Privacy Policy

Welcome to MysupportRoom Ltd’s privacy policy

MySupportRoom Ltd (“we”) respects your privacy and is committed to protecting your personal data. This privacy policy will inform you as to how we look after your personal data when you visit our website or our apps supportroom.com and mysupportroom.com (regardless of where you visit them from), the purposes for which these data are collected as well as how it is processed, and tell you about your privacy rights and how the law protects you. You can rest assured that your personal data is handled with care. If you want to contact us, you will find our contact details at the end of this policy.

A reference to Psychologists means the self-employed and employed practitioners who provide therapy and related services to users. The relationship between us and the Psychologists is explained in more detail in our terms and conditions (www.supportroom.com).
1. What is personal data
Personal data means any information relating to an identified or identifiable natural person, such as your contact information, your browsing history or information you provide about your mental health.
2. General principles for personal data processing by us
We adhere to the following principles when processing your personal data:

• We will only collect personal data for specified, explicit and legitimate purposes
• We will not collect personal data beyond what is necessary to accomplish those purposes
• We will not use personal data for purposes other than that for which the data was collected, except as stated herein, or with prior consent
• We will not transfer personal data to third parties, except as stated herein, or with prior consent
• We do pass analysed data to an organisation that has purchased a digital ESP for their organisation and employees. Employee anonymised data is aggregated and represented as charts
• We will do our best to ensure that information is up to date by encouraging you to verify your personal data periodically
• We will maintain appropriate technical and organizational measures to protect your personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access and against all other unlawful forms of processing
• Except when stated herein, we will not store personal data longer than is necessary to accomplish the purpose for which the data were collected or for which they are further processed, or as is required by law

3. Personal data we collect and process
We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows

• Identity Data includes first name, last name, username or similar identifier, date of birth, title, and gender.
• Contact Data includes billing address, delivery address, email address and telephone numbers.
• Transaction Data includes details about payments to and from you and other details of services you have purchased from us.
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our site or our apps.
• Profile Data includes your username and password, the services you have used on our site or our apps, your use of social media functions on our site or our apps, your interests, preferences, feedback, survey responses and such information about your health as you provide to us.
• Usage Data includes information about how you use our website or apps and the services you use.
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.
• Health Data you may provide us with information about your mental health as part of what we term therapy journey or the automated survey. Automated survey is where you complete an online assessment questionnaire to assist you with choosing a Psychologist and to assist the Psychologist with understanding the mental health issues with which you need help.

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as these data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.

We do collect Special Category of Personal Data about your health (usually as you sign up as a user and need to provide initial information about your mental health to a Psychologist or during your consultations with a Psychologist). We must process Health Data in order to provide services to you as a User. Based on the exemption that Special Categories of Data may be processed in order to provide health care, the Company is entitled to process Health Data you have provided the Company.

We do not collect Special Category Data about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, and genetic and biometric data) except for information you provide about your health at any time (usually this will be when you sign up and need to provide some initial information about your mental health to a Psychologist). Nor do we collect any information about criminal convictions and offences.

We do not collect Financial Data such as payment card details. All payments are managed by Stripe.

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as these data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.
4. How is your personal data collected?
We use different methods to collect data from and about you including through: Direct interactions. You may give us your Identity and Contact by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:

• apply for our services;
• create an account on our site or via our apps;
• subscribe to our service or publications;
• request marketing to be sent to you;
• enter a competition, promotion or survey; or
• give us feedback or contact us.

Automated technologies or interactions
As you interact with our platform, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies and other similar technologies like pixels, tags and other identifiers in order to remember your preferences, to understand how our website and apps are used and to customize our marketing offerings. We may also receive Technical Data about you if you visit other websites employing our cookies. Please see our cookie policy for further details.

Third parties or publicly available sources.
We will receive personal data about you from various third parties and public sources as set out below:
Technical Data from the following parties:

• analytics providers (some of which are based outside the EU) such as Google Analytics, Hubspot, Hotjar, Google, Facebook, Hootsuite, Typeform, Meltwater
• advertising networks such as Google, Facebook, Apple, Snapchat (some of which are based outside the EU) ; and
• search information providers
• Contact and Transaction Data from providers of technical, payment and delivery services such as Stripe Inc based outside the EU.
• Identity and Contact Data from data brokers or aggregators such as Facebook and Google based outside the EU.
• Identity and Contact Data from publicly available sources such as Companies House and the Electoral Register based inside the EU.

5. How we use your personal data
We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform the contract we are about to enter into or have entered into with you.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal obligation.
• Generally, for processing your personal data although we will get your consent before sending third party direct marketing communications to you via email or text message or before processing any personal data relating to your health (which usually only occurs when you first sign up with us before you speak with a Psychologist as part of the digital triage process described above). You have the right to withdraw consent to marketing at any time by contacting us.

