Privacy Notice

This notice is layered, so you can easily find the information that is applicable to you. Please click the headings for each section in order to expand and read the full text.

There is a Glossary of terms at the end of this document.

Introduction – please read me

Please read this Privacy Notice and any other privacy notice or fair processing notice we may provide on specific occasions carefully, as it is meant to help you understand what information we collect, why we collect it, and how you can update, manage, export and delete your information.

This Privacy Notice supplements the other notices and is not intended to override them.

We do not and will not sell your data to third parties.

Websites and Applications in scope of this Privacy Notice

My Online Therapy: Self Care

My Online Therapy: Therapists

Who we are

Company details

My Online Therapy is owned and run by My Online Therapy Ltd, a company incorporated and registered in England and Wales with company number 14006381, whose registered office is at 128 City Road, London, EC1V 2NX, United Kingdom.

You may know us by our brand name: My Online Therapy.


My Online Therapy Ltd is the Controller (registered with the ICO under number ZA456175) and responsible for your Personal Data under this Privacy Notice. This means we decide why we collect your data, how we collect it, what data is collected, how this data is going to be used and how this data is protected.

Our Psychologists

Our Psychologists are all registrants of the Health and Care Professions Council (HCPC). The HCPC is a regulator whose main aim is to protect the public. To do this, it keeps a register of psychologists who meet its standards for training, professional skills, behaviour, and health. Our Psychologists have a professional and legal responsibility to respect and protect the confidentiality of their clients at all times.

Psychologists are also Controllers of your Personal Data and have their own privacy notice. Please ask your Psychologist for a copy of their privacy notice before starting your therapy to make sure you understand their information practices, as this Privacy Notice does not cover the interaction between you and your Psychologist.

Our commitment

We respect your right to privacy and are committed to protecting it and complying with Data Protection Law. We will always keep your Personal Data safe. We will be clear and open with you about why we collect your Personal Data and how we use it. Where you have choices or rights, we will explain them to you and respect your wishes.

How to contact us

If you have questions about this Privacy Notice or the processing of your Personal Data, please contact us at:

Postal address

The Data Protection Officer
My Online Therapy Ltd,
128 City Road,
United Kingdom.


[email protected]


Data protection officer (DPO)

We have appointed GRCI Law Limited as our DPO, who is responsible for overseeing questions in relation to this Privacy Notice. If you have any questions about this Privacy Notice, our privacy practices or how we handle your personal information, please contact our DPO.

Our EU representative

We have appointed IT Governance Europe Ltd to act as our EU representative. If you wish to exercise your rights under the EU General Data Protection Regulation (EU GDPR), or have any queries in relation to your rights or general privacy matters, please email our representative at [email protected].

Please ensure you include our company name in any correspondence you send to our representative.

Personal information we collect about you

We may collect, use, store and transfer different kinds of Personal Data about you depending on our relationship with you:

Identity data

Includes first name, last name, date of birth, title and gender.

Contact data

Includes your billing address, email address and telephone number(s).

Insurance data

Your insurer’s details, insurance membership number and claim number.

Location data

We may collect your location data from your IP address and telephone codes.

Transaction data

Includes details about payments to and from you and other details of services you have purchased from us.

Payment data

Includes details about payments made via our Website and Apps in order to pass on to Stripe for storage and processing. All payments are managed by Stripe.

Technical data

Includes IP address, your login data, browser type and version, time zone setting and location, browser plugin types and versions, operating system and platform, and other technology on the devices you use to access our site or our Apps.

Profile data

Includes your email and password, the services you have used on our site or our Apps, your use of social media functions on our Website or our Apps for authentication, feedback, survey responses and such information about your health as you provide to us.

Usage data

Includes information about how you use our Website or Apps and the services you use.

Candidate data

Includes information you have provided to us in your curriculum vitae, covering letter and/or application form, including name, title, address, telephone number(s), personal email address, date of birth, gender, employment history, qualifications, areas of specialisms and registrations with professional bodies such as the Health and Care Professions Council (HCPC).

This also includes any information you provide to us during an interview.

Marketing and communications data

Includes your preferences in receiving marketing from us and our third parties and your communication preferences.

Video sessions

We do not collect data from your video sessions. Your video sessions with Psychologists are not recorded.

