⚠️ DRAFT v0.1 — for professional sign-off by legal/privacy counsel. NOT legal advice. Counsel must finalise before use. Last updated: [PLACEHOLDER: date]
Faresay Privacy Policy (UK)
Faresay is a B2B SaaS practice portal for therapists. We provide software that an independent therapist uses to run their practice — managing their own client list, scheduling and conducting video sessions, taking payments, and keeping notes. Our customer is the therapist.
This Privacy Policy explains how Faresay handles personal data in the situations where Faresay itself is the data controller — principally, the data we hold about therapists (our customers) and website visitors. It also explains, in plain terms, where Faresay is instead a processor acting on a therapist's behalf, and where you should go in that case.
Two data-protection roles — please read Section 1 carefully. For a therapist's own account, billing, usage and support data, Faresay is the controller and this policy applies. For a therapist's clients' data (including mental-health information), Faresay is a processor acting on the therapist's instructions under a Data Processing Agreement — the therapist is the controller of that data, and a client should refer to their therapist's own privacy notice, not this one.
This policy should be read alongside our Security & Data Protection Policy and, for therapists, the Data Processing Agreement and the SaaS subscription terms. Preparatory material — see also the UK Legal Brief.
1. Who we are & our two data-protection roles ⚠️ COUNSEL
Faresay ("Faresay", "we", "us", "our") provides a practice-portal software product to independent, UK-registered mental-health professionals ("therapists", "clinicians", "you" where you are our customer).
- Controller legal entity: [PLACEHOLDER: registered controller legal name]
- Registered address: [PLACEHOLDER: registered address]
- Company registration number: [PLACEHOLDER: company number]
- ICO registration number: [PLACEHOLDER: ICO registration number]
- Privacy contact: privacy@faresay.com
- Data Protection Officer (if/when appointed): [PLACEHOLDER: DPO name and contact] — see Section 12 and the Security & Data Protection Policy
Faresay holds two distinct data-protection roles, and it matters which one applies to a given piece of data:
1.1 Where Faresay is the CONTROLLER (this policy)
Faresay is the controller of the data it processes for its own business purposes — that is, the data about the therapist (our customer) and about visitors to our website. This includes: - therapist account and identity data; - billing and subscription data; - usage and analytics data about how the portal and website are used; - support and communications data; and - marketing data (where applicable).
Sections 3–14 of this policy describe how we handle that controller data.
1.2 Where Faresay is a PROCESSOR (the therapist is the controller)
When a therapist uses the portal to manage their clients — adding clients, holding intake and session information, conducting sessions, recording notes — Faresay processes that client data on the therapist's documented instructions. For that client data:
- the therapist is the controller;
- Faresay is a processor, governed by a Data Processing Agreement (DPA) under UK GDPR Article 28 (see pp-dpa.md); and
- much of that data is special-category mental-health data (UK GDPR Article 9), which we protect to a correspondingly high standard.
If you are a client of a therapist who uses Faresay: this policy is not the right document for you. Faresay does not decide why or how your data is used — your therapist does. Please refer to your therapist's own privacy notice for information about how your data is handled, and contact your therapist to exercise your rights. Faresay will assist your therapist in responding, as required under the DPA.
⚠️ COUNSEL — confirm the controller / processor mapping above, the precise boundary between Faresay's controller data and the therapist's client data, and that the DPA and SaaS terms reflect these roles consistently. Faresay must not be described as the controller of client clinical data.
2. Scope
This policy applies to Faresay's services as offered in the United Kingdom.
- Faresay's processing of personal data as a controller is governed by the UK GDPR and the Data Protection Act 2018 (DPA 2018), and regulated by the Information Commissioner's Office (ICO).
- Faresay is registered with the ICO and pays the applicable data-protection fee (see Section 1).
This policy covers our website and the practice-portal application (together, the "Portal") insofar as Faresay acts as controller. It does not govern the therapist's processing of their clients' data (Section 1.2), and it does not cover third-party websites or services we link to, which have their own privacy practices.
3. What data we collect (as controller)
We collect the following categories of personal data about therapists and visitors, for which we are the controller.
3.1 Therapist account & identity data
- Name, email address, telephone number, username and password (stored hashed) — authentication is provided via Clerk (Section 5).
- Practice / business name and details (the therapist is typically a sole trader or small business).
- Professional identity and registration details with a relevant professional body (e.g. BACP, UKCP, NCPS, HCPC, BPS or another PSA-accredited register), and any verification information.
- Profile and configuration information the therapist provides about their practice.
3.2 Billing & subscription data
- Subscription plan, billing details and transaction history for the therapist's monthly subscription.
- Records relating to the small card commission we charge on client→therapist payments processed through the Portal.
