⚠️ DRAFT v0.1 — for legal/privacy counsel review. NOT legal advice. Counsel must finalise before use. Last updated: [PLACEHOLDER: date]

Faresay Privacy Policy

Faresay operates an online therapy / mental-health marketplace that connects clients with licensed mental-health professionals. This Privacy Policy explains how we collect, use, share and protect your personal information, and the rights you have over it.

Because Faresay is a mental-health service, much of the information we handle is special-category / sensitive health data. We treat this information with a correspondingly high standard of confidentiality and security. Please read this policy carefully.

This policy should be read alongside our Terms of Service, our Security & Data Protection Policy, and (where applicable) the separate clinician-provided privacy notices and any HIPAA Notice of Privacy Practices (see Section 16).

1. Who we are & data controller ⚠️ COUNSEL

Faresay ("Faresay", "we", "us", "our") provides the technology platform through which clients discover, book and pay for sessions with independent licensed mental-health professionals ("therapists" or "clinicians").

Controller legal entity: [PLACEHOLDER: registered controller legal name]
Registered address: [PLACEHOLDER: registered address]
Company registration number: [PLACEHOLDER: company number]
ICO registration number (UK): [PLACEHOLDER: ICO registration number]
Data Protection Officer / privacy contact: [PLACEHOLDER: DPO or privacy contact name and email]

⚠️ COUNSEL — controller vs processor / joint-controller mapping. Faresay provides the platform; the clinician provides the clinical service and owns the clinical relationship and clinical record (see [CONTEXT.md] / Therapist Agreement). The respective data-protection roles must be confirmed: - For account, marketplace, payment, device and usage data, Faresay is likely the controller. - For clinical / session-note data created by the clinician, the clinician may be the independent controller (with Faresay acting as processor, or as joint controller for certain activities), and in the US the clinician may be the covered entity with Faresay a business associate. - Counsel must finalise the controller / processor / joint-controller analysis (UK/EU) and the covered-entity / business-associate analysis (US HIPAA), and ensure the resulting roles are reflected consistently across this policy, the Terms, the Therapist Agreement and any Business Associate Agreements (BAAs) and Data Processing Agreements (DPAs).

2. Scope (UK + US)

This policy currently applies to Faresay's services as offered in the United Kingdom, and is being prepared to also cover Faresay's planned expansion into the United States (all 50 states + DC).

United Kingdom (now): governed by the UK GDPR and the Data Protection Act 2018.
United States (planned expansion): governed by HIPAA (where applicable) and applicable US state privacy and consumer-health-data laws (e.g. California CCPA/CPRA, Washington My Health My Data Act, and other state comprehensive privacy laws).

⚠️ COUNSEL — Until the US service launches, US-specific provisions in this policy are forward-looking and must be confirmed and finalised before any US-facing version is published. Some jurisdictions may require a separate or supplemented notice.

This policy covers our website, web and mobile applications, and related services (together, the "Platform"). It does not cover third-party websites or services we link to, which have their own privacy practices.

3. What data we collect

We collect the following categories of personal information.

3.1 Account & identity data

Name, email address, telephone number, username and password (stored hashed).
Date of birth / age confirmation.
Country, state/region and (where relevant) address or location.
Profile information you provide.
For clinicians: professional identity, licence/registration details, qualifications, jurisdictions of licensure, and verification information.

3.2 Health & special-category data ⚠️ COUNSEL

This is the most sensitive information we handle. It may include: - The fact that you are seeking or receiving mental-health support (itself sensitive health data). - Intake / assessment information, presenting concerns, symptoms, history and goals. - Session-related clinical information and notes (typically created and held by your clinician — see Section 1). - Messages and communications relating to your care. - Any health, disability, or other special-category information you choose to share.

Under UK GDPR this is special-category data (Article 9). In the US it is likely protected health information (PHI) under HIPAA and/or consumer health data under state laws such as the Washington My Health My Data Act. We apply a high confidentiality and security bar to all such data.

⚠️ COUNSEL — confirm the precise boundary between data Faresay processes and clinical-record data the clinician controls, and ensure consent / authorisation mechanisms meet both UK GDPR Article 9 and US HIPAA / state consumer-health-data requirements (including, where required, separate valid consent for collection, use and sharing of consumer health data).

3.3 Payment data

Billing details and transaction history.
Payment is processed by third-party payment providers; we do not store full card numbers on our own systems. [PLACEHOLDER: confirm exactly what payment data Faresay stores vs. what the payment processor stores.]

