UK Privacy Notice

Privacy Notice

Who we are

A MINDFUL MESSAGE LTD (AMM), registered in England and Wales, company number 14093207, provides the platform. Our registered office is 128 City Road, London, EC1V 2NX. Contact our privacy owner at support@foxtech.app. We have not appointed a Data Protection Officer.

Who is responsible depends on your service:

• Organisation-managed care: the organisation named in your invitation or service message controls your counselling information. AMM processes it on their instructions.
• Private care: AMM controls intake, matching, booking/payment administration, platform security and support. Your independent practitioner controls their review of your request, professional service and practice records. AMM processes hosted practice records for them.
• Your practitioner's own clients: an invitation keeps you with that practitioner, outside AMM's global matching pool.
• AMM also controls accounts, subscriptions, professional eligibility and its own legal/compliance records.

Your organisation or practitioner must explain their own purposes, lawful conditions, retention and rights contact. Ask us if a message does not identify the responsible provider. FoxTech supplies approved hosting management and technical support as AMM's processor or subprocessor. Authorised staff may use their named business accounts to administer providers; this does not give them ownership of your counselling records or change who is responsible for each purpose.

The service and your age

The UK service is for people aged 16 or over. It arranges referrals, appointments, payments and practitioner records. Practitioners provide the service identified in your proposal, including mentoring. Mentoring is not diagnosis or clinical treatment. Clinical treatment is delivered by appropriately qualified professionals. It is not an emergency or crisis service. Use emergency or urgent-support services if someone is in immediate danger.

If you are 16 or 17, you can use the referral and privacy-rights routes yourself. We keep privacy defaults high and do not use counselling information for advertising. A practitioner or organisation may need to share limited information to protect someone at risk. They should explain this unless doing so creates risk or the law prevents it. Consent to treatment is a separate clinical decision, including capacity and safeguarding.

We block new under-16 referrals before storing them. Any existing records are restricted to lawful exit, rights, safeguarding, incident or retention needs.

Information and purposes

We receive information from you, your organisation/practitioner, identity and payment providers, service operations and support. It includes contact and age details, accounts/roles, referral and health information, appointments, questionnaires, feedback, professional credentials, payment references and privacy/security records.

AMM purpose	Legal basis
Private intake, review, matching and arranging your requested service	Contract steps under Article 6(1)(b); separate explicit consent under Article 9(2)(a) for necessary health information
Accounts, subscriptions and booking/payment administration	Contract; legal obligations for applicable accounting/tax records; legitimate interests for authorised business contacts
Health-revealing private appointment and attendance administration	Contract under Article 6(1)(b), with separate explicit consent under Article 9(2)(a) for the necessary health information
Authentication, security, fraud prevention, reliability and support	Legitimate interests in protecting and operating the service; legal obligation where applicable
Rights, complaints, incidents and legal claims	Applicable legal obligation or legitimate interests; a separate special-category condition where needed

Organisations and independent practitioners identify their own lawful bases and health-data conditions. AMM does not select those for them. We assess necessity and people's rights where relying on legitimate interests. Required fields are identified; without necessary details we may be unable to arrange the requested service. Optional fields are marked.

Your client account and access to your care

AMM prepares a client account automatically to help you manage requested or invited care. A private request or practitioner invitation can start that preparation; for organisation-managed care it may start when you first join your booked session. We send WorkOS the minimum identity details, such as your name and email address, needed to create or reuse a sign-in identity. We do not send referral reasons, questionnaire answers, clinical notes or meeting content to WorkOS. A prepared identity is not a verified account and does not itself grant access to care.

To link a particular care record, you must sign in with your currently verified identity and complete that record's secure claim in the original booking browser. We record the exact claim, identity and time. A matching email address, a staff role or an invitation alone does not link historical records. If you lose access to the original browser, contact support; support cannot merge records simply because their email addresses match.

