguarding incident log / record of concerns capturing reported serious incidents, escalations, and outcomes, accessible only to authorised safeguarding/governance personnel. ⚠️ CLINICAL / ⚠️ COUNSEL — define what Faresay records vs what stays in the clinician's clinical record (to respect the controller/processor split in Privacy Policy §1), access controls, and retention.

9.3 Retention & security. Records of concern are highly sensitive special-category data and must be retained and secured per the Privacy Policy and Security & Data Protection Policy, for the retention period set there. ⚠️ COUNSEL — confirm retention periods under UK law.

9.4 Auditability. Escalations, referrals, and emergency data-sharing decisions should be time-stamped and auditable to support post-incident review (§10) and any regulatory inquiry.


10. Safeguarding Leads, Roles & On-Call Expectations

10.1 Safeguarding Lead. Faresay will designate a Safeguarding Lead (and a Deputy) with defined responsibilities for this policy, incident oversight, escalation support, liaison with authorities where appropriate, and learning. ⚠️ CLINICAL — The Safeguarding Lead should be (or be advised by) a suitably qualified clinical/safeguarding professional. Confirm the required qualification, the appointment, and named contacts. - Safeguarding Lead: [PLACEHOLDER: name / role / contact] - Deputy Safeguarding Lead: [PLACEHOLDER: name / role / contact] - Clinical Lead / Advisor: [PLACEHOLDER: name / role / contact] (see Clinical Governance Policy)

10.2 Trust & Safety function. [PLACEHOLDER: team/role] triages Platform safety signals and non-clinical reports and escalates to the Safeguarding Lead per §6.8.

10.3 On-call expectations. ⚠️ CLINICAL / ⚠️ COUNSEL — Decide and document whether Faresay offers any out-of-hours safeguarding contact, the response-time expectation, and the limits of that contact. Critically: an on-call channel must not be presented to Clients as an emergency or crisis line — doing so would contradict §2 and could create reliance and liability. Any internal on-call is for Therapist/staff escalation and governance, not Client emergency response. Confirm scope, staffing, and SLAs.

10.4 Limits of Faresay's role. Faresay does not provide clinical care, does not supervise the clinical judgement of independent Therapists, and is not a substitute for emergency services. Its safeguarding role is governance, support, logging, learning, and meeting its own legal/regulatory obligations.


11. Therapist Training Requirements

11.1 Required training. Before onboarding and periodically thereafter, Therapists must complete and attest to Faresay's required training on this policy, covering: identifying and assessing the risk types in §3; the escalation protocol (§6); confidentiality and public-interest-disclosure thresholds and UK safeguarding-referral duties (§7); use of Platform safety features (§8); and documentation (§9). ⚠️ CLINICAL — define the curriculum, format, assessment, and refresh cadence.

11.2 Nation-specific knowledge. Therapists must be familiar with the public-interest-disclosure and safeguarding-referral rules of every UK nation in which they hold themselves out to treat Clients. ⚠️ COUNSEL / ⚠️ CLINICAL — Faresay should provide a per-nation reference, but the Therapist remains professionally responsible.

11.3 Competence. Therapists must only accept Clients within their competence and must keep risk-management skills current per their professional body's CPD requirements. ⚠️ CLINICAL.

11.4 Records. Faresay should record training completion and attestations as part of credentialing (see Clinical Governance Policy).


12. Post-Incident Review & Learning

12.1 Review of serious incidents. Serious safeguarding/crisis incidents should be reviewed by the Safeguarding Lead (with the Clinical Lead and, where appropriate, the Therapist) to identify what happened, whether this policy and the escalation protocol were followed, what worked, and what should change. ⚠️ CLINICAL — define what counts as a "serious incident" requiring review, and the review method and timeframe.

12.2 Learning loop. Findings should feed back into training (§11), this policy, the Clinical Governance Policy, screening/exclusion criteria (§5), and Platform safety features (§8). Themes and trends should be reviewed periodically.

12.3 Support & a just culture. Reviews should support a just, learning-oriented culture (supporting Clients, Therapists, and staff affected by a serious incident) rather than being purely punitive, while preserving accountability where standards were not met. ⚠️ CLINICAL.

12.4 External duties. ⚠️ COUNSEL / ⚠️ CLINICAL — Confirm any external reporting/notification duties arising from a serious incident (e.g. to professional bodies and regulators such as the HCPC, BACP, UKCP, BPS, or Social Work England and its devolved equivalents; to the ICO for any associated personal-data breach; or to coroner / procurator-fiscal processes).


