Privacy Policy

1Introduction

This Privacy Policy is provided by Psych2Gether Limited, a company incorporated in England and Wales with company number 16556266, registered office at The Stable Yard, 25–33 Vicarage Road, Stony Stratford, Milton Keynes, Buckinghamshire, England, MK11 1BN (“Company”, “we”, “our” or “us”).

We provide online mental health assessment and treatment services, including ADHD and Autism assessments for children and adults, and related clinical, administrative and website services. For most patient, client, website and business administration data described in this policy, we act as the controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where a third-party platform or provider processes data for us, it will usually do so as our processor or as an independent controller, depending on the service and its own legal role.

We take your privacy very seriously. Please read this policy carefully — it explains how and why we collect, store, use and share your personal data, your rights in relation to that data, and how to contact us or the relevant regulator if you have a complaint.

2What This Policy Applies To

This privacy policy relates to:

• Your use of our website and online contact forms (“Website”)
• Enquiries, bookings and administrative communications
• Personal data processed in connection with online mental health assessments, treatment, reports, letters, prescribing support and related clinical services

3Personal Data We Collect About You

The personal data we collect depends on how you interact with us and the services you request. We may collect data directly from you, from a parent or guardian, from a patient management platform, from GPs or other healthcare professionals, and from payment providers or other third parties where relevant and lawful.

We may also collect, use and share aggregated and anonymised data — such as statistical or demographic information — which does not directly or indirectly reveal your identity, for example to analyse Website trends and improve our services.

Sensitive Data

Sensitive personal data (“special category data”) includes information revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, health data, sex life or sexual orientation. In our services, this usually includes health data, mental health information, neurodevelopmental assessment information, care information, medical history, medication and prescribing information, clinical correspondence, treatment plans, reports and letters.

We process this data only where necessary for your care, clinical administration, safeguarding, or professional/regulatory obligations — relying on a lawful basis under Article 6 UK GDPR and a special category condition under Article 9 UK GDPR, with appropriate professional, technical and organisational safeguards.

4How Your Personal Data Is Collected

• Your interaction with us — when you contact us, submit enquiries, complete booking or intake forms, use our Website or patient platform, sign consent forms, attend appointments, receive reports or treatment, subscribe to communications, or correspond with us by email, telephone or video consultation. We may also collect data from parents/guardians, GPs and other healthcare professionals where necessary and lawful.
• Automated technologies — as you interact with the Website, we automatically collect technical data about your equipment and browsing patterns, using cookies, server logs and similar technologies.

5How and Why We Use Your Personal Data

Personal data may only be processed where there is a lawful basis. For most data, we act as controller and rely on one or more of the following:

• Where you have given consent, including consent to particular communications or optional processing
• To comply with our legal, safeguarding, professional and regulatory obligations
• For the performance of a contract with you, or to take steps at your request before entering into one
• For our legitimate interests, or those of a third party

For special category health data, we also rely on an Article 9 UK GDPR condition — usually that processing is necessary for the provision of health or social care/treatment by a health professional subject to confidentiality obligations, explicit consent where appropriate, substantial public interest (such as safeguarding), legal obligations, or the establishment/defence of legal claims.

6Marketing

We may send you communications about our services, updates and insights, and (where permitted) promotional offers. Where required by law — including under PECR — we will obtain your consent before sending direct marketing. Where consent isn’t required, we may rely on legitimate interests, and you can opt out at any time. We maintain records of your marketing preferences.

You can opt out of marketing communications at any time by:

• Contacting us at the email address published on our Website
• Using the ‘unsubscribe’ link included in all marketing emails

We will never sell your personal data to third parties for their own direct marketing purposes.

7Who We Share Your Personal Data With

We share personal data only where necessary for the purposes in this policy. This may include:

• A third-party patient management platform such as Semble — bookings, forms, payments, records, reports, letters
• Payment, accounting and invoicing providers such as Xero
• Prescribing fulfilment providers (e.g. Signature RX) for non-controlled prescriptions
• Email and IT providers such as Gmail/Google Workspace
• GPs, referrers and other healthcare professionals, with consent or where legally/professionally required
• Suppliers and professional advisers needed to operate our Website, services and business

We only allow service providers to handle your data where we’re satisfied they take appropriate protective measures, and we impose contractual obligations restricting their use of your data to providing services to us and you.

We may also occasionally share data with:

• External auditors, bound by confidentiality obligations
• Professional advisers (lawyers and similar), bound by confidentiality obligations
• Law enforcement, courts, tribunals and regulatory bodies, to comply with legal obligations
• Other parties in connection with a corporate transaction or restructuring — usually anonymised where possible

We do not share your personal data with third parties except as described in this policy or where required or permitted by law.

8How Long Your Personal Data Will Be Kept

We keep personal data only as long as necessary for the purposes in this policy — including providing care, maintaining clinical records, complying with legal/safeguarding/professional/accounting obligations, and defending legal claims. Retention periods vary depending on the type of record, professional guidance, patient age, and whether a record relates to clinical care, safeguarding, finance, enquiries or Website administration.

General administrative email correspondence and documents from GPs or patients are typically retained for approximately six to seven years, unless a longer or shorter period is required by law, professional guidance or clinical need. After the retention period, we delete or anonymise data unless required to retain it for legal reasons.

9Transferring Your Personal Data Out of the UK

We aim to use service providers that process personal data in the UK or jurisdictions with appropriate protections. Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place — such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, a transfer risk assessment (TRA), an adequacy regulation, or another lawful transfer mechanism.

• The EEA — we may rely on UK adequacy regulations where applicable
• Other countries — we put in place appropriate safeguards (e.g. IDTA, TRA) and other measures required by UK data protection law

10Your Rights

You generally have the following rights, usually exercisable free of charge. These may be limited where we must retain information for legal, safeguarding, professional, clinical or regulatory reasons, or where another person’s rights are affected.

To exercise any of these rights, please email, call or write to us (see “How to Contact Us” below). We may need to verify your identity and consider the rights and confidentiality of patients, children, parents/guardians, clinicians and other individuals before responding.

11Keeping Your Personal Data Secure

We’ve implemented appropriate technical and organisational security measures to protect your personal data, including special category health data. Access is restricted to authorised clinicians, staff, contractors and service providers on a need-to-know basis. Patient records and clinical communications may be held in a third-party patient management platform, while general administrative correspondence may be held via Gmail/Google Workspace or another email service.

We have procedures in place to deal with any suspected data security breach, and will notify you and any applicable regulator where legally required to do so.

12How to Complain

Please contact us if you have any queries or concerns about our use of your information — we hope to resolve any issues directly. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

• Online: ico.org.uk/make-a-complaint
• Telephone: 0303 123 1113

13Changes to This Privacy Policy

We may change this privacy policy from time to time to reflect updates in our services, processing activities or regulatory requirements. Where appropriate, we’ll bring significant changes to your attention — for example, by posting an updated version on the Website and/or contacting you directly.

14How to Contact Us

You can contact us by post, email or telephone if you have any questions about this policy, the information we hold about you, to exercise your rights under data protection law, or to make a complaint.