If the original browser is unavailable or the intended recipient needs correcting, you can request assisted recovery while signed in. We keep your recovery case, its status, expiry and decision/completion dates, and the minimum security proofs and links to your verified identity and the accountable reviewers. A request does not confirm that a care record exists or give access to it. The responsible care owner verifies you through a pre-existing care relationship or pre-existing verified contact, recording the method, verification date and an evidence reference that must not contain personal information. The underlying evidence stays with its responsible owner; this bounded form does not collect raw identity documents or clinical notes.

A different authorised platform operator must independently review the exact case. Neither reviewer can act as the requester. You must then explicitly accept the exact care claim in your recovery browser using your currently verified sign-in. Control of an email address, or an address match, never merges records by itself. If previously issued external meeting or payment access may still be usable, recipient correction waits until the relevant access has been checked and safely retired. Uncertainty stops correction. Changing local access does not recall previous messages or prove that an external reusable link has been revoked; possible misdirected disclosures use our privacy or incident process.

Your client workspace shows your linked care, sessions and their administrative history, payment information and optional form status. Saved questionnaire answers and clinical notes are not automatically displayed there. Access remains limited to your own linked records and the current permissions of the responsible organisation or practitioner. If you also have a professional account, your client workspace is a separate role; professional access does not grant client response rights for someone else's care.

We keep your client contact name and phone number encrypted, separately from your sign-in identity and any professional profile. Editing them does not automatically change existing care contacts: you choose which linked care records to update. Changes to your sign-in email and security methods use WorkOS's verified account controls. Optional reminder and product-update choices are managed in Settings; product updates are off unless you choose them. Essential booking, payment, security and legal messages may still be sent. A product-update choice does not authorise using health information for marketing.

Account administration uses the account, contract and security purposes described above. It is not additional consent to clinical processing or to a practitioner's separate care purposes. Where necessary information reveals health, the relevant health-data condition and controller responsibilities still apply.

Account support and closing My care

You can send an authenticated support request with a topic, short subject and message. Do not include passwords, card details or clinical notes. We encrypt the request in the application. A generic notification tells support that a request is ready; it does not include your message. Current authorised platform operators can open the exact request in the protected support queue, with an audit record. This does not give them routine access to clinical records or your mailbox history. A request may need delivery recovery before it is reviewed; submitting it does not summon emergency help or provide continuously monitored clinical support. You can still use our email, privacy and safety contact routes without a client account.

Closing My care stops new care and cancels future appointments. It does not close a separate practitioner or organisation role, delete your whole sign-in identity or automatically erase records. Started and completed sessions, original agreements and consent, necessary history, privacy requests and payment recovery remain available for their authorised purposes. An already accepted Join keeps its original one-minute Undo period, subject to current identity/security and consent controls; closure does not start a fresh minute. We continue necessary closure and payment follow-up even if account access later stops. A pending release or refund is not a confirmed payment outcome.

Closing My care and withdrawing booking consent are separate actions. You can also ask for erasure through the rights routes below. The responsible controller reviews retention duties, holds and any information that can lawfully be deleted; closing an account does not bypass that review.

Your health-information consent

Private referral submission requires a separate, unticked consent to AMM using necessary health information for intake, review and matching. We record its wording/version and time. It is separate from terms, marketing and treatment consent.

Withdraw at any time using the privacy request route or emailing support@foxtech.app. You do not need an account or receipt to contact us. We may need proportionate identity information to protect your records. Withdrawal may stop matching where we can no longer use necessary information. It does not invalidate earlier lawful processing or erase records lawfully needed for another purpose, such as a claim or safeguarding event.

Processing without consent for safeguarding or confidential counselling requires the exact legal conditions, necessity and safeguards; it is not a routine substitute for consent. Reading this notice, accepting terms and acknowledging the emergency warning are not health-data consent.

Before you confirm a private appointment, we ask separately for your explicit consent to using its details and your attendance confirmation to arrange that session and administer its payment. These details may reveal use of practitioner services even if you answer no questionnaire. The checkbox starts unticked. We keep the statement, version and time against the exact proposal; this applies to free sessions and invitations from your own practitioner too.