3.4 Device & usage data

IP address, device identifiers, browser type, operating system.
Log data, pages/screens viewed, features used, and timestamps.
Approximate location derived from IP address.
Cookies and similar technologies (see Section 11).

3.5 Communications data

Messages you send to us (support, enquiries) and, where applicable, in-platform messages with clinicians.
Records of your communications with our support team.
Feedback, reviews and survey responses.

We collect this information directly from you, automatically through your use of the Platform, and in some cases from third parties (e.g. clinicians regarding your bookings, identity/licence verification providers regarding clinicians, and payment providers regarding transactions).

4. How and why we use your data, with legal bases

The table below summarises our main purposes and the legal bases we rely on under UK GDPR. For health / special-category data we identify both an Article 6 basis and an Article 9 condition.

⚠️ COUNSEL — the legal bases below are a first draft and must be confirmed. In particular, the Article 9 condition for health data and the US legal basis (HIPAA treatment/payment/healthcare-operations and any required authorisations, plus state-law consent requirements) must be finalised by counsel.

#	Purpose	Data used	UK GDPR Art 6 basis	UK GDPR Art 9 condition (health data)
1	Create and manage your account	Account/identity	Contract (Art 6(1)(b))	n/a
2	Match you with clinicians and enable booking/scheduling	Account/identity, limited health context	Contract (Art 6(1)(b))	⚠️ COUNSEL — likely Art 9(2)(h) (health/social care) or explicit consent Art 9(2)(a)
3	Facilitate the provision of mental-health care via clinicians	Health & special-category	Contract / Legitimate interests	⚠️ COUNSEL — Art 9(2)(h) provision of health care, and/or Art 9(2)(a) explicit consent
4	Process payments and operate the 15% platform fee	Payment, account	Contract (Art 6(1)(b))	n/a
5	Provide support and respond to enquiries	Communications, account	Contract / Legitimate interests	Art 9(2)(a) / 9(2)(h) where health data is involved ⚠️ COUNSEL
6	Safety, safeguarding and crisis response	Health, communications	Legitimate interests / Legal obligation / Vital interests	⚠️ COUNSEL — Art 9(2)(c) vital interests and/or 9(2)(h); see Crisis & Safeguarding Policy
7	Security, fraud prevention, and protecting the Platform	Device/usage, account	Legitimate interests / Legal obligation	n/a
8	Service improvement and analytics	Device/usage (minimised/aggregated where possible)	Legitimate interests	⚠️ COUNSEL — avoid using health data for analytics without an appropriate condition
9	Marketing communications (where permitted)	Account, usage	Consent / Legitimate interests	n/a
10	Legal compliance, regulatory and dispute handling	As needed	Legal obligation / Legitimate interests	Art 9(2)(f) legal claims; 9(2)(g)/(h) as applicable ⚠️ COUNSEL

US legal basis ⚠️ COUNSEL. Where HIPAA applies, uses and disclosures of PHI will be made for treatment, payment and healthcare operations and otherwise as permitted or required by HIPAA, with patient authorisation obtained where required. State consumer-health-data laws (e.g. Washington MHMDA) may require separate, specific consent for the collection and sharing of consumer health data. Counsel must confirm the HIPAA basis, Faresay's covered-entity vs business-associate status, and the required state-law consents before US launch.

We will not use your special-category health data for a new, incompatible purpose without identifying an appropriate lawful basis and, where required, obtaining your explicit consent.

We share personal information only as described below.

Therapists / clinicians. To enable and deliver your care, relevant information is shared with the clinician you book or are matched with. The clinician is an independent professional responsible for the clinical relationship and clinical record (see Section 1).
Service providers / processors & sub-processors. We use third-party providers to host, operate and support the Platform (e.g. cloud hosting, communications, analytics, identity/licence verification, customer support). They process data on our instructions under written contracts (DPAs, and BAAs where HIPAA applies). [PLACEHOLDER: sub-processor list / link to sub-processor list.]
Payment providers. Payment processors handle transactions and operate under their own privacy notices. [PLACEHOLDER: name(s) of payment provider(s).]
Legal & safety. We may disclose information where necessary to comply with law, respond to lawful requests, enforce our Terms, prevent fraud, or protect the rights, safety and vital interests of you or others (including in safeguarding / crisis situations — see Crisis & Safeguarding Policy).
Business transfers. If Faresay is involved in a merger, acquisition, financing or sale of assets, personal information may be transferred as part of that transaction, subject to appropriate confidentiality and continued protection of your data.

