> ⚠️ DRAFT v0.1 — for professional sign-off by legal/privacy counsel. NOT legal advice. Counsel must finalise before use. Last updated: [PLACEHOLDER: date]

# Faresay Privacy Policy (UK)

Faresay is a **B2B SaaS practice portal** for therapists. We provide software that an independent therapist uses to run their practice — managing their own client list, scheduling and conducting video sessions, taking payments, and keeping notes. **Our customer is the therapist.**

This Privacy Policy explains how Faresay handles personal data **in the situations where Faresay itself is the data controller** — principally, the data we hold about **therapists** (our customers) and **website visitors**. It also explains, in plain terms, where Faresay is instead a **processor** acting on a therapist's behalf, and where you should go in that case.

> **Two data-protection roles — please read Section 1 carefully.** For a therapist's own account, billing, usage and support data, **Faresay is the controller** and this policy applies. For a therapist's **clients'** data (including mental-health information), **Faresay is a processor** acting on the therapist's instructions under a Data Processing Agreement — the **therapist is the controller** of that data, and a client should refer to **their therapist's own privacy notice**, not this one.

> This policy should be read alongside our [Security & Data Protection Policy](pp-security-data-protection-policy.md) and, for therapists, the [Data Processing Agreement](pp-dpa.md) and the SaaS subscription terms. Preparatory material — see also the [UK Legal Brief](pp-uk-legal-brief.md).

---

## 1. Who we are & our two data-protection roles ⚠️ COUNSEL

**Faresay** ("Faresay", "we", "us", "our") provides a practice-portal software product to independent, UK-registered mental-health professionals ("therapists", "clinicians", "you" where you are our customer).

- **Controller legal entity:** [PLACEHOLDER: registered controller legal name]
- **Registered address:** [PLACEHOLDER: registered address]
- **Company registration number:** [PLACEHOLDER: company number]
- **ICO registration number:** [PLACEHOLDER: ICO registration number]
- **Privacy contact:** privacy@faresay.com
- **Data Protection Officer (if/when appointed):** [PLACEHOLDER: DPO name and contact] — see Section 12 and the [Security & Data Protection Policy](pp-security-data-protection-policy.md)

Faresay holds **two distinct data-protection roles**, and it matters which one applies to a given piece of data:

### 1.1 Where Faresay is the CONTROLLER (this policy)
Faresay is the **controller** of the data it processes for its own business purposes — that is, the data **about the therapist** (our customer) and about **visitors to our website**. This includes:
- therapist **account and identity** data;
- **billing and subscription** data;
- **usage and analytics** data about how the portal and website are used;
- **support and communications** data; and
- **marketing** data (where applicable).

Sections 3–14 of this policy describe how we handle that controller data.

### 1.2 Where Faresay is a PROCESSOR (the therapist is the controller)
When a therapist uses the portal to manage **their clients** — adding clients, holding intake and session information, conducting sessions, recording notes — Faresay processes that **client data on the therapist's documented instructions**. For that client data:

- the **therapist is the controller**;
- **Faresay is a processor**, governed by a **Data Processing Agreement (DPA)** under UK GDPR Article 28 (see [pp-dpa.md](pp-dpa.md)); and
- much of that data is **special-category mental-health data** (UK GDPR Article 9), which we protect to a correspondingly high standard.

**If you are a client of a therapist who uses Faresay:** this policy is **not** the right document for you. Faresay does not decide why or how your data is used — your therapist does. Please refer to **your therapist's own privacy notice** for information about how your data is handled, and contact your therapist to exercise your rights. Faresay will assist your therapist in responding, as required under the DPA.

⚠️ **COUNSEL** — confirm the controller / processor mapping above, the precise boundary between Faresay's controller data and the therapist's client data, and that the DPA and SaaS terms reflect these roles consistently. Faresay must **not** be described as the controller of client clinical data.

---

## 2. Scope

This policy applies to Faresay's services as offered in the **United Kingdom**.