Therapy notes and chat sessions

Psychologists may make their own session notes and store them independently – these notes are not stored on our system and are the responsibility of the therapist as controller of this data. Therapists are also able to make and store session notes within our platform. These notes are associated with your session records and are visible only to your therapist and their supervisor.

Our platform also provides online chat sessions with your Psychologist and stores the chat history of any previous sessions, which may include Special Category Personal Data should any such details have been discussed during the session. The chat history data from previous sessions are only available to you and your therapist.

For more information, please also see your Psychologist’s privacy notice or contact them.

Special Category Personal Data

Special Category Personal Data is personal data that needs more protection because it is sensitive, and we may collect this type of personal data from you in the course of providing you with our services or during our interactions with you.

Your online chat sessions may contain Special Category Personal Data

Health data is Special Category Personal Data and we collect it when you provide us information about your health in our self-assessment questionnaires or insurance standard questionnaires. We also may collect information about your moods from our mood check-ins.

Aggregated Data

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your Personal Data but is not considered Personal Data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing a specific Website feature. However, if we combine or connect Aggregated Data with your Personal Data so that it can directly or indirectly identify you, we treat the combined data as Personal Data, which will be used in accordance with this Privacy Notice.

We will not process your Special Category Personal Data in order to aggregate it without a Lawful Basis to do so.

How we get your Personal Data

We use different methods to collect data from and about you, including through:

Personal Data provided directly by you

You may give us your Personal Data by filling in forms, surveys, questionnaires or assessments on our Apps or Website, by applying to work for or with us, or by corresponding with us by post, phone, email, chat or otherwise. This includes Personal Data you provide when you:

  • Register to use our Apps, Website or services, or to receive general, market or commercial information;
  • Make uploads such as a user profile image and subscribe to access self-care content;
  • Start or complete an assessment and/or questionnaire;
  • Download our Apps;
  • Make an in-App purchase;
  • Create an account on our site or via our Apps;
  • Enter a promotion or survey;
  • Give us feedback or contact us; or
  • Complete our Net Promoter Score (NPS) rating tool.

Data we collect when you use our Websites and Apps

Each time you interact with our Website or use our App, we will automatically collect Personal Data, including technical data about your device, your browsing actions and patterns, content and usage data. We collect this data using Cookies, server logs and other similar technologies like pixels, tags and other identifiers in order to remember your preferences, to understand how our Website and Apps are used, and to customise our marketing offerings.
Please see our Cookie Policy for further details.

Information we receive from third parties

We may receive Personal Data about you from various third parties, such as:

  1. Device data from the following parties:
    • Analytics providers such as Google.
    • Advertising networks.
    • Search information providers.
  2. Contact, financial and transaction data from providers of technical, payment and delivery services, such as Stripe;
  3. Transactional data from app stores for in-App payments, such as the Apple App Store and Google Play Store;
  4. Technical data and device data from the following parties:
  5. Providers collecting survey information, such as SurveyMonkey and Typeform;
  6. Psychologists providing general and Aggregated Data to ensure sufficient resources and health and safety obligations;
  7. Information about our candidates from referees, recruitment agencies and social media such as LinkedIn; and
  8. Reviews from providers such as Trustpilot.

Information we receive from public sources

Identity and contact data from publicly available sources such as the UK Companies House and the electoral register inside the UK.

Unique application numbers

When you want to install or uninstall a service containing a unique application number or when such a service searches for automatic updates, that number and information about your installation, for example the type of operating system, may be sent to us.

How we use personal information


We need your Personal Data to conduct our business and provide you with our Apps and services. Most commonly we will use your Personal Data in the following circumstances:

  • Where you have consented before the processing.
  • Where we need to perform a contract, we are about to enter or have entered with you.
  • Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
  • Where we need to comply with a legal or regulatory obligation.

UK GDPR/EU GDPR Lawful Basis table

The table below describes the ways we plan to use your Personal Data, and which Lawful Basis we rely on to do so. We have also identified what our legitimate interests are where appropriate.
For more information on the Lawful Basis we use to process your data under the UK GDPR and EU GDPR, see our Lawful Basis table  below or contact us.