We do not sell your personal information. ⚠️ COUNSEL — confirm "sale"/"share" definitions under CCPA/CPRA and "sale" of consumer health data under MHMDA, and ensure our disclosures and any required opt-out mechanisms match actual data flows (including any analytics/advertising trackers).

6. International data transfers ⚠️ COUNSEL

Faresay is based in the UK and plans to operate in the US, and some of our service providers may process data outside the UK/EEA (including in the US). Where we transfer personal data internationally, we will put in place an appropriate safeguard, which may include:

UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs);
EU Standard Contractual Clauses for EEA-origin transfers;
reliance on an adequacy decision / the UK Extension to the EU–US Data Privacy Framework, where applicable; or
other lawful transfer mechanisms.

⚠️ COUNSEL — finalise the transfer mechanism(s) for each data flow (UK/EU → US in particular), confirm current adequacy / Data Privacy Framework status, and complete transfer risk assessments (TRAs / TIAs) where required. Given the sensitivity of mental-health data, transfer safeguards warrant particular scrutiny.

7. Data retention ⚠️ COUNSEL

We keep personal information only for as long as necessary for the purposes set out in this policy, and to meet legal, regulatory, accounting, clinical-record and dispute-resolution requirements.

Account & identity data: [PLACEHOLDER: retention period]
Health & clinical-record data: [PLACEHOLDER: retention period] ⚠️ COUNSEL — clinical-record retention is governed by professional/clinical standards and law (and may differ between UK and US, and by state). Confirm who (Faresay vs clinician) is responsible for retaining clinical records and for how long.
Payment & transaction data: [PLACEHOLDER: retention period, typically driven by tax/accounting law]
Device, usage & log data: [PLACEHOLDER: retention period]
Communications & support data: [PLACEHOLDER: retention period]

When data is no longer required, we will securely delete or anonymise it. ⚠️ COUNSEL — finalise the full retention schedule and reconcile it with clinical-record obligations and US state law.

8. Security

We implement technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse or alteration, with enhanced controls for sensitive health data. These measures are described in our Security & Data Protection Policy, which this policy incorporates by reference.

No system can be guaranteed 100% secure, but we maintain a high security bar appropriate to the sensitivity of mental-health data.

9. Your rights

9.1 UK / EU data-subject rights

Subject to applicable law, you have the right to: - access the personal data we hold about you; - request rectification of inaccurate data; - request erasure ("right to be forgotten") in certain circumstances; - restrict or object to certain processing; - data portability; - withdraw consent at any time where processing is based on consent (without affecting prior processing); and - not be subject to solely automated decisions with legal/similarly significant effects (see Section 13).

To exercise these rights, contact us using the details in Section 17. We will respond within the timeframes required by law. ⚠️ COUNSEL — note that some rights (e.g. erasure) may be limited where data forms part of a clinical record or must be retained for legal/regulatory reasons.

9.2 US state rights ⚠️ COUNSEL

Depending on your state of residence and applicable law, you may have rights including to know/access, delete, correct, opt out of sale/share/targeted advertising, data portability, and to non-discrimination for exercising your rights.

California (CCPA/CPRA): rights to know, delete, correct, opt out of sale/sharing, and limit use of sensitive personal information.
Washington My Health My Data Act: specific consumer-health-data rights, including the right to withdraw consent, to access, and to delete consumer health data, and protections requiring consent for collection and sharing.
Other state comprehensive privacy laws: [PLACEHOLDER: list applicable states and rights as US footprint is confirmed].

⚠️ COUNSEL — finalise the full list of US state rights, the request/verification and appeal mechanisms, response timeframes, authorised-agent handling, and any required "Your Privacy Choices" / opt-out links before US launch. Where HIPAA applies, individual rights over PHI are governed by HIPAA and the separate Notice of Privacy Practices (Section 16).

10. Cookies & tracking

We use cookies and similar technologies to operate the Platform, remember your preferences, keep you signed in, maintain security, and understand and improve how the Platform is used.

Strictly necessary cookies are required for the Platform to function.
Analytics / performance and functional cookies are used [PLACEHOLDER: confirm categories and providers].
We will obtain consent for non-essential cookies where required (e.g. under PECR / UK law), and provide controls to manage your preferences.

