My-Therapy-Suite Ltd
If you have any questions about this notice, contact us:
Data protection law distinguishes between organisations that decide why and how personal data is processed ("controllers") and organisations that process personal data on behalf of controllers ("processors").
If your data has been entered by a therapist or practice, please contact them directly to exercise your data protection rights.
We collect or use the following information to provide platform and portal functionality:
The Service may process special category personal data, such as health information, if a therapist/practice enters this information for the purpose of providing care. This information is processed under strict access controls and security safeguards. The therapist/practice as controller is responsible for establishing the appropriate lawful basis and condition for processing special category data.
Where therapists use the platform's video or audio session features, we may process session metadata (date, time, duration, participants) and, where recording is enabled by the therapist, session recordings stored on servers in the United Kingdom.
The Service includes AI-assisted features such as session transcription, clinical summarisation, pre-session briefing, and risk signal analysis. Where these features are used, data may be sent to third-party AI providers acting as sub-processors (see "Who we share information with" below).
The therapist/practice as controller is responsible for obtaining appropriate consent for recording and for informing clients about how recordings will be used. We provide template consent agreements to assist with this.
We collect or use personal information for legal compliance purposes, including names, contact information, and audit logs and security records (where necessary).
We collect or use the following for information updates, marketing, or market research: names and contact details, marketing preferences, and IP addresses and usage analytics (where enabled).
Under UK data protection law, we must have a "lawful basis" for collecting and using your personal information. You can find out more about lawful bases on the ICO's website.
If you are a client/patient whose data is processed by a therapist/practice using the Service, the therapist/practice is typically the controller and determines the lawful basis for processing your therapy record.
You have the right to access your personal information, rectification of inaccurate data, erasure (in certain circumstances), restriction of processing, data portability, objection to processing based on legitimate interests, withdrawal of consent at any time, and not to be subject to solely automated decisions with legal or similarly significant effects.
To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.
We may get personal information from:
We keep personal information only for as long as necessary for the purposes it was collected for, including legal, accounting, regulatory, and security requirements.
Client/patient records: The controller (therapist/practice) determines the retention period. We retain that information according to the controller's instructions.
Account records: Retained for the duration of the account and for up to 6 months after closure, unless a longer period is required by law.
Billing and financial records: Retained for 6 years from the end of the relevant financial year, in accordance with HMRC requirements and the Companies Act 2006.
Security and audit logs: Retained for up to 24 months for security monitoring, incident investigation, and legal compliance.
Session recordings and transcriptions: Retention is determined by the therapist/practice as controller. We provide tools for therapists to manage and delete recordings.
Our primary infrastructure (Microsoft Azure and Google Cloud Platform) is hosted in the United Kingdom. Some sub-processors are located outside the UK. Where personal information is transferred outside the United Kingdom, we ensure appropriate safeguards are in place in accordance with Chapter V of the UK GDPR (such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses).
We use appropriate technical and organisational measures to protect personal information, including encryption in transit and at rest, role-based access controls, audit logging, and secure infrastructure hosted in UK data centres.
No method of transmission or storage is completely secure, but we take reasonable steps to protect personal information.
If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.
If you remain unhappy after raising a complaint with us, you can also complain to the ICO.
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Tel: 0303 123 1113
Website: ico.org.uk