Lawful Basis Table

We use your Personal Data on the basis that it is necessary for us to provide our services and products to you.When you sell or purchase a service and/or use our Apps and Website or register with us, you are entering into a contract with us.
When you register as a new client, insurance recipient or supplier and we interview and onboard you.Service delivery
In order to be able to deliver our services or receive services in physical or digital form.Account administration

  • When we administer your account, take, or receive payment, deal with any transaction, respond to your queries, refund requests and complaints.
  • We do not collect clients’ payment information.
  • When we collect and recover money owed to us (usually from insurance companies and clients).
  • When we manage and store your chat sessions.

Relationship management
To manage our relationship with you, which may include:

  • Notifying you of changes to our terms or Privacy Notice;
  • Notifying you of changes to the Apps or any services processing and delivering your subscription or booking;
  • Processing orders; and
  • Asking you to leave a review or take a survey.

Appointment management

  • For the scheduling of appointments requested by our clients and to contact our clients in relation to appointment scheduling (please note that we may use your telephone number to contact you in relation to scheduling appointments).
  • To confirm your scheduled appointment and send you a push notification before the start of your session.
  • To share data with our Psychologists for the purpose of arranging appointments with you.

Insurance management
Recognising clients covered by insurance agreements and sharing a report with the client’s insurer as to account activation.

To be able to contact you regarding updates or informative communications related to the functionalities, products, or contracted services, including the security updates, when necessary or reasonable for their implementation.

Handling the information you submit to us enables us to respond effectively. We may also keep a record of these queries to inform any future communications between us and to demonstrate how we communicated with you throughout our contractual relationship.

Therapy outcomes
Therapy outcomes are measured by collecting the results of questionnaires.

These are processed to enable us to match a client or potential client with our Psychologists having the most relevant specialism to meet their needs.

Legitimate interest
When we rely on this, we will carry out a Legitimate Interests Assessment to ensure we consider and balance any potential impact on you (both positive and negative), and your rights under Data Protection Law.Our legitimate business interests do not automatically override your interests – we will not use your Personal Data for activities where our interests are overridden by the impact on you unless we have your consent or are otherwise required or permitted to by law.
Managing our business
We hold Personal Data for our own legitimate business interest. This relates to us managing our business to enable us to give you the best service/products and most secure experience, including:

  • When we respond to your queries and complaints, where you are not a client or supplier, or a potential client or supplier.
  • To monitor trends so we can improve our services, Website and Apps.

Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud, and in the context of a business reorganisation or group restructuring exercise).

Provide and maintain Websites and Apps.
To provide and maintain our Websites, Apps and platforms, including to monitor the usage of these, troubleshooting, data analysis and system testing necessary for our legitimate interests (for running our business, provision of administration and IT services, network security).

Recommendations and marketing

  • To make recommendations to you about services that may interest you.
  • To measure and analyse the effectiveness of the advertising we serve you.
  • To create custom audiences or lookalike audiences on Facebook to help us advertise our service.
  • Ensuring that our marketing is tailored to your interests and to keep our records up to date and to provide you with marketing as allowed by law.
  • To make suggestions and recommendations to you about goods or services that may be of interest to you and necessary for our legitimate interests (to develop our products/services and grow our business).

We process your data to protect you against fraud when transacting on our Website, and to ensure our Websites and systems are secure.

Recruitment of candidates (contractors, employees and providers)
We will use the personal information we collect about you to assess your skills, qualifications and suitability for the work.

It is in our legitimate interests to decide whether to appoint you to work since it would be beneficial to our business to appoint someone to that work.

Therapy outcomes
Therapy outcomes are measured by collecting the results of client questionnaires. The performance of the Psychologists is tracked based on these outcome scores; it is in our legitimate interest to ensure that Psychologists’ performance is tracked to ensure clients get the best possible treatment and to measure the efficiency of our services.

When we capture your service reviews, for example when you buy goods and services from us, we may follow it up with an enquiry about your experience of the service to help us gauge customer satisfaction.

Research and analysis
For statistical analysis, so that we can monitor and improve services, Websites and Apps, or develop new ones.

Necessary for our legitimate interests (to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy).

For statistical and scientific research in the public’s interest by improving understanding of mental health conditions and treatment thereof.

Data analytics
We use data analytics to improve our Website, products/services, marketing, customer relationships and experiences.

Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy).

Necessary for our legitimate interests (to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy).