- Faresay's processing of personal data **as a controller** is governed by the **UK GDPR** and the **Data Protection Act 2018 (DPA 2018)**, and regulated by the **Information Commissioner's Office (ICO)**.
- Faresay is registered with the ICO and pays the applicable data-protection fee (see Section 1).

This policy covers our website and the practice-portal application (together, the "Portal") **insofar as Faresay acts as controller**. It does **not** govern the therapist's processing of their clients' data (Section 1.2), and it does **not** cover third-party websites or services we link to, which have their own privacy practices.

---

## 3. What data we collect (as controller)

We collect the following categories of personal data **about therapists and visitors**, for which we are the controller.

### 3.1 Therapist account & identity data
- Name, email address, telephone number, username and password (stored hashed) — authentication is provided via Clerk (Section 5).
- Practice / business name and details (the therapist is typically a sole trader or small business).
- Professional identity and registration details with a relevant professional body (e.g. BACP, UKCP, NCPS, HCPC, BPS or another PSA-accredited register), and any verification information.
- Profile and configuration information the therapist provides about their practice.

### 3.2 Billing & subscription data
- Subscription plan, billing details and transaction history for the therapist's **monthly subscription**.
- Records relating to the **small card commission** we charge on client→therapist payments processed through the Portal.
- Payment is processed by a third-party payment provider; we do **not** store full card numbers on our own systems. [PLACEHOLDER: confirm exactly what billing data Faresay stores vs. the payment processor.]

### 3.3 Usage & analytics data
- Pages/screens viewed, features used, and timestamps within the Portal and website.
- Technical data: IP address, device identifiers, browser type, operating system, and log data.
- Website analytics via **Plausible** — a cookieless, privacy-focused analytics tool (see Section 10).

### 3.4 Support & communications data
- Messages you send to us (support requests, enquiries) and our responses.
- Feedback, survey responses, and onboarding correspondence.

### 3.5 Marketing data (where applicable)
- Contact details and preferences for product updates and marketing communications, where you have opted in or where we may lawfully contact you.

We collect this information directly from you (the therapist), automatically through use of the Portal and website, and in some cases from third parties (e.g. our authentication, payment and email providers).

> **Not covered here:** a therapist's **clients'** personal data (intake, session, clinical-note and mental-health information). Faresay processes that only as a **processor** on the therapist's instructions under the [DPA](pp-dpa.md) — see Section 1.2.

---

## 4. How and why we use your data, with lawful bases (as controller)

The table below summarises our main purposes and the **lawful bases** we rely on under UK GDPR for the **controller** data described in Section 3. Note that, as controller, Faresay does **not** rely on these bases to process clients' special-category data — that processing sits with the therapist as controller.

⚠️ **COUNSEL** — the lawful bases below are a first draft and must be confirmed.

| # | Purpose | Data used | UK GDPR Art 6 basis |
|---|---------|-----------|---------------------|
| 1 | Create and manage the therapist's account | Account/identity | Contract (Art 6(1)(b)) |
| 2 | Provide, operate and support the Portal as a SaaS service | Account, usage, support | Contract (Art 6(1)(b)) |
| 3 | Process the subscription and the card commission | Billing, account | Contract (Art 6(1)(b)) / Legal obligation (tax/accounting) |
| 4 | Provide customer support and respond to enquiries | Communications, account | Contract / Legitimate interests (Art 6(1)(f)) |
| 5 | Verify professional registration / eligibility to use the Portal | Account/identity, verification | Legitimate interests / Legal obligation ⚠️ COUNSEL |
| 6 | Security, fraud prevention, and protecting the Portal | Usage, account | Legitimate interests / Legal obligation |
| 7 | Product analytics, service improvement (aggregated where possible) | Usage (minimised) | Legitimate interests |
| 8 | Marketing communications (where permitted) | Account, marketing | Consent / Legitimate interests (with opt-out) |
| 9 | Legal compliance, regulatory and dispute handling | As needed | Legal obligation / Legitimate interests / Art 9(2)(f) for legal claims where relevant |

Where we rely on **legitimate interests**, we balance our interests against your rights and only proceed where appropriate. Where we rely on **consent** (e.g. some marketing), you can withdraw it at any time without affecting prior processing.