13. Review Cadence

13.1 This policy will be reviewed at least annually, and additionally after any serious incident (§12), and after any material change in UK law or professional guidance. ⚠️ CLINICAL / ⚠️ COUNSEL — confirm cadence and owner.

13.2 Owner: [PLACEHOLDER: Safeguarding Lead]. Next review due: [PLACEHOLDER: date].

13.3 Version control. Material changes should be versioned and the "Last updated" date refreshed. This is DRAFT v0.1 and must not be operationalised until validated by a qualified clinical/safeguarding lead and reviewed by counsel.


⚠️ DRAFT v0.1 — Not for operational use. Validate with a qualified clinical/safeguarding lead (⚠️ CLINICAL) and legal counsel (⚠️ COUNSEL) before publication or reliance. Keep crisis resources synchronised with the Terms of Service.

Faresay
Therapy, matched.

UK Security & Data Protection Policy

DRAFT — for professional sign-off Faresay Ltd·24 June 2026

⚠️ DRAFT v0.1 — for security + legal review. NOT legal advice. Must be validated before use. Last updated: [PLACEHOLDER: date]

Faresay UK Security & Data Protection Policy

Faresay operates an online therapy / mental-health marketplace that connects clients with registered mental-health professionals in the United Kingdom. Because the Platform handles mental-health information — among the most sensitive categories of personal data that exist — Faresay applies a correspondingly high standard of security and data protection across its people, processes and technology.

This policy sets out the controls Faresay maintains to protect the confidentiality, integrity and availability of the data it processes. It is written to support Faresay's obligations under the UK GDPR (in particular Article 32 — Security of processing) and the Data Protection Act 2018 (DPA 2018). Clinical data is special-category health data under Article 9 UK GDPR; Faresay is registered with the Information Commissioner's Office (ICO).

This policy should be read alongside the Privacy Policy, the Terms of Service, the Therapist Agreement, and the shared CONTEXT.md fact sheet. It is an internal operational policy; client-facing commitments live in the Privacy Policy.

⚠️ COUNSEL / SECURITY — overarching note. This is a first draft for review. Faresay is bootstrapped and early-stage; several controls below describe a target state rather than a control that is fully implemented today. Each section flags where this is the case. Counsel and a security specialist must validate scope, the UK/EU data-residency and international-transfer model, the controller / processor / joint-controller analysis, and all breach-notification obligations before this policy is relied upon.


1. Purpose & scope

1.1 Purpose

This policy defines how Faresay protects the data it processes, establishes accountability for security and data protection, and demonstrates — for UK GDPR Article 32 — that Faresay implements appropriate technical and organisational measures (TOMs) proportionate to the risk to individuals.

1.2 Scope

This policy applies to: - All Faresay personnel: employees, founders, contractors, and any worker with access to Faresay systems or data. - All Faresay information systems and services, including the marketplace application, supporting infrastructure, code repositories, administrative tooling, and corporate accounts (email, collaboration tools). - All data processed by Faresay, with mental-health data / special-category health data treated as the highest-sensitivity class (Section 2). - Third parties and sub-processors that process Faresay data on Faresay's behalf (Section 9).

1.3 Role boundary

Faresay provides the platform; the clinician provides the clinical service and owns the clinical relationship and clinical record (see CONTEXT.md and the Therapist Agreement). For data-protection purposes: - Faresay is the controller for platform and account data (registration, marketplace activity, payments, platform messaging metadata). - The clinician is the controller for the clinical record they create and hold. - Where Faresay processes clinical data on the clinician's documented instructions, Faresay acts as a processor for that clinician.

The precise split of controller / processor / joint-controller roles — and the data-sharing agreement / DPA between Faresay and clinicians that governs it — is being finalised by counsel and affects which obligations in this policy fall on Faresay versus the clinician. ⚠️ COUNSEL.


2. Data classification

Faresay classifies data so that controls are applied proportionately. Mental-health data is always treated at the highest level.