Rights and claims
To enforce or apply our Website terms of use, our policy terms and conditions, or other contracts.

To exercise our rights, to defend ourselves from claims and to keep to laws and regulations that apply to us and the third parties we work with.

Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud, and in the context of a business reorganisation or group restructuring exercise.

Legal obligations
We may use your Personal Data to comply with laws (for example, if we are required to co-operate with a police investigation after a court order orders us to).
Legal requirement
The processing is necessary for compliance with My Online Therapy’s legal obligations, such as but not limited to healthcare requirements, security requirements and accounting requirements.To comply with applicable law, for example in response to a request from a court or regulatory body, where such request is made in accordance with the law.Data subject rights
Verifying your identity when you exercise your data subject rights.Fulfilling data subject rights requests.Criminal activity
To detect fraudulent or criminal activity, we may share information with forces such as the police.
We may have to get your consent to use your Personal Data, such as when we collect and use Special Category Personal Data about you or when we want to send you marketing.We will get your consent before sending third-party direct marketing communications to you via email or text message or before processing any Personal Data relating to your health (which usually only occurs when you first sign up with us before you speak with a Psychologist as part of the digital triage process described above).You have the right to withdraw consent to marketing at any time by contacting us.Wherever consent is the only reason for using your Personal Data, you have the right to change your mind and/or withdraw your consent at any time by clicking the Unsubscribe button at the bottom of an applicable email or by withdrawing your consent here.

  • For marketing our products and services like email marketing newsletters generally.
  • To deliver content and advertisements to you.
  • To measure and analyse the effectiveness of the advertising we serve you.
  • To monitor trends so we can improve the Apps.
  • To facilitate visitors’ use of the Websites, we may collect IP addresses and store Cookies on visitors’ devices.
  • Sending third-party direct marketing communications to you via email, letters or phone calls.

Special Category Personal Data

  • Express consent for collecting and processing Special Category Personal Data.
  • When you provide some initial information about your to either match with an appropriate Psychologist or, in the case of a questionnaire provided by an Insurance provider, to ensure that your agreement with the insurance provider is met.

To install an App and register you as a new App user.

When you download our mobile Apps, you may allow us to obtain your precise location from your mobile device. We use this information to deliver personalised content and for analytics.

Push notifications
We may also offer automatic (‘push’) notifications. We will provide push notifications only if you opt-in to receive them. You do not have to provide location information or enable push notifications to use our mobile Apps.

Special Category Personal Data

Reason for processing Special Category Personal Data

Where we are processing your Special Category Personal Data, we must, in addition to the Lawful Basis in the Lawful Basis table, process your Special Category Personal Data because of an additional condition, including:

  • You have given us your explicit consent to process that data;
  • We are required by law to process that data in order to ensure we meet our ‘know your client’ and ‘anti-money laundering’ obligations (or other legal obligations imposed on us);
  • The processing is necessary to carry out our obligations under employment, social security, or social protection law;
  • The processing is necessary for the establishment, exercise, or defence of legal claims;
  • You have made the data manifestly public; or
  • Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes.

Commonly we will process that data:

  • On your express consent; or
  • On the basis of scientific research in the public interest.

For more information about us using your Special Category Personal Data, please see the Special Category Personal Data table below or contact us. The ICO has some useful information here.

Special Category Personal Data table

Express consent
We may have to get your explicit consent to use your Special Category Personal Data.We will get your consent to process any Personal Data relating to your health (which usually only occurs when you first sign up with us before you speak with a Psychologist as part of our digital triage process).Wherever consent is the only reason for using your Personal Data, you have the right to change your mind and/or withdraw your consent at any time.Withdraw your consent here.
We use standard questionnaires to score/grade the severity of conditions, e.g., generalised anxiety disorder or depression, and to measure therapy outcomes. Our initial assessment questionnaire is a bespoke chatbot-style question set, designed by our highly experienced clinical team, to grade the issues and severity levels and capture any other relevant factors before matching our clients with a Psychologist.Therapy outcomes
Therapy outcomes are measured by collecting the results of your questionnaires. The performance of your Psychologist is tracked based on these outcome scores.Mood check-ins
Our Apps and Website may use Mood check-ins, which allow you to voluntarily indicate mood scores relating to our self-care content to allow us to determine the content success and when to refer you for treatment.Chat sessions
You may make use of our chat feature and have online chat sessions with your Psychologist. The chat history of previous sessions is saved so both you and the Psychologist can make use of them; this Personal Data may include Special Category Personal Data.Psychologists
Your completed assessment determines the list of suitable Psychologists. Prevalent issues user bases are used to predict which types of therapists meet your needs.