---

## 5. How we share your data (as controller)

We share **controller** personal data only as described below. Each of these providers acts as a **processor or sub-processor** for Faresay's controller data under a written contract (Article 28 terms), and is also listed in our [Security & Data Protection Policy](pp-security-data-protection-policy.md).

| Provider | Role | Used for |
|---|---|---|
| **Clerk** (US) | Sub-processor | Authentication / identity for therapist accounts |
| **Daily** (US) | Sub-processor | Video session delivery within the Portal |
| **Resend** (US) | Sub-processor | Transactional and account email |
| **Neon** (US/EU) | Sub-processor | Application database / data storage |
| **[PLACEHOLDER: payment provider]** | Independent processor / controller | Payment processing, subscription billing, commission |
| **Plausible** | Processor | Cookieless website analytics |

[PLACEHOLDER: maintain a current sub-processor list / link.]

We may also disclose data where necessary to **comply with law**, respond to lawful requests, enforce our terms, prevent fraud, or protect rights and safety. If Faresay is involved in a **merger, acquisition, financing or sale of assets**, personal data may be transferred as part of that transaction, subject to appropriate confidentiality and continued protection.

We do **not** sell your personal information.

> For a therapist's **clients' data**, sharing is governed by the [DPA](pp-dpa.md) — Faresay shares it only on the therapist's documented instructions and with the sub-processors listed there.

⚠️ **COUNSEL** — confirm disclosures match actual data flows and that no health-related data is exposed via website analytics or trackers (note: Plausible is cookieless and does not track individuals across sites).

---

## 6. International data transfers ⚠️ COUNSEL

Faresay's preferred residency for personal data is **UK or EU regions**. However, several of our sub-processors are **US-based** (notably **Clerk**, **Daily** and **Resend**; **Neon** offers UK/EU regions which we select where available). Where personal data is transferred outside the UK, we put in place an appropriate safeguard, which may include:

- the **UK International Data Transfer Agreement (IDTA)**, or the **EU Standard Contractual Clauses (SCCs)** with the **UK Addendum**;
- reliance on an **adequacy** decision / the **UK Extension to the EU–US Data Privacy Framework**, where applicable; or
- other lawful transfer mechanisms,

each supported, where required, by a **transfer risk assessment (TRA)**.

⚠️ **COUNSEL** — finalise the transfer mechanism for each data flow (Clerk, Daily, Resend, Neon and the payment provider), confirm current adequacy / DPF status, select UK/EU hosting regions where available, and ensure the same mechanisms flow down through the [DPA](pp-dpa.md) for client data.

---

## 7. Data retention ⚠️ COUNSEL

We keep **controller** personal data only for as long as necessary for the purposes in this policy, and to meet legal, regulatory, accounting and dispute-resolution requirements.

- Therapist account & identity data: [PLACEHOLDER: retention period — typically while the account is active plus a defined wind-down period]
- Billing & subscription data: [PLACEHOLDER: retention period, typically driven by tax/accounting law — commonly 6 years]
- Usage, analytics & log data: [PLACEHOLDER: retention period]
- Support & communications data: [PLACEHOLDER: retention period]
- Marketing data: until opt-out / [PLACEHOLDER: period]

When controller data is no longer required, we securely delete or anonymise it.

> Retention of a therapist's **clients' data** is governed by the [DPA](pp-dpa.md) and the therapist's own clinical-records obligations — Faresay returns or deletes that data on the therapist's instruction or on termination, as the controller directs.

⚠️ **COUNSEL** — finalise the full retention schedule and reconcile controller retention with the DPA's deletion/return obligations.