⚠️ COUNSEL — given the sensitivity of mental-health data, scrutinise any third-party trackers/SDKs (especially advertising/analytics) for potential disclosure of health-related data; certain trackers on a health service may trigger HIPAA and state consumer-health-data restrictions. Confirm the cookie banner/consent mechanism. [PLACEHOLDER: link to detailed cookie notice / preference centre.]

11. Children's data

The Platform is intended for adults. [PLACEHOLDER: confirm minimum age — e.g. 18, or 16/13 with conditions, and whether services to minors are offered at all.]

We do not knowingly collect personal information from children below the applicable age without appropriate consent/authorisation. If you believe a child has provided us with personal information contrary to this policy, please contact us and we will take appropriate steps.

⚠️ COUNSEL — confirm the age policy and any provision of services to minors, which raises additional requirements (UK Age Appropriate Design Code; US COPPA; parental/guardian consent; and clinical considerations). If minors are ever supported, this section and the underlying processes must be substantially expanded.

12. Automated decision-making

Faresay does not currently make decisions producing legal or similarly significant effects about you based solely on automated processing without human involvement. We may use limited automated processing (e.g. to suggest clinician matches), but clinical decisions are made by your clinician.

⚠️ COUNSEL — confirm this remains accurate as matching/recommendation features evolve; if any solely-automated significant decisions are introduced, additional UK GDPR Article 22 safeguards and disclosures will be required.

13. Data breaches

We maintain procedures to detect, investigate and respond to personal-data breaches. Where a breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and affected individuals as required by law.

UK: notification to the ICO without undue delay and, where required, within 72 hours of becoming aware, and to affected individuals where the breach is high-risk.
US ⚠️ COUNSEL: where HIPAA applies, breach notification obligations under the HIPAA Breach Notification Rule (to individuals, HHS, and in some cases the media) and applicable state breach-notification laws must be followed.

Our incident-response approach is detailed in the Security & Data Protection Policy.

14. How to complain ⚠️ COUNSEL

If you have a concern about how we handle your personal data, please contact us first (Section 17) so we can try to resolve it.

UK: you have the right to lodge a complaint with the Information Commissioner's Office (ICO) — https://ico.org.uk — though we ask that you contact us first.
US: depending on the issue and jurisdiction, you may be able to complain to relevant regulators, which may include the US Department of Health and Human Services Office for Civil Rights (HHS OCR) for HIPAA matters, your State Attorney General, and other applicable state regulators. [PLACEHOLDER: confirm relevant US regulators / contact routes.]

⚠️ COUNSEL — finalise the list of competent US regulators and complaint routes (including EU/EEA lead supervisory authority analysis if EU residents are served).

15. HIPAA Notice of Privacy Practices ⚠️ COUNSEL

Where HIPAA applies to Faresay's US operations, a separate HIPAA Notice of Privacy Practices (NPP) may be legally required and will describe how protected health information (PHI) may be used and disclosed and the rights individuals have under HIPAA. This Privacy Policy does not replace any required NPP.

⚠️ COUNSEL — confirm whether Faresay is a HIPAA covered entity, business associate, or neither for each US data flow; whether an NPP is required and, if so, who must provide it (Faresay and/or the clinician); and ensure appropriate Business Associate Agreements (BAAs) are in place. Link the NPP here once finalised: [PLACEHOLDER: link to HIPAA Notice of Privacy Practices].

16. State-specific disclosures

[PLACEHOLDER: state-specific privacy disclosures to be inserted as the US footprint and applicable state laws are confirmed — e.g. California CCPA/CPRA notice at collection and "Your Privacy Choices", Washington My Health My Data Act consumer-health-data disclosures, and other state-required notices.] ⚠️ COUNSEL

17. Contact & updates

Privacy / data-protection contact: [PLACEHOLDER: privacy contact name, email, postal address] Data Protection Officer (if appointed): [PLACEHOLDER: DPO name and contact] UK / EU representative (if required) ⚠️ COUNSEL: [PLACEHOLDER: representative details] US privacy contact ⚠️ COUNSEL: [PLACEHOLDER: US contact / toll-free number where required]

We may update this Privacy Policy from time to time. We will post the updated version with a revised "Last updated" date and, where changes are material, take additional steps to notify you as required by law.

This is a DRAFT document prepared for legal/privacy counsel review. It is not legal advice and must be reviewed and finalised by qualified UK and US counsel before publication or use.

Privacy Policy