Aggregated Data
We may ask for your express consent to anonymise the health data you provided in your assessments and questionnaires to create Aggregated Data.

Archiving, research, and statistics (with a basis in law) We may use your Special Category Personal Data for researching conditions and better ways of treatment. We will minimise the data use and anonymise that Personal Data wherever possible.
Vital interests In extraordinary circumstances, we may process your Special Category Personal Data to protect your vital interests or that of another natural person where you are physically or legally incapable of giving consent and it is necessary to protect an interest that is essential to your life or that of another natural person, for example if you were unconscious.
Using your data for other reasons

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the Lawful Basis that allows us to do so.

Marketing and advertising

Using Personal Data for marketing purposes

We may use your information to provide you with details about services.

Where we are legally required to obtain your consent to provide you with certain marketing materials, we will only provide you with such marketing materials where we have obtained such consent from you.

You can opt out of us using your personal information for marketing purposes by following the unsubscribe link included in each marketing email or by contacting us via email ([email protected]).

Disclosing your Personal Data to others

Sharing your Personal Data safely

We require all third parties to respect the security of your Personal Data and to treat it in accordance with the law.

We do not allow our third-party service providers to use your Personal Data for their own purposes. We only permit them to process your Personal Data for specified purposes and in accordance with our instructions.

Who we share Personal Data with

We may share your personal information with the following organisations that help us manage our business and deliver our products, applications, or services, or where we are legally obliged to share information, including with:

  • Business partners, our employees, psychologists, contractors’ consultants, agents and professional advisors;
  • Insurance providers, including Vitality Insurance;
  • Third parties carrying out services on our behalf, including billing, sales, marketing agencies, analytics, research, university research, data storage, validation, security, fraud prevention and legal services;
  • GRCI Law for data privacy services;
  • Stripe for payment processing;
  • Third-party service providers to assist us with client insight analytics, such as Google Analytics;
  • Third parties to which we outsource certain services such as couriers, IT systems or software providers, IT support service providers, and document and data storage providers;
  • Third-party platforms to manage and deliver customer relationship management (CRM);
  • Third parties for the purposes of App development;
  • Third parties in the event of any merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our assets (including without limitation in connection with any bankruptcy or similar proceedings);
  • Other organisations for the purposes of fraud/crime protection and investigation;
  • Courts of law and government, regulatory authorities or third parties to the extent required by law, court order or a decision rendered by a competent public authority and for the purpose of law enforcement; or
  • Other third parties subject to your consent.

Why we share your Personal Data

As a general principle, we share data in order to facilitate or improve our services or offers. We will get your express opt-in consent before we share your Personal Data with any third party for marketing purposes.

You can opt out of us using your personal information for marketing purposes by following the unsubscribe link included in each marketing email or by contacting us via email ([email protected]).

From time to time, we may share Personal Data and other information that we have collected about you:

  • To get help in running our business, and delivering our products, Apps and services;
  • Where we are legally required to do so, such as in response to court orders or legal process, or to establish, protect or exercise our legal rights or to defend against legal claims or demands;
  • Where we are acquired by or merged with another entity (in which case we will require such entity to assume our obligations under this Privacy Notice or inform you that you are covered by a new privacy notice);
  • If we believe it is necessary in order to investigate, prevent or act regarding illegal activities, fraud, or situations involving potential threats to the rights, property or personal safety of any person, or other exigent circumstances; or
  • If we believe it is necessary to investigate, prevent or act regarding situations that involve abuse of our infrastructure or the Internet in general (such as voluminous spamming, denial-of-service attacks, or attempts to compromise the security of the Website infrastructure), or to otherwise protect our assets or rights.

Sharing your Personal Data overseas

Please note that we may send personal information outside of the country generally for, but not limited to, reasons relating to processing and storage by our service providers. For example, we may have Cloud storage providers with data storage facilities in the US, Canada, Europe, Japan, Pakistan, or other countries.