Use Withdraw booking consent on your private session link for that session, or email support@foxtech.app if you cannot use the link or your request covers other bookings. The link control stops further attendance, questionnaire and feedback submissions and cancels an open session, including after it starts. Completed history and original consent are preserved; payment is reviewed separately and this is not a promise of an automatic refund. Withdrawal stops future use that depends on that consent and may prevent us continuing the affected booking administration. If you do not consent, contact your practitioner to discuss other arrangements. Withdrawal does not remove cancellation, refund or complaint rights, invalidate earlier lawful processing or automatically erase financial records we must lawfully keep. This consent does not cover questionnaire answers, mentoring notes or your practitioner's separate care purposes.

Who sees your information

For public matching, your chosen first practitioner sees the information needed to review your request, including support needs, urgency and requested appointment. Your backup receives it only if the first declines or does not respond within 24 hours. Other listed practitioners do not receive it simply by appearing in results. For a practitioner invitation, information stays in that practitioner's private-client workflow.

Clinical access is limited by role, organisation and assignment. Organisation administrators see permitted status/administrative information, without routine access to counselling notes, questionnaire answers or session content. AMM/FoxTech support uses redacted information; exceptional raw access needs specific authority, a time limit and audit.

We use WorkOS for identity/access; Google Cloud for hosting, storage and protected backups; Resend for generic service emails; Stripe for payments, refunds, disputes, fraud and accounting; and FoxTech for technical support. Clinical content is excluded from WorkOS, Stripe, generic email and telemetry. Stripe handles card details; AMM keeps necessary payment references and status.

We share information with the responsible controller for rights/incidents and with advisers, regulators, safeguarding bodies or authorities where required or justified. We do not sell health information or use it for advertising. Identifiable research or a new optional purpose requires a separate assessment and appropriate notice/choice.

Session meeting choices

The proposed initial service offers three choices in practitioner profile settings. Connecting Google is optional and is not part of signup or ordinary login. Each automatic route stays disabled until its account, clinical/privacy safeguards and released operation are qualified; a successful Google connection does not by itself make an account eligible for counselling.

Choice	Who arranges the room and is responsible for its account
Use my meeting link — the default	The practitioner supplies a link from their selected provider. AMM stores it encrypted and exposes it through authorised appointment views; it does not connect to that provider, monitor the room or revoke its URL. A pasted Google link is still this choice.
Connect my Google Meet	With the practitioner's explicit Google permission, AMM creates appointment rooms as that connected account. The practitioner is the Google organiser and must establish the account's suitability and applicable privacy/contract arrangements. AMM's own Workspace agreement does not cover a separately consumer-owned room.
Use an AMM meeting room	Where enabled, AMM creates the room through its dedicated company Workspace organiser and assigns the practitioner's verified Google identity as co-host. The practitioner admits the client and delivers care; AMM does not routinely enter the call. The intended production company account has not yet been purchased or qualified.

Clients use the protected AMM Join link, then Google's meeting interface or the supplied provider. Guest entry and any Google-account requirements depend on the selected room and admission controls. A non-Gmail email address alone is not a Google Account. Calendar invitations contain neutral details and secure AMM links. An existing appointment keeps its agreed room and owner when a practitioner changes their profile preference. AMM does not silently switch owners after a failure.

For connected Google routes, AMM requests permission only to create and manage rooms created through this application, plus the minimum identity details needed to bind the account. This does not grant access to unrelated personal meetings, mailboxes, Drive, contacts, phone data or call media. AMM does not request camera or microphone access; Google's own meeting interface handles participants' device permissions and carries their audio/video. Google therefore processes meeting media and related service data under the applicable account terms even though AMM staff do not routinely see it.

