PsychSense Ltd — Privacy Policy

1. Introduction & Who We Are

PsychSense Ltd ("we", "us", or "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal data when you visit our website, utilise our mobile application, or book clinical services.

For the purposes of the UK General Data Protection Regulation (UK GDPR), PsychSense Ltd is the Data Controller.

• Company Registration: 14204720
• Registered Office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
• Data Protection Contact: contact@psychsense.co.uk

2. The Data We Collect About You

Because we operate a digital psychiatric and therapeutic platform, we process both standard personal data and sensitive, Special Category Personal Data (specifically, health and medical metrics). We categorise this data as follows:

• Identity & Contact Data: First name, last name, date of birth, biological sex, billing address, home address, email address, and phone number.
• Clinical & Special Category Data: Symptoms, psychiatric and medical histories, intake form answers, automated screening scores, clinical consultation notes, letters, prescriptions, and live audio/video streams from your digital consultations.
• Identity Verification Data: Copies of government-issued photo ID (e.g., passport or driving licence) displayed during video onboarding.
• Financial & Transaction Data: Details of payments made by you and medical packages purchased. Note: We do not store or view raw credit card numbers; all transactions are routed through our secure partner, Stripe Payments Europe, Ltd
• Technical & Device Data: Internet Protocol (IP) address, operating system, browser type, device identifiers, and data regarding how you navigate our app and website.

3. How and Why We Use Your Data (Legal Bases)

Under the UK GDPR, we must establish a specific legal justification for every processing activity. The table below outlines our operational layout:

4. Sharing Your Data with Third Parties

We do not sell, rent, or trade your personal data to any third parties for marketing purposes. We share your data strictly with trusted service providers who help run our platform:

• Stripe Payments Europe, Ltd: To securely process your assessment and session fees.
• Secure Telehealth Infrastructure: Encrypted video-routing providers that facilitate your live consultations (they cannot view or record your sessions).
• Emergency Services & Local NHS Trusts: If our clinicians determine you are in immediate physical danger, we will bypass standard confidentiality rules to contact your local A&E or emergency team to protect your life.
• Safeguarding: If we have serious concerns that you, a child, or a vulnerable adult are at risk of significant harm or abuse, we have a legal and ethical duty to share this information with relevant third parties, such as your social care or emergency services. Whenever possible and safe to do so, we will discuss this with you first.
• Regulators & Legal Bodies: Where legally compelled to disclose data by a court order, the General Medical Council (GMC), or law enforcement.

5. International Data Transfers

PsychSense Ltd is based in the United Kingdom. Where our software utilities or payment processors (like Stripe) route data outside the UK or the European Economic Area (EEA), we ensure equivalent protections are maintained.

All international transfers are anchored by International Data Transfer Agreements (IDTAs) or the UK Addendum to the EU Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner’s Office (ICO).

6. How Long We Keep Your Data

We store your data only for as long as necessary to satisfy clinical, statutory accounting, and legal requirements

Clinical Records

In accordance with UK independent practice regulations and the NHS Records Management Code of Practice, child medical files are subject to specific legal retention limits:

• Standard Child Records: Retained until the patient’s 25th birthday, or their 26th birthday if they were 17 when treatment ended. This meets the timelines set by the UK Limitation Act 1980 for medical claims.
  • Mental Health Services: Retained for 20 years from the date of last contact if mental health care was provided.
  • In the Event of Death: If a patient sadly passes away as a minor, records are securely held for 8 years following their death.

Financial Records

• Invoice and payment data processed via Stripe is retained for 6 years from the end of the financial year to comply with UK statutory tax laws.

7. Your Statutory Rights (and your Child Rights) Under the UK GDPR

Depending on the age and understanding of the child (typically evaluated using Gillick competency standards around age 12–13), children or their legal guardians have the right to:

• Access: Request a copy of their medical file (via a Subject Access Request):
  • You can request a copy of all information we hold about you, including your clinical record files.
• Rectification: Request corrections to inaccurate administrative or personal data.
• Restriction and Objection: Object to or restrict certain types of data processing (though clinical documentation cannot be erased upon request due to legal healthcare mandates).
• Erasure ("Right to be Forgotten"): You can ask us to wipe your account data. Note: We cannot erase data that we are legally required to maintain under UK medical retention laws.

8. Children’s Privacy and Competency (Who Controls the Data?)

We recognise that as children grow, their right to control their own medical information increases. In accordance with UK data protection laws and clinical guidelines, how we manage a child's privacy depends on their age and developmental understanding:

• Children under 13: A parent or legal guardian holds the legal right to act on the child’s behalf. We will share medical updates, take consent for treatments, and process data requests directly with the parent or guardian. Assessments booked on behalf of a minor require explicit, verifiable parental or guardian authentication and active presence.
• Young People aged 13 to 15: Young people in this age bracket may be assessed using Gillick competency standards. If our clinical team determines that a young person has sufficient understanding and intelligence to fully grasp what is being proposed, they have the legal right to confidentiality. This means they can choose to access their own records, consent to their own treatment, or request that certain medical information not be shared with their parents. We will always encourage open communication within families, but we must respect the young person’s legal right to privacy if they are deemed competent.
• Young People aged 16 and 17: By law, young people aged 16 and over are presumed to have the capacity to make their own healthcare and privacy decisions. They hold the rights to their own medical data, and we will generally require their explicit consent before sharing details of their care with parents or guardians.

Exclusions to Confidentiality: As outlined in our safeguarding policy, a young person's right to privacy is never absolute if they are at risk. If a competent young person refuses to allow us to share information with their parents, but we believe they are facing significant harm, neglect, or abuse, we are legally required to bypass their withholding of consent to protect them.

9. How to Complain

If you are unhappy with how we manage your clinical data, please contact our Data Protection Team first:

contact@psychsense.co.uk

If we cannot resolve your issue, you have the right to lodge a formal complaint with the UK supervisory authority:

• Name: Information Commissioner’s Office (ICO)
• Website: www.ico.org.uk