> ⚠️ DRAFT v0.1 — for legal/privacy counsel review. NOT legal advice. Counsel must finalise before use. Last updated: [PLACEHOLDER: date] # Faresay Privacy Policy (UK) Faresay operates an online therapy / mental-health marketplace that connects clients with UK-registered mental-health professionals. This Privacy Policy explains how we collect, use, share and protect your personal information, and the rights you have over it. Because Faresay is a mental-health service, much of the information we handle is **special-category health data**. We treat this information with a correspondingly high standard of confidentiality and security. Please read this policy carefully. > This policy should be read alongside our [Terms of Service](uk-terms-of-service.md), our [Security & Data Protection Policy](uk-security-data-protection-policy.md), and (where applicable) the separate clinician-provided privacy notices. --- ## 1. Who we are & data controller ⚠️ COUNSEL **Faresay** ("Faresay", "we", "us", "our") provides the technology platform through which clients discover, book and pay for sessions with independent UK-registered mental-health professionals ("therapists" or "clinicians"). - **Controller legal entity:** [PLACEHOLDER: registered controller legal name] - **Registered address:** [PLACEHOLDER: registered address] - **Company registration number:** [PLACEHOLDER: company number] - **ICO registration number:** [PLACEHOLDER: ICO registration number] - **Data Protection Officer / privacy contact:** [PLACEHOLDER: DPO or privacy contact name and email] ⚠️ **COUNSEL — controller vs processor / joint-controller mapping.** Faresay provides the platform; the clinician provides the clinical service and owns the clinical relationship and clinical record (see [CONTEXT.md] / [Therapist Agreement](uk-therapist-agreement.md)). The respective data-protection roles must be confirmed: - For **account, marketplace, payment, device and usage data**, Faresay is likely the **controller**. - For **clinical / session-note data created by the clinician**, the clinician may be the **independent controller** (with Faresay acting as **processor**, or as **joint controller** for certain activities). - Counsel must finalise the controller / processor / joint-controller analysis under UK GDPR, and ensure the resulting roles are reflected consistently across this policy, the Terms, the Therapist Agreement and any data-sharing agreements and Data Processing Agreements (DPAs) between Faresay and clinicians. --- ## 2. Scope This policy applies to Faresay's services as offered in the **United Kingdom**. - Faresay's processing of personal data is governed by the **UK GDPR** and the **Data Protection Act 2018**, and regulated by the **Information Commissioner's Office (ICO)**. - Faresay is registered with the ICO and pays the applicable data-protection fee (see Section 1). This policy covers our website, web and mobile applications, and related services (together, the "Platform"). It does **not** cover third-party websites or services we link to, which have their own privacy practices. --- ## 3. What data we collect We collect the following categories of personal information. ### 3.1 Account & identity data - Name, email address, telephone number, username and password (stored hashed). - Date of birth / age confirmation. - Address or location (where relevant). - Profile information you provide. - For clinicians: professional identity, registration details with a relevant professional body (e.g. BACP, UKCP, NCPS, HCPC, BPS or another PSA-accredited register), qualifications, and verification information. ### 3.2 Health & special-category data ⚠️ COUNSEL This is the most sensitive information we handle. It may include: - The fact that you are seeking or receiving mental-health support (itself sensitive health data). - Intake / assessment information, presenting concerns, symptoms, history and goals. - Session-related clinical information and notes (typically created and held by your clinician — see Section 1). - Messages and communications relating to your care. - Any health, disability, or other special-category information you choose to share. Under UK GDPR this is **special-category data** (Article 9). We apply a high confidentiality and security bar to all such data. ⚠️ **COUNSEL** — confirm the precise boundary between data Faresay processes and clinical-record data the clinician controls, and ensure consent / lawful-basis mechanisms meet UK GDPR Article 9 requirements (including, where relied upon, separate valid explicit consent for collection, use and sharing of health data). ### 3.3 Payment data - Billing details and transaction history. - Payment is processed by third-party payment providers; we do **not** store full card numbers on our own systems. [PLACEHOLDER: confirm exactly what payment data Faresay stores vs. what the payment processor stores.] ### 3.4 Device & usage data - IP address, device identifiers, browser type, operating system. - Log data, pages/screens viewed, features used, and timestamps. - Approximate location derived from IP address. - Cookies and similar technologies (see Section 10). ### 3.5 Communications data - Messages you send to us (support, enquiries) and, where applicable, in-platform messages with clinicians. - Records of your communications with our support team. - Feedback, reviews and survey responses. We collect this information directly from you, automatically through your use of the Platform, and in some cases from third parties (e.g. clinicians regarding your bookings, identity/registration verification providers regarding clinicians, and payment providers regarding transactions). --- ## 4. How and why we use your data, with legal bases The table below summarises our main purposes and the **legal bases** we rely on under UK GDPR. For health / special-category data we identify both an **Article 6** basis and an **Article 9** condition. ⚠️ **COUNSEL** — the legal bases below are a first draft and must be confirmed. In particular, the Article 9 condition for health data must be finalised by counsel. | # | Purpose | Data used | UK GDPR Art 6 basis | UK GDPR Art 9 condition (health data) | |---|---------|-----------|---------------------|----------------------------------------| | 1 | Create and manage your account | Account/identity | Contract (Art 6(1)(b)) | n/a | | 2 | Match you with clinicians and enable booking/scheduling | Account/identity, limited health context | Contract (Art 6(1)(b)) | ⚠️ COUNSEL — likely Art 9(2)(h) (health/social care) or explicit consent Art 9(2)(a) | | 3 | Facilitate the provision of mental-health care via clinicians | Health & special-category | Contract / Legitimate interests | ⚠️ COUNSEL — Art 9(2)(h) provision of health care, and/or Art 9(2)(a) explicit consent | | 4 | Process payments and operate the 15% platform fee | Payment, account | Contract (Art 6(1)(b)) | n/a | | 5 | Provide support and respond to enquiries | Communications, account | Contract / Legitimate interests | Art 9(2)(a) / 9(2)(h) where health data is involved ⚠️ COUNSEL | | 6 | Safety, safeguarding and crisis response | Health, communications | Legitimate interests / Legal obligation / Vital interests | ⚠️ COUNSEL — Art 9(2)(c) vital interests and/or 9(2)(h); see [Crisis & Safeguarding Policy](uk-crisis-safeguarding-policy.md) | | 7 | Security, fraud prevention, and protecting the Platform | Device/usage, account | Legitimate interests / Legal obligation | n/a | | 8 | Service improvement and analytics | Device/usage (minimised/aggregated where possible) | Legitimate interests | ⚠️ COUNSEL — avoid using health data for analytics without an appropriate condition | | 9 | Marketing communications (where permitted) | Account, usage | Consent / Legitimate interests | n/a | | 10 | Legal compliance, regulatory and dispute handling | As needed | Legal obligation / Legitimate interests | Art 9(2)(f) legal claims; 9(2)(g)/(h) as applicable ⚠️ COUNSEL | We will not use your special-category health data for a new, incompatible purpose without identifying an appropriate lawful basis and, where required, obtaining your explicit consent. --- ## 5. How we share your data We share personal information only as described below. - **Therapists / clinicians.** To enable and deliver your care, relevant information is shared with the clinician you book or are matched with. The clinician is an independent professional responsible for the clinical relationship and clinical record (see Section 1). - **Service providers / processors & sub-processors.** We use third-party providers to host, operate and support the Platform (e.g. cloud hosting, communications, analytics, identity/registration verification, customer support). They process data on our instructions under written contracts (Data Processing Agreements). [PLACEHOLDER: sub-processor list / link to sub-processor list.] - **Payment providers.** Payment processors handle transactions and operate under their own privacy notices. [PLACEHOLDER: name(s) of payment provider(s).] - **Legal & safety.** We may disclose information where necessary to comply with law, respond to lawful requests, enforce our Terms, prevent fraud, or protect the rights, safety and vital interests of you or others (including in safeguarding / crisis situations — see [Crisis & Safeguarding Policy](uk-crisis-safeguarding-policy.md)). - **Business transfers.** If Faresay is involved in a merger, acquisition, financing or sale of assets, personal information may be transferred as part of that transaction, subject to appropriate confidentiality and continued protection of your data. We do **not** sell your personal information. ⚠️ **COUNSEL** — confirm our disclosures and any required controls match actual data flows (including any analytics/advertising trackers), and that any sharing of health-related data via trackers is avoided or appropriately consented. --- ## 6. International data transfers ⚠️ COUNSEL Faresay is based in the UK, but some of our service providers may process data outside the UK (including in the US — for example certain communications, video-session and email providers such as Clerk, Daily and Resend). Where we transfer personal data internationally, we will put in place an appropriate safeguard, which may include: - the **UK International Data Transfer Agreement (IDTA)**, or the **EU Standard Contractual Clauses (SCCs)** with the **UK Addendum**; - reliance on an **adequacy** decision / the **UK Extension to the EU–US Data Privacy Framework**, where applicable; or - other lawful transfer mechanisms. ⚠️ **COUNSEL** — finalise the transfer mechanism(s) for each data flow, confirm current adequacy / Data Privacy Framework status, and complete transfer risk assessments (TRAs) where required. Several current processors are US-based (e.g. Clerk, Daily, Resend); each such transfer must be assessed and documented, and UK/EU hosting regions should be selected where available. Given the sensitivity of mental-health data, transfer safeguards warrant particular scrutiny. --- ## 7. Data retention ⚠️ COUNSEL We keep personal information only for as long as necessary for the purposes set out in this policy, and to meet legal, regulatory, accounting, clinical-record and dispute-resolution requirements. Retention periods are set out in our retention schedule. - Account & identity data: [PLACEHOLDER: retention period] - Health & clinical-record data: [PLACEHOLDER: retention period] ⚠️ COUNSEL — clinical-record retention is governed by professional/clinical standards and law. Confirm who (Faresay vs clinician) is responsible for retaining clinical records and for how long. - Payment & transaction data: [PLACEHOLDER: retention period, typically driven by tax/accounting