6. Purposes for which we will use your personal data

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.

Promotional offers from us

We may use your Identity, Contact, Technical, Usage and Profile Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you (we call this marketing).

You will receive marketing communications from us if you have requested information from us or purchased services from us and you have not opted out of receiving that marketing.
We have two mailing lists. One is for news and updates. The other is for educational content and insights. You can opt out of receiving one or both of them.
7. Where we store and process your personal data

As a general principle, your personal data is stored and processed within the European Economic Area (EEA) and the United Kingdom. It may also be processed by staff operating outside the EEA and the United Kingdom who work for us or by one of our suppliers. Such processing may include the processing of your identity information by providers of payment services, which is managed by Stripe. Whenever we transfer your personal data out of the EEA and the United Kingdom, we will ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission or the Information Commissioners Office.
• Where we use certain service providers, we may use specific contracts approved by the European Commission or the Information Commissioners Office which give personal data the same protection it has in Europe.

8. Our disclosure of your personal data to third parties
As a general principle, we collect and process data in order to facilitate or improve our services or offers. We will get your express opt-in consent before we share your personal data with any third party for marketing purposes.

We may disclose your personal data to third parties to the extent required by law, court order or a decision rendered by a competent public authority and for the purpose of law enforcement. In addition, we may share your personal data with the following third parties:

• Psychologists for the purposes of furthering a contract between us and you in relation to our services.
• Our Clinical Lead for the for the purposes of furthering a contract between us and you in relation to our services.
• Third parties carrying out services on our behalf, including billing, sales, marketing, IT support, advertising, analytics, research, customer service, data storage, validation, security, fraud prevention, payment processing, and legal services. Such third-party vendors have access to perform these services but are prohibited from using your personal data for other purposes.
• Third parties in order to establish, exercise or defend our legal rights.
• Third parties in the event of any merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our assets (including without limitation in connection with any bankruptcy or similar proceedings).
• Other third parties subject to your consent.

When we disclose your personal data to a third party, we take all reasonable steps to ensure that those third parties are bound by confidentiality and privacy obligations with respect to the protection of your personal data. The disclosure is conducted in compliance with legal requirements, including entering into data processing agreements with the relevant third parties, to ensure that personal data is only processed in accordance with our instructions, applicable law and regulations and for the purpose specified by us and to ensure adequate security measures.
9. Change of purpose
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
10. Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

All information you provide to us is stored on our secure servers. Any payment transactions will be managed by Stripe and will be encrypted.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

The video sessions with Psychologists are not recorded. We periodically test the security of our systems to check for vulnerabilities.
11. Retention of your personal data

We keep your information for no longer than necessary for the purposes for which it is collected. The length of time for which we retain information depends on the purposes for which we collected and use it.

Personal data related to our services is kept and processed for a period of seven (7) years from the last date of service, unless such data is legitimately processed for other purposes, such as providing you with personal benefits or customized direct marketing upon your consent or for pursuing our legal claims, where maintaining such information is considered necessary.

Personal data related to your use of our site or our apps is kept and processed for a period of seven (7) years from the date you last have been active in using our site or our apps.

Personal data related to our provision of direct marketing to you is kept and processed for a period of three (3) years from the date you last have been active in opening our marketing communication or otherwise showing interest in such communication.

Relevant personal information will be deleted after expiry of the above-mentioned periods, unless such data legitimately can be kept and processed for other processing purposes for which we have legal basis.
12. Cookies

We use cookies and similar technologies like pixels, tags and other identifiers in order to remember your preferences, to understand how our site and our apps are used and to customize our marketing offerings.

Further details can be found in our cookie policy.
13. Data Processors

We are the data controller. We use external third parties to process data, which include the following:

• Amazon Web Services, 91200 Pacific Tower 1200 12th Ave S98144 which provides services needed to operate our website and apps (UK data servers).
• Stripe, Inc which manages payments (note that we do not collect financial information, which you will provide directly to Stripe – B2C).
• Psychologists, who provide services to users.
• Mailgun (EU and USA) (who send emails on our behalf)
• Twillio (USA) (who send the sms on our behalf)
• Whatsapp (USA) (who send sms on our behalf)
• Hubspot (USA) (CRM)
• Active Campaigns (USA, Australia, Ireland)
• Fitbit(San Francisco, California)
• Samsung Health (South Korea )
• Apple Health (United States)
• IOS (United States)
• Android (Palo Alto, California)

14. Health connect

The Use of information received from Health Connect will adhere to the Health Connect Permissions policy, including the Limited Use requirements.

a. Collection and Usage of Health Data:
We value the privacy and security of our users. Our mobile application requests access to health-related permissions, specifically the ability to read steps and sleep information. This data is collected for the sole purpose of enhancing the user experience and providing features related to health and fitness.