Class Examples Handling baseline
Class 1 — Highest sensitivity: mental-health data / special-category health data The fact a person is seeking or receiving therapy; intake/assessment information; session-related clinical information and notes; safeguarding/crisis information; messages relating to care. Strict least-privilege access; encryption in transit and at rest; full audit logging; no use in non-production environments; breach-notification regime applies (Section 14).
Class 2 — Confidential Account & identity data; authentication data; payment-related data; clinician registration/verification data; internal financials; security configuration. Role-based access; encryption in transit and at rest; logged access.
Class 3 — Internal Internal documents, non-sensitive operational data. Access limited to personnel; standard controls.
Class 4 — Public Marketing pages, published clinician profile information the clinician has agreed to publish. Integrity controls; no confidentiality requirement.

Notes: - Mental-health data is inherently sensitive. Even the bare fact that an individual is a Faresay client is Class 1 special-category data and must be protected accordingly. - Where Faresay acts as a processor for clinical records, the clinician (as controller) sets the lawful basis and permitted uses; Faresay processes only on documented instructions under a DPA / data-sharing agreement. ⚠️ COUNSEL. - Payment card data: Faresay intends to use a PCI-DSS-compliant payment processor so that Faresay does not store raw card data. [PLACEHOLDER: payment processor]. ⚠️ SECURITY — confirm cardholder-data flows and PCI scope.


3. Governance, roles & responsibilities

3.1 Accountability

Faresay's leadership (founder/management) is ultimately accountable for information security and data protection and for approving this policy.

3.2 Key roles

  • Security Lead — [PLACEHOLDER: named individual]. Owns this policy, the risk treatment plan, vendor security review, incident response coordination, and the security roadmap. In an early-stage bootstrapped company this may initially be a founder; ⚠️ SECURITY — confirm whether a fractional/virtual CISO or external security advisor is engaged.
  • Data Protection point of contact — [PLACEHOLDER: named individual]. Owns DPIAs, records of processing (UK GDPR Art 30), data-subject rights handling, and the ICO relationship. ⚠️ COUNSEL — confirm whether a statutory Data Protection Officer (DPO) is required under UK GDPR Art 37 (likely triggered by large-scale processing of special-category health data) and, if so, appoint a DPO, document the appointment, and notify the ICO of their contact details.
  • All personnel — responsible for following this policy, completing training, reporting incidents promptly, and protecting credentials and devices.

3.3 Decision-making & review

Security risks are tracked in the risk-register.md. Material security decisions, exceptions and accepted risks are recorded with an owner and review date.


4. Access control

4.1 Principles

  • Least privilege — personnel receive the minimum access required for their role; broad/admin access is the exception, justified and time-bound where possible.
  • Role-Based Access Control (RBAC) — access is granted by role, not individually, wherever the platform and tooling support it.
  • Need-to-know for Class 1 data — access to mental-health data is restricted to roles with a genuine operational need and is logged (Section 11).
  • Separation of duties — production access, code-deployment rights and security administration are separated where headcount allows; ⚠️ SECURITY — document compensating controls given small team size.

4.2 Authentication

  • Multi-factor authentication (MFA) is required for all administrative and production-system access, code repositories, the hosting provider, DNS, email, and any system holding Class 1 or Class 2 data.
  • Strong, unique passwords managed via a password manager; no shared accounts for administrative access.
  • ⚠️ SECURITY — adopt SSO with enforced MFA across corporate SaaS where feasible. [PLACEHOLDER: identity provider / SSO].

4.3 Joiner / mover / leaver (JML)

  • Joiner — access provisioned by role on a documented request; principle of least privilege; security onboarding and confidentiality agreement before access to Class 1/Class 2 data.
  • Mover — access reviewed and adjusted on role change; entitlements no longer needed are revoked.
  • Leaver — all access revoked promptly on departure (target: same business day; immediately for involuntary departures); credentials rotated; devices returned/wiped.
  • Periodic access reviews — entitlements (especially to Class 1 data and admin roles) reviewed at least [PLACEHOLDER: quarterly] and stale access removed.

5. Encryption & key management

5.1 In transit

  • TLS (current secure version, [PLACEHOLDER: TLS 1.2+ / 1.3]) enforced for all connections to the Platform and between services. HTTP redirected to HTTPS; HSTS enabled.
  • TLS termination and edge security are provided via Cloudflare (DNS) and Vercel (web hosting) for the marketplace web app. ⚠️ SECURITY — confirm certificate management and that all backend/API and database connections are also encrypted.

5.2 At rest

  • Class 1 and Class 2 data encrypted at rest using strong, industry-standard algorithms (e.g. AES-256). [PLACEHOLDER: database / storage provider and their at-rest encryption].
  • Backups encrypted at rest (Section 13).