When we do this, we will ensure it has an appropriate level of protection and the transfer is made in line with Data Protection Law. Often, this protection is set out under a contract with the organisation that receives that information. You can find more details of the protection given to your information when it is transferred overseas by contacting us.

Data security

We have put in place appropriate security measures to prevent your Personal Data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your Personal Data to those employees, agents, contractors and other third parties that have a business need to know. They will only process your Personal Data on our instructions, and they are subject to a duty of confidentiality.

We periodically test the security of our systems to check for vulnerabilities.


Unfortunately, the transmission of information via the Internet is not completely secure. Although we will do our best to protect your Personal Data, we do not have any control over what happens between your device and the boundary of our information infrastructure. You should be aware of the many Information Security Risks that exist and take appropriate steps to safeguard your own information.


All information you provide to us is stored encrypted in rest and in transit. Any payment transactions will be managed by Stripe and will be encrypted.


We have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

Third-party websites, plugins and services links to other websites

You should be aware that information about your use of this website (including your IP address) may be retained by your ISP (Internet Service Provider)  , the hosting provider and any third party that has access to your Internet traffic.

Our Website and Apps may contain links to third-party websites and plugins, for instance a social media login plugin. If you choose to use these websites, plugins, or services, you may disclose your information to those third parties.

We are not responsible for the content or practices of those websites, plugins, or services. The collection use and disclosure of your Personal Data will be subject to the privacy notices of these third parties and not this Privacy Notice. We urge you to read the privacy and cookie notices of the relevant third parties.

Use by children

We do not target children, and our Website and Apps are not intended to attract children. Accordingly, our online services that collect Personal Data are not directed at and should not be accessed by individuals under the age of 18 years, and we request that such individuals do not provide any Personal Data to us.

Minors must obtain express consent from parents or legal guardians before accessing or providing any Personal Data. If notified by a parent or guardian, or discovered by other means, that a minor under the age of 18 has provided their Personal Data to us, we will delete the minor’s Data that is in our possession.

Retention of your Personal Data

We will keep your Personal Data in line with our data retention policy for no longer than is necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements.

To determine the appropriate retention period for Personal Data, we consider the amount, nature and sensitivity of the Personal Data, the risk of harm from unauthorised use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements.


We use Cookies and similar technologies like pixels, tags, and other identifiers to remember your preferences, to understand how our Website and our Apps are used, and to customise our marketing offerings.

Further details can be found in our Cookie Policy.

Rights of data subjects

You have several rights under Data Protection Law. The rights available to you depend on our reason for processing your information and are set out in the Table of your rights. Information on your rights under Data Protection Law can also be found at

Table of your rights

Right to be informed We have a legal obligation to provide you with concise, transparent, intelligible, and easily accessible information about your personal information and our use of it. We have written this notice to do just that, but if you have any questions or require more specific information, you can contact us.
Right of access You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information. When you request this data, this is known as making a data subject access request (DSAR). In most cases, this will be free of charge; however, in some limited circumstances, for example repeated requests for further copies, we may apply an administration fee. Please contact us for more information or complete this form to exercise this right.
Right to rectification You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies. Please contact us for more information or complete this form to exercise this right.
Right to erasure You have the right to ask us to erase your personal information in certain circumstances. We have the right to refuse to comply with a request for erasure if we are processing the Personal Data for one of the following reasons:

  • To exercise the right of freedom of expression and information.
  • To comply with a legal obligation.
  • To perform a task in the public interest or exercise official authority.
  • For archiving purposes in the public interest, scientific research, historical research or statistical purposes.
  • For the exercise or defence of legal claims.

Please contact us for more information or complete this form to exercise this right.

Right to restriction of processing You may ask us to stop processing your Personal Data. We will still hold the data but will not process it any further. This right is an alternative to the right to erasure. If one of the following conditions applies, you may exercise the right to restrict processing:

  • The accuracy of the Personal Data is contested.
  • Processing of the Personal Data is unlawful.
  • We no longer need the Personal Data for processing, but the Personal Data is required for part of a legal process.
  • The right to object has been exercised and processing is restricted pending a decision on the status of the processing.

Please contact us for more information or complete this form to exercise this right.