AMM processes the verified connected identity, encrypted grant and meeting link, room/owner/co-host references, preparation/recovery state and minimum appointment and audit metadata. This may reveal use of practitioner services. AMM controls its booking, account, security and compliance purposes; for organisation or practitioner-controlled care it processes the authorised meeting administration on that controller's instructions. Google is used under the actual purpose-specific contractual arrangement, not assumed covered by an unrelated hosting or mail account.

The initial automatic service does not collect recordings, transcripts or AI notes, use Google's Media API, or turn provider connections into care, no-show or payment decisions. Clinical generative AI is excluded. Automatic recording, transcription and notes must be off; disabling automatic generation alone does not prove manual capture is prevented. Practitioners assess confidentiality, admission, provider/account terms, international processing and suitability for each person, including anyone aged 16 or 17. Client agreement cannot override a provider restriction. Free consumer-owned clinical hosting is not qualified for this design and remains disabled for live clinical creation until its actual safeguards are established. An accepted link or paid account is not legal approval.

Disconnecting a practitioner Google connection stops new preparation and provider reads under that grant and makes it unusable locally, with supported Google revocation where applicable. Saved booked links are not erased or silently replaced; AMM may no longer be able to manage those practitioner-owned rooms, so affected appointments need explicit recovery. Disconnecting that grant does not remove co-host roles separately assigned by AMM's organiser to existing AMM rooms. Those roles continue under the appointment's authority until cancellation, closure or an authorised replacement requires cleanup. New delegation cannot silently reuse an invalidated identity. Cancelling an appointment or ending a call is not a promise that the Google URL is permanently deleted or cannot be restarted.

Connection secrets are kept only while authorised and usable and are invalidated on disconnect. Necessary appointment, binding and audit records follow the retention/hold periods below; disconnect does not erase lawful booking history. Use the rights/contact routes below for correction, an unexpected artifact or a disclosure concern. We route care-purpose requests to the responsible controller and provide only the necessary support, without routinely copying call content.

Encrypted records from the previous Google meeting setup remain protected under our retention and rights arrangements. AMM no longer uses those grants to access Google accounts. Practitioners can revoke any previous grant from Google Account connections. Revocation does not delete an existing room or end a call.

Session questionnaires and feedback

For an online session, selecting Join session records your intention to join and opens the external meeting link from your authorised client workspace or private session link. We retain the original actor, appointment arrangement and time needed to distinguish that action from another person's response. You have one minute to select Undo. If you do not undo, your client Join can become the appointment's attendance record after that window, including when you have agreed an early start. AMM does not wait for the scheduled start to record that attendance. This is an AMM action, not confirmation that the meeting provider admitted you or that care was delivered. Contact your practitioner if you could not join or the record is wrong. For a session without an online meeting link, use Confirm attendance through your private appointment link when you attend, before your practitioner completes it. Your practitioner may offer GAD-7 or PHQ-9 where appropriate for your service. Neither is selected by default. Answering is optional; you can confirm attendance without questionnaire answers, without preventing completion or agreed payment.

If you choose to answer, the platform stores and displays your answers and records the submission time and source. It does not calculate scores, interpret answers or recommend treatment. Your practitioner may independently calculate and record a total, labelled as a practitioner entry; AMM does not verify that total against your answers. Before saving, you can review your answers. A successful submission shows an answer receipt in that browser view; it disappears when you reload or leave. Contact your practitioner to review your record or request a correction.

Your attendance confirmation and your practitioner's confirmation that the agreed service has been delivered enable the normal payment workflow without waiting for the scheduled end. The agreed duration and price remain unchanged. Questionnaire answers, practitioner-entered totals and optional satisfaction feedback do not determine the price or payment. Answers are not sent to Stripe.

Responses are not continuously monitored. The same general support and emergency notice appears whether or not you answer a questionnaire; it does not notify your practitioner or summon emergency help. Your practitioner remains responsible for reviewing information within their competence, safeguarding and appropriate referral. Contact them directly about concerns. Mentoring is not diagnosis or clinical treatment.