5.3 Key management

  • Encryption keys and secrets (API keys, database credentials) managed via a dedicated secrets manager / platform environment-variable store, never committed to source control. [PLACEHOLDER: secrets management solution].
  • Key access restricted, logged, and keys rotated on a defined schedule and on suspected compromise. ⚠️ SECURITY — define key-rotation cadence and ownership.

6. Infrastructure, hosting & data residency

6.1 Known stack (per CONTEXT.md)

  • Marketplace application — the core product.
  • Web hosting: Vercel.
  • DNS: Cloudflare.
  • Application database / backend services / file storage: [PLACEHOLDER: provider(s) — not specified in CONTEXT]. ⚠️ SECURITY — document the full inventory: database, object storage, email, payments, video/session delivery, analytics, error monitoring.

6.2 Data residency & international transfers ⚠️ COUNSEL

  • Preferred residency: personal data — especially Class 1 mental-health data — should be stored and processed in UK or EU regions wherever possible. Vercel and Cloudflare operate globally; region configuration and routing must be verified, since default configurations may route or store data outside the UK/EU. ⚠️ COUNSEL.
  • International transfers: where a processor is not UK-based — note that Clerk (auth), Daily (video) and Resend (email) are US-based — a lawful UK transfer mechanism is required before personal data is transferred. This means a UK International Data Transfer Agreement (IDTA), or EU Standard Contractual Clauses (SCCs) with the UK Addendum, supported by a documented transfer risk assessment (TRA). Reliance on an adequacy regulation, where one applies, should be confirmed in writing. ⚠️ COUNSEL.
  • ⚠️ SECURITY — maintain a data-flow map showing where each data class is stored, processed and transmitted, including sub-processor locations and the transfer mechanism relied on for each non-UK processor.

7. Secure software development lifecycle (SSDLC)

  • Secure by design — security and privacy considered from design; a Data Protection Impact Assessment (DPIA) is completed for high-risk processing of special-category data (UK GDPR Art 35). ⚠️ COUNSEL.
  • Source control & review — code held in version control ([PLACEHOLDER: GitHub/GitLab]); changes via pull request with peer review before merge to production where headcount allows; protected main branch.
  • Secrets hygiene — secret scanning enabled; no credentials in code or logs.
  • Dependency & supply-chain security — automated dependency scanning (e.g. Dependabot/equivalent) and timely patching of vulnerable libraries.
  • Application security — input validation, output encoding, parameterised queries, authentication/authorisation checks, protection against OWASP Top 10 risks.
  • Environment separation — production, staging and development environments separated; production Class 1 data is never used in non-production environments (use synthetic/anonymised test data).
  • CI/CD — automated build, test and deploy pipelines with access controls on deployment. [PLACEHOLDER: CI/CD tooling].
  • ⚠️ SECURITY — formalise security testing (SAST/DAST) in the pipeline as the team matures.

8. (Reserved — see Section 9 for third-party management)

Section intentionally consolidated into Section 9.


9. Third-party & sub-processor management

9.1 Inventory & due diligence

  • Faresay maintains a register of all sub-processors / vendors that process Faresay data, the data classes involved, and their locations. [PLACEHOLDER: sub-processor register].
  • Vendors handling Class 1/Class 2 data are subject to security due diligence proportionate to risk (e.g. SOC 2 / ISO 27001 evidence, security questionnaire).

9.2 Contracts — DPAs and transfer mechanisms ⚠️ COUNSEL

  • A Data Processing Agreement (DPA) compliant with UK GDPR Article 28 is required with every processor handling personal data. The DPA must include the Art 28(3) processor terms (processing only on documented instructions, confidentiality, security, sub-processor controls, assistance with data-subject rights and breaches, deletion/return of data, audit rights).
  • For any processor that is not UK-based (including Clerk, Daily and Resend, which are US-based), a UK transfer mechanism — IDTA, or SCCs with the UK Addendum, plus a transfer risk assessment — is required in addition to the DPA before any personal data is shared (Section 6.2).
  • ⚠️ SECURITY / COUNSEL — confirm that a signed DPA and a valid UK transfer mechanism are in place for each current provider (Vercel, Cloudflare, Clerk, Daily, Resend, and the to-be-confirmed database/payment providers) before transmitting Class 1/Class 2 data to them. Do not transmit Class 1 data to any provider without a signed DPA and, where the provider is non-UK, a valid transfer mechanism.