Right to object to processing You have the right to object to processing in certain circumstances. You can also object if the processing is for a task carried out in the public interest, the exercise of official authority vested in you, or your legitimate interests (or those of a third party).

Please contact us for more information or complete this form to exercise this right.

Right to data portability This right only applies if we are processing information based on your consent or for the performance of a contract and the processing is automated.

Please contact us for more information or complete this form to exercise this right.

How to exercise your rights

In most circumstances, you do not need to pay any charge for exercising your rights. We have one month to respond to you.

To exercise your rights or get more information about exercising them, please contact us, giving us enough information to identify you.

How you can complain to or about us

We hope that we can resolve any query or concern you raise about our use of your information. Please contact us first and title your email “Complaint”. All complaints will be treated in a confidential manner and we will try our best to deal with your concerns.

You have the right to lodge a complaint with a supervisory authority in the EEA member state where you work or normally live, or where any alleged infringement of Data Protection Law occurred.

The supervisory authority in the UK is the ICO, which may be contacted at or by telephone on 0303 123 1113.

Aggregated Data means data that can be compiled from numeric or non-numeric data.

The data are collected and summarised for the purpose of statistical analysis or reporting. It is limited to recognising general trends due to the non-specific nature of the information.

It could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity.

Anonymisation means a type of information sanitisation whose intent is privacy protection. It is the process of removing personally identifiable information from data sets, so that the people whom the data describe remain anonymous.

In order to be truly anonymised under the UK GDPR and EU  GDPR, the personal data must be stripped of sufficient elements that mean the individual can no longer be identified. However, if you could at any point use any reasonably available means to re-identify the individuals to which the data refers, that data will not have been effectively anonymised but will have merely been pseudonymised and subject to data protection law.

For more information from the ICO read here

App(s) means an application that is a computer program or piece of software designed for a particular purpose that you can download onto a mobile phone or other mobile device.

My Online Therapy Apps

Our apps include iOS (Apple App Store) and Android (Google Play Store) My Online Therapy apps.

Consent The UK GDPR and EU GDPR. sets a high standard for consent , consent should be given by a clear affirmative act establishing a freely given, specific, informed, and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement.

Controller means the natural or legal person, public authority, agency or any other entity or person who alone or jointly with others determines the purposes and means of the processing of personal data.

Our entry as a Controller on the ICO’s Data protection register can be found here.

Cookies means a small file of letters and numbers that is stored on a browser or the hard drive of a computer. Cookies contain information that is transferred to a computer’s hard drive.

Controllers must have users’ informed consent before storing cookies on a user’s device and/or tracking them.

For more information, please read our cookie notice.

The ICO provides information about cookies here.

DPA 2018 UK Data Protection Act 2018
Data Protection Act 2018 (
Data Protection Law means all applicable data protection and privacy legislation in force from time to time including the UK GDPR and the EU GDPR, the Electronic Communications Directive 2002/58/EC (as updated by Directive 2009/136/EC) and the Privacy and Electronic Communications Regulations 2003 (SI 2003 No. 2426) as amended, and any other legislation relating to personal data and all other legislation and regulatory requirements in force from time to time that apply to the use of personal data.
Encryption is the process that scrambles readable text so it can only be read by the person who has the secret code, or decryption key. It helps provide data security for sensitive information.

For more information see the Encryption | ICO and the GDPR’s requirements for encryption.

EU Representative the GDPR requires organisations not established in the EU to appoint a representative in an EU member state (or the EEA), if (i) it is apparent that the organisation intends to offer goods or services to individuals in the EU or (ii) it monitors the behaviour of individuals in the EU (or the EEA).

For more information see the ICO information here

EU GDPR means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing the Directive.

General Data Protection Regulation (GDPR) – Official Legal Text (

Health and Care Professions Council (HCPC) means the organisation that regulates health, psychological and care professionals in the UK. It sets standards, holds a register, quality assures education and investigates complaints.

The Health and Care Professions Council (HCPC) | (

ICO means the Information Commissioner’s Office, the UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

Home | ICO

Information Security Risks comprises the impacts on individuals or organisations that could occur due to the threats and vulnerabilities associated with the operation and use of information systems and the environments in which those systems operate.

Lawful Basis under the EU GDPR and the UK GDPR, you must have a valid lawful basis to process personal data.