International transfers

Our application and clinical database use UK hosting. This does not keep all provider processing in the UK: WorkOS's identity service permits US processing; Resend sends our emails from Ireland and stores message content and delivery logs in the US. Stripe and Google also use international processing/support arrangements subject to their applicable service and transfer terms.

We use applicable UK contractual transfer safeguards, including providers' standard contractual clauses adapted for the UK, and assess the risks with data minimisation, access controls and encryption. These controls do not make all provider access impossible. Where a valid adequacy route applies it may also be used. Contact us for countries, safeguards and a copy of relevant transfer terms, with confidential information redacted where necessary. Organisations explain their own transfers.

How long records are kept

Record	Standard period
Private referral with no delivered service	90 days after last activity
Completed private session/referral and hosted clinical workflow	Six years after closure
Payment, contract, material audit and privacy/compliance evidence	Normally six years after the relationship or case closes
Privacy export download	30 days
Raw professional-verification document	90 days after a final verification decision
Minimal verification decision evidence	Six years after the practitioner relationship ends

Organisations instruct AMM through their DPA's standard schedule. Practitioners explain retention for their separate practice records. Valid legal, safeguarding, complaint, fraud or regulatory holds can delay deletion for affected records. Backups are protected from ordinary use and expire through the documented cycle.

An assisted-recovery expiry ends permission to continue that recovery; it does not erase the case or start a new retention period. Recovery source records remain subject to manual disposal review of the applicable account, care, financial and casework requirements and any valid holds. Links to the requester, reviewers, claims and care must be reviewed together before source records are deleted.

Your rights and complaints

Depending on the purpose and circumstances, you may request access, correction, erasure, restriction or portability, object to processing, and withdraw consent. For legitimate-interest processing, explain your situation; we stop unless overriding grounds or legal claims justify continuing. Any direct-marketing objection would be honoured.

You can make a request verbally or in writing; no special form is required. Use the signed-in privacy centre, public request form or our email address. The form normally checks your receipt and original email with a single-use link; if you lack either, contact us for another proportionate identity check. Verification does not automatically release data. The privacy owner checks scope, other people's rights, lawful exceptions and secure delivery. AMM answers its controller scope and routes the remainder to your organisation or practitioner. An authenticated client request uses your explicitly linked care records, not all records sharing an email address. Settings shows request status and a download only after the existing review and secure-release requirements are met. A formal access or export response may include clinical information where the responsible controller has authorised its lawful inclusion; ordinary account screens do not automatically reveal that information.

You can also request access to your own recovery-case information before any care is linked. We identify those cases through your verified requester account, not other records sharing an email address. The reviewed response can explain the case's purpose, status and dates without disclosing security proofs, private reviewer evidence or someone else's unclaimed care record.

Send complaints to support@foxtech.app. We acknowledge privacy complaints within 30 days, investigate without undue delay, keep you updated and explain the outcome and relevant escalation options. You can also complain to the ICO; you do not have to wait where the law allows.

Online-safety reports

You can report unsafe content or conduct, or appeal a restriction, at /safety without an account. AMM controls the minimum contact, content reference, allegation, decision and review record needed for its safety duties and complaint handling. Authorised operators review reports privately; necessary limited summaries or legally required authority disclosures may be made, with your safety considered. We do not routinely reveal your identity to the person reported. Do not email clinical records or illegal images. Special-category or offence information requires a separate applicable legal condition; a complaint is not consent to unrelated use. Minimal case decisions follow the six-year compliance-case period; unnecessary raw material is reviewed for removal at closure, subject to lawful holds. You can use the rights and complaint routes above and ask not to receive report follow-up emails.

Cookies, decisions and changes

We use necessary authentication cookies and minimised server security and reliability logs. We do not collect browser performance measurements or use analytics cookies, optional advertising pixels or make solely automated decisions with legal or similarly significant effects. Matching supports your choice; professionals decide suitability and care.

Before first launch, we maintain this initial notice in place. After launch, material changes receive a new version and publication record, and previous effective versions remain available.