10. (Reserved)

See Section 11.


11. Logging, monitoring & audit trails

  • Audit logging — access to and changes affecting Class 1 (mental-health) and Class 2 data are logged with user identity, timestamp and action, to support UK GDPR accountability (Art 5(2)) and Article 32 security obligations. ⚠️ SECURITY — confirm application-level audit logging covers reads of clinical data, not just writes.
  • Security monitoring — infrastructure, authentication and application logs collected and reviewed; alerting on suspicious activity (e.g. failed-login spikes, privilege changes). [PLACEHOLDER: logging/monitoring/SIEM tooling].
  • Log protection & retention — logs protected against tampering and unauthorised access, and retained for [PLACEHOLDER: retention period — align with UK GDPR storage limitation and ICO guidance]. ⚠️ COUNSEL.
  • No sensitive data in logs — Class 1 content and secrets must not be written to application logs.

12. Vulnerability management & penetration testing

  • Patch management — operating systems, dependencies and platform components kept up to date; critical vulnerabilities remediated on a defined SLA (target: [PLACEHOLDER: e.g. critical within 7 days]).
  • Vulnerability scanning — regular automated scanning of dependencies and, where applicable, infrastructure.
  • Penetration testing — independent penetration test of the Platform before launch and at least annually / on major change thereafter. [PLACEHOLDER: pentest provider/cadence]. ⚠️ SECURITY.
  • Coordinated disclosure — a channel for reporting vulnerabilities ([PLACEHOLDER: security@ address]) and a triage process.

13. Backup, disaster recovery & business continuity

  • Backups — regular automated backups of production data, encrypted at rest, with backup integrity/restore testing. [PLACEHOLDER: backup solution, frequency, retention].
  • Recovery objectives — defined RPO and RTO: [PLACEHOLDER: RPO/RTO targets]. ⚠️ SECURITY.
  • Disaster recovery — documented procedure to restore service after major failure; reliance on managed providers (Vercel, Cloudflare, and the database provider) is noted, with their resilience/SLA considered.
  • Business continuity — plan for continuity of essential operations (including client safety and crisis pathways — see crisis-safeguarding-policy.md) during disruption. ⚠️ CLINICAL / SECURITY.

14. Incident response & breach notification ⚠️ COUNSEL

14.1 Incident response

  • A documented incident-response process covers detection, triage, containment, eradication, recovery, notification and post-incident review.
  • All personnel must report suspected incidents immediately to the Security Lead. [PLACEHOLDER: reporting channel].
  • Incidents are logged and assessed for severity and for whether a notifiable personal-data breach has occurred.

14.2 Breach notification

  • Where a personal-data breach is likely to result in a risk to individuals' rights and freedoms, Faresay (or the responsible controller) notifies the ICO without undue delay and, where feasible, within 72 hours of becoming aware (UK GDPR Art 33).
  • Where the breach is likely to result in a high risk to individuals, affected individuals are notified without undue delay (UK GDPR Art 34).
  • A record of all personal-data breaches (facts, effects, remedial action) is maintained, whether or not notified to the ICO.
  • ⚠️ COUNSEL — confirm Faresay's notification role given the controller / processor split: where Faresay acts as a processor, it must notify the relevant controller (the clinician) without undue delay rather than the ICO directly; where Faresay is the controller, it notifies the ICO and individuals as above.

15. Personnel security

  • Background checks — pre-engagement screening proportionate to role and access to Class 1 data, subject to UK law (e.g. DBS checks where appropriate). ⚠️ COUNSEL — confirm lawful basis and limits for screening. (Clinician registration/verification is handled separately under the Therapist Agreement and clinical governance.)
  • Confidentiality agreements — all personnel with access to Class 1/Class 2 data sign confidentiality / NDA terms.
  • Security & data-protection training — at onboarding and at least annually, including phishing awareness, UK GDPR fundamentals, and handling of mental-health data.
  • Sanctions — defined consequences for policy violations.

16. Physical security

  • Faresay is a [PLACEHOLDER: remote-first?] organisation relying primarily on cloud-hosted infrastructure; physical data-centre security is inherited from providers (Vercel, Cloudflare, and the database provider) and evidenced via their certifications (e.g. SOC 2 / ISO 27001).
  • Endpoint security — personnel devices accessing Faresay data must use full-disk encryption, screen lock, current OS/security updates, and reputable endpoint protection; lost/stolen devices reported immediately.
  • Workspace — Class 1 data must not be viewed in insecure public settings; clear-screen/clear-desk discipline applies.
  • ⚠️ SECURITY — confirm any office/physical access controls and mobile-device management (MDM). [PLACEHOLDER: MDM solution].