Lawful Basis of processing personal data

There are six lawful bases for processing personal data available:

  1. Consent: the individual has given clear consent to the processing of their personal data for a specific purpose.
  2. Contract: the processing is necessary for a contract, or because specific steps have been taken before entering into a contract.
  3. Legal obligation: the processing is necessary for compliance with the law (not including contractual obligations).
  4. Vital interests: the processing is necessary to protect someone’s life.
  5. Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.
  6. Legitimate interests: the processing is necessary for an organisation’s legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data that overrides those legitimate interests. (This cannot apply if an organisation is a public authority processing data to perform its official tasks.)

For more information

Lawful basis for processing | ICO

Art. 6 GDPR – Lawfulness of processing

GDPR: lawful bases for processing, with examples – IT Governance UK Blog

Special category data

Special category data is personal data that needs more protection because it is sensitive.

In order to lawfully process special category data, you must identify both a lawful basis under Article 6 of the UK GDPR  and EU GDPR and a separate condition for processing under Article 9. These do not have to be linked.

Legitimate Interests Assessment (LIA) is a form of risk assessment and should be conducted by an organisation when your personal data processing is based on legitimate interest. The LIA is split into three steps:

  • Assessing whether a legitimate interest exists.
  • Establishing the necessity for processing.
  • Performing the balancing test.

Legitimate interest assessment (LIA) | ICO

Net Promoter Score (NPS) is a rating tool. The main purpose of the Net Promoter Score (NPS) question is to calculate a score so we can determine the level of customer loyalty and satisfaction to our business.
My Online Therapy, we, or us means My Online Therapy Ltd, a company incorporated and registered in England and Wales with company number 14006381 whose registered office is at My Online Therapy Ltd, 128 City Road, London, EC1V 2NX, United Kingdom.
Personal Data this is also referred to as “personal information” and it means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

Privacy Notice (also sometimes called a privacy policy or fair processing notice) is a public document from an organisation that explains how that organisation processes personal data and how it applies data protection principles under Articles 12, 13 and 14 of the EU GDPR and the UK GDPR.
Psychologists means the self-employed practitioners who provide therapy and related services to users. The relationship between us and the Psychologists is explained in more detail in our terms and conditions (
Questionnaire(s) includes a PHQ9 questionnaire (a series of nine questions to measure a depression score) and a GAD7 questionnaire (a series of seven questions to measure an anxiety score).
Special Category Personal Data some of the personal data that organisations process is more sensitive and needs higher protection. Under the GDPR, this is known as ‘special categories of personal data, and includes information about a person’s:

  • Race
  • Ethnicity
  • Political views
  • Religion, spiritual or philosophical beliefs
  • Biometric data for ID purposes
  • Health data
  • Sex life data
  • Sexual orientation
  • Genetic data

In order to lawfully process special category personal data, we must identify both a lawful basis under Article 6 of the UK GDPR and EU GDPR and a separate condition for processing under Article 9. These do not have to be linked.

There are ten conditions for processing special category data in Article 9 of the UK GDPR.

Five of these require us to meet additional conditions and safeguards set out in UK law, in Schedule 1 of the DPA 2018.

Special Category Personal Data Conditions for Processing the conditions for processing special category data:

  1. Explicit consent
  2. Employment, social security and social protection (if authorised by law)
  3. Vital interests
  4. Not-for-profit bodies
  5. Made public by the data subject
  6. Legal claims or judicial acts
  7. Reasons of substantial public interest (with a basis in law)
  8. Health or social care (with a basis in law)
  9. Public health (with a basis in law)
  10. Archiving, research and statistics (with a basis in law)

For more information

Art. 9 GDPR – Processing of special categories of personal data –

Special category data | ICO

GDPR | Personal Data vs Sensitive Data: What’s the Difference? (

Supervisory Authorities means the data protection authority tasked with supervising GDPR compliance in each member state of the European Union.

What are Data Protection Authorities (DPAs)? | European Commission (

UK GDPR means the GDPR as transposed into United Kingdom national law by operation of section 3 of the European Union (Withdrawal) Act 2018, together with the DPA 2018, the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019, and other data protection or privacy legislation in force from time to time in the United Kingdom.


Website and including all subdomains thereof, present and future.