- Payment is processed by a third-party payment provider; we do not store full card numbers on our own systems. [PLACEHOLDER: confirm exactly what billing data Faresay stores vs. the payment processor.]
3.3 Usage & analytics data
- Pages/screens viewed, features used, and timestamps within the Portal and website.
- Technical data: IP address, device identifiers, browser type, operating system, and log data.
- Website analytics via Plausible — a cookieless, privacy-focused analytics tool (see Section 10).
3.4 Support & communications data
- Messages you send to us (support requests, enquiries) and our responses.
- Feedback, survey responses, and onboarding correspondence.
3.5 Marketing data (where applicable)
- Contact details and preferences for product updates and marketing communications, where you have opted in or where we may lawfully contact you.
We collect this information directly from you (the therapist), automatically through use of the Portal and website, and in some cases from third parties (e.g. our authentication, payment and email providers).
Not covered here: a therapist's clients' personal data (intake, session, clinical-note and mental-health information). Faresay processes that only as a processor on the therapist's instructions under the DPA — see Section 1.2.
4. How and why we use your data, with lawful bases (as controller)
The table below summarises our main purposes and the lawful bases we rely on under UK GDPR for the controller data described in Section 3. Note that, as controller, Faresay does not rely on these bases to process clients' special-category data — that processing sits with the therapist as controller.
⚠️ COUNSEL — the lawful bases below are a first draft and must be confirmed.
| # | Purpose | Data used | UK GDPR Art 6 basis |
|---|---|---|---|
| 1 | Create and manage the therapist's account | Account/identity | Contract (Art 6(1)(b)) |
| 2 | Provide, operate and support the Portal as a SaaS service | Account, usage, support | Contract (Art 6(1)(b)) |
| 3 | Process the subscription and the card commission | Billing, account | Contract (Art 6(1)(b)) / Legal obligation (tax/accounting) |
| 4 | Provide customer support and respond to enquiries | Communications, account | Contract / Legitimate interests (Art 6(1)(f)) |
| 5 | Verify professional registration / eligibility to use the Portal | Account/identity, verification | Legitimate interests / Legal obligation ⚠️ COUNSEL |
| 6 | Security, fraud prevention, and protecting the Portal | Usage, account | Legitimate interests / Legal obligation |
| 7 | Product analytics, service improvement (aggregated where possible) | Usage (minimised) | Legitimate interests |
| 8 | Marketing communications (where permitted) | Account, marketing | Consent / Legitimate interests (with opt-out) |
| 9 | Legal compliance, regulatory and dispute handling | As needed | Legal obligation / Legitimate interests / Art 9(2)(f) for legal claims where relevant |
Where we rely on legitimate interests, we balance our interests against your rights and only proceed where appropriate. Where we rely on consent (e.g. some marketing), you can withdraw it at any time without affecting prior processing.
5. How we share your data (as controller)
We share controller personal data only as described below. Each of these providers acts as a processor or sub-processor for Faresay's controller data under a written contract (Article 28 terms), and is also listed in our Security & Data Protection Policy.
| Provider | Role | Used for |
|---|---|---|
| Clerk (US) | Sub-processor | Authentication / identity for therapist accounts |
| Daily (US) | Sub-processor | Video session delivery within the Portal |
| Resend (US) | Sub-processor | Transactional and account email |
| Neon (US/EU) | Sub-processor | Application database / data storage |
| [PLACEHOLDER: payment provider] | Independent processor / controller | Payment processing, subscription billing, commission |
| Plausible | Processor | Cookieless website analytics |
[PLACEHOLDER: maintain a current sub-processor list / link.]
We may also disclose data where necessary to comply with law, respond to lawful requests, enforce our terms, prevent fraud, or protect rights and safety. If Faresay is involved in a merger, acquisition, financing or sale of assets, personal data may be transferred as part of that transaction, subject to appropriate confidentiality and continued protection.
We do not sell your personal information.
For a therapist's clients' data, sharing is governed by the DPA — Faresay shares it only on the therapist's documented instructions and with the sub-processors listed there.
⚠️ COUNSEL — confirm disclosures match actual data flows and that no health-related data is exposed via website analytics or trackers (note: Plausible is cookieless and does not track individuals across sites).
6. International data transfers ⚠️ COUNSEL
Faresay's preferred residency for personal data is UK or EU regions. However, several of our sub-processors are US-based (notably Clerk, Daily and Resend; Neon offers UK/EU regions which we select where available). Where personal data is transferred outside the UK, we put in place an appropriate safeguard, which may include:
- the UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses (SCCs) with the UK Addendum;
- reliance on an adequacy decision / the UK Extension to the EU–US Data Privacy Framework, where applicable; or
- other lawful transfer mechanisms,
each supported, where required, by a transfer risk assessment (TRA).