17. Acceptable use

  • Faresay systems and data are used only for authorised business purposes.
  • No sharing of credentials; no exporting or copying Class 1 data outside approved systems; no use of unapproved tools/services (including AI tools) to process Class 1/Class 2 data without authorisation.
  • Personnel must protect devices and credentials, follow this policy, and report security concerns.
  • ⚠️ SECURITY — define an approved-tools list and rules for any AI/LLM tooling that could expose mental-health data.

18. Mapping to UK GDPR Article 32 measures ⚠️ COUNSEL

The following maps this policy to the technical and organisational measures (TOMs) referenced in UK GDPR Article 32. This is a planning aid, not a confirmation of compliance. ⚠️ COUNSEL.

18.1 Pseudonymisation & encryption (Art 32(1)(a))

  • Encryption in transit and at rest; secrets/key management — Section 5.
  • Minimisation and, where appropriate, pseudonymisation/anonymisation of test data — Sections 7, 19.

18.2 Confidentiality, integrity, availability & resilience (Art 32(1)(b))

  • Access control, RBAC, least privilege, MFA — Section 4.
  • Audit logging and integrity controls — Sections 5, 7, 11.
  • Resilience, backups and disaster recovery — Section 13.

18.3 Restore availability after an incident (Art 32(1)(c))

  • Backup, restore testing, RPO/RTO, disaster recovery, business continuity — Section 13.

18.4 Process for testing & evaluating effectiveness (Art 32(1)(d))

  • Vulnerability management and penetration testing — Section 12.
  • Periodic access reviews — Section 4.
  • Policy review and evaluation — Section 21.

18.5 Governance & accountability

  • Roles, risk register, DPIAs, records of processing — Sections 3, 7; risk-register.md.
  • Processor due diligence, DPAs and transfer mechanisms — Section 9.
  • Incident response and breach notification — Section 14.
  • Personnel security, training and confidentiality — Section 15.

⚠️ COUNSEL / SECURITY — a full Article 32 / DPA 2018 gap assessment, DPIA(s), and records-of-processing documentation set must be completed and maintained.


19. Data retention, minimisation & secure disposal

  • Minimisation — Faresay collects and retains only the data necessary for the purposes set out in the Privacy Policy.
  • Retention — data retained per a defined retention schedule. Note that clinical records are typically owned and retained by the clinician under professional/clinical-records rules; Faresay's retention of platform data is separate. [PLACEHOLDER: retention schedule]. ⚠️ COUNSEL / CLINICAL.
  • Secure disposal — data securely deleted/anonymised at end of retention; media sanitised or providers' certified-destruction processes relied upon; backups age out per the backup retention policy.
  • ⚠️ COUNSEL — reconcile retention with UK GDPR storage limitation (Art 5(1)(e)) and clinical-records retention rules, which differ.

20. Alignment to a recognised framework (future goal)

Faresay's security programme is structured to align over time with a recognised framework. As a bootstrapped, early-stage company, formal certification is a future goal rather than a current state. Candidate frameworks: - ISO/IEC 27001 — internationally recognised ISMS certification; strong signal for UK healthtech and clinician trust. - Cyber Essentials / Cyber Essentials Plus — UK government-backed baseline; a pragmatic early target. - SOC 2 (Type II) — useful where enterprise/partner due diligence demands it. - NIST Cybersecurity Framework — useful as a control reference.

⚠️ SECURITY — agree the target framework and a realistic roadmap (likely: Cyber Essentials early, ISO 27001 as the company scales).


21. Policy review cadence

  • This policy is reviewed at least annually and after any major change to systems, processing, regulation, or following a significant incident.
  • The Security Lead owns the review; the Data Protection point of contact and counsel review data-protection and regulatory aspects.
  • Version history and review dates are maintained below.
Version Date Author Notes
v0.1 (DRAFT) [PLACEHOLDER: date] [PLACEHOLDER: author] Initial UK-only draft for security + legal review.

End of draft. ⚠️ This document is a v0.1 draft and must be validated by qualified security and legal professionals, with all [PLACEHOLDER: …] items resolved, before it is relied upon or published.