---

## 8. Security

We implement technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse or alteration, with enhanced controls for the special-category client data we process. These are described in our **[Security & Data Protection Policy](pp-security-data-protection-policy.md)**, which this policy incorporates by reference.

No system can be guaranteed 100% secure, but we maintain a security bar appropriate to the sensitivity of the data on the Portal.

---

## 9. Your rights (as a therapist / data subject of controller data)

Where Faresay is the **controller** of your data, and subject to applicable law, you have the right to:
- **access** the personal data we hold about you (a subject access request / DSAR);
- request **rectification** of inaccurate data;
- request **erasure** in certain circumstances;
- **restrict** or **object** to certain processing;
- **data portability**;
- **withdraw consent** at any time where processing is based on consent; and
- not be subject to solely automated decisions with legal/similarly significant effects.

To exercise these rights, contact **privacy@faresay.com**. We respond within the timeframes required by law — generally **within one month** (extendable in limited circumstances).

> **If you are a client of a therapist:** to exercise rights over **your** data, contact **your therapist** (the controller), not Faresay. Faresay will assist the therapist in responding, as required by the [DPA](pp-dpa.md).

---

## 10. Cookies & analytics

We aim to keep tracking minimal.

- **Strictly necessary** cookies are required for the Portal to function (e.g. authentication/session via Clerk, security).
- **Analytics:** we use **Plausible**, a **privacy-focused, cookieless** analytics tool. Plausible does not use cookies, does not collect personal data for cross-site tracking, and does not require a consent banner for analytics in the way cookie-based trackers do.
- We do **not** use advertising trackers or sell analytics data.

⚠️ **COUNSEL** — confirm the cookie inventory (including any set by Clerk) and that any non-essential cookies have an appropriate consent mechanism under PECR. [PLACEHOLDER: link to detailed cookie notice if required.]

---

## 11. Automated decision-making

Faresay does **not** make decisions producing legal or similarly significant effects about you based **solely** on automated processing without human involvement. Clinical decisions are made by the **therapist**, not by Faresay.

⚠️ **COUNSEL** — confirm this remains accurate as features evolve.

---

## 12. Data breaches

We maintain procedures to detect, investigate and respond to personal-data breaches.

- For **controller** data (therapist/visitor), where a breach is likely to result in a risk to rights and freedoms, we notify the **ICO without undue delay and, where feasible, within 72 hours** (UK GDPR Art 33), and notify affected individuals where there is a high risk (Art 34).
- For a therapist's **client data**, where Faresay is the **processor**, we notify the **controller (the therapist)** without undue delay so they can meet their own notification obligations.

Our incident-response approach is detailed in the [Security & Data Protection Policy](pp-security-data-protection-policy.md).

---

## 13. How to complain ⚠️ COUNSEL

If you have a concern about how Faresay handles your **controller** data, please contact us first at **privacy@faresay.com** so we can try to resolve it.

You also have the right to lodge a complaint with the **Information Commissioner's Office (ICO)** — https://ico.org.uk.

> Concerns about how a **therapist** handles **client** data should be raised with the therapist (the controller) in the first instance; the client retains their right to complain to the ICO.

**If you need urgent help.** This policy is about data protection, not crisis support. If you or someone else is in immediate danger, call **999**. For mental-health support you can also contact the **Samaritans** on **116 123**, **NHS 111**, or the **SHOUT** text service by texting **85258**.

---

## 14. Contact & updates

**Privacy / data-protection contact:** privacy@faresay.com — [PLACEHOLDER: postal address]
**Data Protection Officer (if appointed):** [PLACEHOLDER: DPO name and contact]

We may update this Privacy Policy from time to time. We will post the updated version with a revised "Last updated" date and, where changes are material, take additional steps to notify you as required by law.

---

*This is a DRAFT document prepared for professional sign-off by qualified UK legal/privacy counsel. It is not legal advice and must be reviewed and finalised before publication or use. Resolve all `[PLACEHOLDER: …]` items and `⚠️` flags first.*