⚠️ COUNSEL — finalise the transfer mechanism for each data flow (Clerk, Daily, Resend, Neon and the payment provider), confirm current adequacy / DPF status, select UK/EU hosting regions where available, and ensure the same mechanisms flow down through the DPA for client data.
7. Data retention ⚠️ COUNSEL
We keep controller personal data only for as long as necessary for the purposes in this policy, and to meet legal, regulatory, accounting and dispute-resolution requirements.
- Therapist account & identity data: [PLACEHOLDER: retention period — typically while the account is active plus a defined wind-down period]
- Billing & subscription data: [PLACEHOLDER: retention period, typically driven by tax/accounting law — commonly 6 years]
- Usage, analytics & log data: [PLACEHOLDER: retention period]
- Support & communications data: [PLACEHOLDER: retention period]
- Marketing data: until opt-out / [PLACEHOLDER: period]
When controller data is no longer required, we securely delete or anonymise it.
Retention of a therapist's clients' data is governed by the DPA and the therapist's own clinical-records obligations — Faresay returns or deletes that data on the therapist's instruction or on termination, as the controller directs.
⚠️ COUNSEL — finalise the full retention schedule and reconcile controller retention with the DPA's deletion/return obligations.
8. Security
We implement technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse or alteration, with enhanced controls for the special-category client data we process. These are described in our Security & Data Protection Policy, which this policy incorporates by reference.
No system can be guaranteed 100% secure, but we maintain a security bar appropriate to the sensitivity of the data on the Portal.
9. Your rights (as a therapist / data subject of controller data)
Where Faresay is the controller of your data, and subject to applicable law, you have the right to: - access the personal data we hold about you (a subject access request / DSAR); - request rectification of inaccurate data; - request erasure in certain circumstances; - restrict or object to certain processing; - data portability; - withdraw consent at any time where processing is based on consent; and - not be subject to solely automated decisions with legal/similarly significant effects.
To exercise these rights, contact privacy@faresay.com. We respond within the timeframes required by law — generally within one month (extendable in limited circumstances).
If you are a client of a therapist: to exercise rights over your data, contact your therapist (the controller), not Faresay. Faresay will assist the therapist in responding, as required by the DPA.
10. Cookies & analytics
We aim to keep tracking minimal.
- Strictly necessary cookies are required for the Portal to function (e.g. authentication/session via Clerk, security).
- Analytics: we use Plausible, a privacy-focused, cookieless analytics tool. Plausible does not use cookies, does not collect personal data for cross-site tracking, and does not require a consent banner for analytics in the way cookie-based trackers do.
- We do not use advertising trackers or sell analytics data.
⚠️ COUNSEL — confirm the cookie inventory (including any set by Clerk) and that any non-essential cookies have an appropriate consent mechanism under PECR. [PLACEHOLDER: link to detailed cookie notice if required.]
11. Automated decision-making
Faresay does not make decisions producing legal or similarly significant effects about you based solely on automated processing without human involvement. Clinical decisions are made by the therapist, not by Faresay.
⚠️ COUNSEL — confirm this remains accurate as features evolve.
12. Data breaches
We maintain procedures to detect, investigate and respond to personal-data breaches.
- For controller data (therapist/visitor), where a breach is likely to result in a risk to rights and freedoms, we notify the ICO without undue delay and, where feasible, within 72 hours (UK GDPR Art 33), and notify affected individuals where there is a high risk (Art 34).
- For a therapist's client data, where Faresay is the processor, we notify the controller (the therapist) without undue delay so they can meet their own notification obligations.
Our incident-response approach is detailed in the Security & Data Protection Policy.
13. How to complain ⚠️ COUNSEL
If you have a concern about how Faresay handles your controller data, please contact us first at privacy@faresay.com so we can try to resolve it.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) — https://ico.org.uk.
Concerns about how a therapist handles client data should be raised with the therapist (the controller) in the first instance; the client retains their right to complain to the ICO.
If you need urgent help. This policy is about data protection, not crisis support. If you or someone else is in immediate danger, call 999. For mental-health support you can also contact the Samaritans on 116 123, NHS 111, or the SHOUT text service by texting 85258.
14. Contact & updates
Privacy / data-protection contact: privacy@faresay.com — [PLACEHOLDER: postal address] Data Protection Officer (if appointed): [PLACEHOLDER: DPO name and contact]
We may update this Privacy Policy from time to time. We will post the updated version with a revised "Last updated" date and, where changes are material, take additional steps to notify you as required by law.
This is a DRAFT document prepared for professional sign-off by qualified UK legal/privacy counsel. It is not legal advice and must be reviewed and finalised before publication or use. Resolve all [PLACEHOLDER: …] items and ⚠️ flags first.