b. Purpose of Health Data Access:
Our app utilizes health-related permissions to track daily steps, and sleep patterns. This data is processed locally on the user’s device and is not shared with any third parties.

c. User Consent:
By using our app, you explicitly consent to the collection and usage of health-related data for the purposes outlined in this privacy policy. You have the option to grant or deny these permissions within the app settings.

d. Security Measures:
We implement robust security measures to protect the confidentiality and integrity of health-related data. This includes encryption and secure storage.

e. Data Retention:
We retain health-related data only for as long as necessary to fulfill the purposes outlined in this privacy policy. Users can request the deletion of their data by

f. Third-Party Services:
Our app does not share health-related data with any third-party services, advertisers, or external entities. We do not engage in the sale or exchange of user data

15. YOUR RIGHTS

Access to your personal data and data portability
You have the right to access the personal data we hold about you. You have the right to request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Updating and/or deleting your personal data
We encourage you to update your personal data provided to us any time there are changes in your personal data.Your personal data can be deleted from our servers unless we are entitled or obliged by applicable law and regulations to keep and process such information regardless of withdrawal of your consent.

Following your request for deletion of your personal data, these will be deleted from our servers without undue delay; please note it may take a period of up to two (2) months to ensure complete deletion of any information stored in our back-up.

You may also contact us to review, update or delete personal data stored about you. For relevant contact details please see section 18 below. Please note that prior to accessing and requesting changes to your data, we will need to verify your identity properly.

Right to restriction of processing, right to object and marketing preferences
You have the right to restrict processing of your personal data if the personal data is not correct, or if the processing is unlawful, in the event that you oppose erasure of your personal data, if we no longer needs your personal data for the purposes of processing but storing such data is requested by you for the establishment, exercise or defence of legal claims, or if you have objected to processing and verification and a decision about whether we still have a legitimate interest in the given personal data is pending. Please see section 18 for relevant contact details.

At any time you have the right to object to processing of your personal data that has been collected and processed for the purposes of legitimate interests pursued by us, for instance when we make your future bookings easier by remembering your details or when we conduct analytics and statistics on your use of our services. Please see section 18 for relevant contact details.

You can ask us to stop sending you marketing messages at any time or by following the opt-out links on any marketing message sent to you or by contacting us at any time.

Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a product/service purchase, warranty registration, product/service experience or other transactions.

Right to withdraw your consent
Some of our processing activities may be based on your consent. In these situations you will have the right to withdraw your consent at any time. Withdrawal of your consent will not affect the lawfulness of processing conducted prior to the withdrawal.

If you withdraw your consent, we and third parties involved in personal data processing will cease to process your personal data, unless and to the extent the continued processing or storage is permitted or required according to the applicable personal data legislation or other applicable laws and regulations. Please note that as a consequence of your withdrawal of your consent, we may not be able to meet your requests or provide you with our services.

Right to complain
If you want to complain about a privacy breach, please contact us by sending your complaint to by post or email to the address or email address shown at the bottom of this policy.

We will acknowledge receipt of your complaint within five (5) business days. We will do our best to resolve it as quickly as possible and within one (1) month from the date of complaint. In case a response would require longer than one (1) month, we will let you know and inform you of the relevant reason(s).

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.
16. MISCELLANEOUS

Third-party websites, plug-ins and services
Our website and apps may contain links to third party websites and plug-ins, for instance a social media login plug-in. If you choose to use these websites, plug-ins or services you may disclose your information to those third parties. We are not responsible for the content or practices of those websites, plug-ins or services. The collection, use, and disclosure of your personal data will be subject to the privacy policies of these third parties and not this Privacy Policy. We urge you to read the privacy and security policies of the relevant third parties.
Use by children

We do not target and our website and apps are not intended to attract children. Accordingly, our online services that collect personal data are not directed at and should not be accessed by individuals under the age of sixteen (16) years, and we request that such individuals do not provide any personal data to us. Minors must obtain express consent from parents or legal guardians prior to accessing or providing any personal data. If notified by a parent or guardian, or discovered by other means, that a child under the age of sixteen has provided his or her personal data to us we will delete the child’s personal data that is in our possession.

Changes to our Privacy Policy
We may modify or update this Privacy Policy when necessary to reflect changes in our products and services, changes in applicable legislation, regulations or practice and to address customer feedback. Accordingly, please review it periodically. The date of the latest update is always provided on the top of the document.

Contact details
If you have questions about this Privacy Policy or the processing of your personal data, please contact us at:
Mysupportroom Ltd, 20-22 Wenlock Road, London, England, N1 7GU.
Alternatively please send an e-mail to [email protected]

MySupportRoom Ltd is a company incorporated and registered in England and Wales with company number 12554309 whose registered office is at Mysupportroom Ltd, 20-22 Wenlock Road, London, England, N1 7GU.