law] - Device, usage & log data: [PLACEHOLDER: retention period] - Communications & support data: [PLACEHOLDER: retention period] When data is no longer required, we will securely delete or anonymise it. ⚠️ **COUNSEL** — finalise the full retention schedule and reconcile it with clinical-record obligations. --- ## 8. Security We implement technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse or alteration, with enhanced controls for sensitive health data. These measures are described in our **[Security & Data Protection Policy](uk-security-data-protection-policy.md)**, which this policy incorporates by reference. No system can be guaranteed 100% secure, but we maintain a high security bar appropriate to the sensitivity of mental-health data. --- ## 9. Your rights Subject to applicable law, you have the right to: - **access** the personal data we hold about you (a subject access request / DSAR); - request **rectification** of inaccurate data; - request **erasure** ("right to be forgotten") in certain circumstances; - **restrict** or **object** to certain processing; - **data portability**; - **withdraw consent** at any time where processing is based on consent (without affecting prior processing); and - not be subject to solely automated decisions with legal/similarly significant effects (see Section 12). To exercise these rights, contact us using the details in Section 14. We will respond within the timeframes required by law — generally **within one month** of receiving your request (extendable in limited circumstances). ⚠️ **COUNSEL** — note that some rights (e.g. erasure) may be limited where data forms part of a clinical record or must be retained for legal/regulatory reasons. --- ## 10. Cookies & tracking We use cookies and similar technologies to operate the Platform, remember your preferences, keep you signed in, maintain security, and understand and improve how the Platform is used. - **Strictly necessary** cookies are required for the Platform to function. - **Analytics / performance** and **functional** cookies are used [PLACEHOLDER: confirm categories and providers]. - We will obtain consent for non-essential cookies where required (e.g. under PECR / UK law), and provide controls to manage your preferences. ⚠️ **COUNSEL** — given the sensitivity of mental-health data, scrutinise any third-party trackers/SDKs (especially advertising/analytics) for potential disclosure of health-related data. Confirm the cookie banner/consent mechanism. [PLACEHOLDER: link to detailed cookie notice / preference centre.] --- ## 11. Children's data The Platform is intended for adults. [PLACEHOLDER: confirm minimum age — e.g. 18, or 16/13 with conditions, and whether services to minors are offered at all.] We do not knowingly collect personal information from children below the applicable age without appropriate consent. If you believe a child has provided us with personal information contrary to this policy, please contact us and we will take appropriate steps. ⚠️ **COUNSEL** — confirm the age policy and any provision of services to minors, which raises additional requirements (UK GDPR child-consent rules and the ICO Age Appropriate Design (Children's) Code; parental/guardian consent; and clinical considerations). If minors are ever supported, this section and the underlying processes must be substantially expanded. --- ## 12. Automated decision-making Faresay does **not** currently make decisions producing legal or similarly significant effects about you based **solely** on automated processing without human involvement. We may use limited automated processing (e.g. to suggest clinician matches), but clinical decisions are made by your clinician. ⚠️ **COUNSEL** — confirm this remains accurate as matching/recommendation features evolve; if any solely-automated significant decisions are introduced, additional UK GDPR Article 22 safeguards and disclosures will be required. --- ## 13. Data breaches We maintain procedures to detect, investigate and respond to personal-data breaches. Where a breach is likely to result in a risk to your rights and freedoms, we will notify the **Information Commissioner's Office (ICO)** without undue delay and, where required, **within 72 hours** of becoming aware. Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify affected individuals without undue delay. Our incident-response approach is detailed in the [Security & Data Protection Policy](uk-security-data-protection-policy.md). --- ## 14. How to complain ⚠️ COUNSEL If you have a concern about how we handle your personal data, please contact us first (Section 14, contact details below) so we can try to resolve it. You have the right to lodge a complaint with the **Information Commissioner's Office (ICO)** — https://ico.org.uk — though we ask that you contact us first. ⚠️ **COUNSEL** — confirm the complaint-handling process and contact routes, and whether any EU/EEA lead supervisory authority analysis is needed if EU residents are served. **If you need urgent help.** This policy is about data protection, not crisis support. If you or someone else is in immediate danger, call **999**. For mental-health support you can also contact the **Samaritans** on **116 123**, **NHS 111**, or the **SHOUT** text service by texting **85258**. --- ## 15. Contact & updates **Privacy / data-protection contact:** [PLACEHOLDER: privacy contact name, email, postal address] **Data Protection Officer (if appointed):** [PLACEHOLDER: DPO name and contact] We may update this Privacy Policy from time to time. We will post the updated version with a revised "Last updated" date and, where changes are material, take additional steps to notify you as required by law. --- *This is a DRAFT document prepared for legal/privacy counsel review. It is not legal advice and must be reviewed and finalised by qualified UK counsel before publication or use.*