Privacy Policy

Introduction

TherapyConnect ("we", "our", or "us") is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, store, and protect your information in accordance with the General Data Protection Regulation (GDPR) and UK data protection laws.

As a healthcare service provider, we also adhere to NHS data protection standards and the UK Caldicott Principles to ensure the highest level of confidentiality for your medical information.

1. Information We Collect

1.1 Personal Information

We collect the following types of personal data:

• Contact information (name, email address, phone number, postal address)
• Account credentials (username, encrypted password)
• Demographic information (date of birth, gender)
• Payment information (processed securely through third-party payment providers)

1.2 Medical Information

With your explicit consent, we collect health-related information necessary for providing our services:

• Medical history and current health conditions
• Medication information
• Allergies and sensitivities
• Treatment notes and progress records
• Emergency contact information

1.3 Technical Information

We automatically collect certain technical data when you use our platform:

• IP address and device information
• Browser type and version
• Usage data and analytics
• Cookies and similar technologies (see our Cookie Policy)

2. Legal Basis for Processing

Under GDPR, we process your personal data based on the following legal grounds:

• Consent: You have given explicit consent for us to process your personal and medical data for specific purposes.
• Contract Performance: Processing is necessary to fulfill our service agreement with you (booking appointments, providing therapy services).
• Legal Obligation: We must process certain data to comply with legal requirements (e.g., safeguarding, professional standards).
• Legitimate Interests: Processing is necessary for our legitimate business interests (fraud prevention, service improvement) while respecting your rights.

3. How We Use Your Information

We use your personal data for:

• Providing and managing therapy services and appointments
• Communicating with you about your bookings and treatments
• Processing payments and maintaining financial records
• Ensuring the safety and effectiveness of our services
• Complying with professional and legal obligations
• Improving our services and platform functionality
• Sending service updates and important notifications
• Conducting research and analytics (anonymized data only)

5. Data Security

We implement robust security measures to protect your data:

• End-to-end encryption for data transmission (SSL/TLS)
• Encrypted storage of sensitive medical information
• Regular security audits and penetration testing
• Access controls and authentication requirements
• Staff training on data protection and confidentiality
• Secure backup and disaster recovery procedures
• Compliance with NHS Digital security standards

While we take every precaution to protect your data, no internet transmission is completely secure. We encourage you to use strong passwords and keep your login credentials confidential.

6. Data Retention

We retain your personal data only for as long as necessary:

• Active Accounts: Data is retained while your account is active and for the provision of services.
• Medical Records: Retained for 8 years after the last treatment, in accordance with NHS and professional body guidelines.
• Financial Records: Retained for 7 years to comply with tax and accounting regulations.
• Marketing Data: Retained until you withdraw consent or unsubscribe.

After the retention period, data is securely deleted or anonymized.

8. International Data Transfers

Your data is primarily stored and processed within the UK and European Economic Area (EEA). If we transfer data outside these regions, we ensure adequate safeguards are in place:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions for countries with equivalent data protection
• Additional security measures for medical data transfers

9. Cookies and Tracking Technologies

We use cookies and similar technologies to improve your experience:

• Essential Cookies: Required for platform functionality and security.
• Performance Cookies: Help us understand how you use our platform.
• Functional Cookies: Remember your preferences and settings.

You can manage cookie preferences through your browser settings.

10. Children's Privacy

We provide services to children under 16, but their accounts must be managed by a parent or legal guardian. Parental consent is required for processing children's personal and medical data. We take extra precautions to protect children's information.

11. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of significant changes via email or through our platform. The "Last updated" date at the top of this page indicates when the policy was last revised.

13. Regulatory Compliance

TherapyConnect is committed to compliance with:

• General Data Protection Regulation (GDPR)
• UK Data Protection Act 2018
• NHS Data Security and Protection Toolkit
• UK Caldicott Principles
• Professional body data protection standards