Privacy Notice

Personal data is an increasing concern for individuals and it is understandable that service users are interested in how companies look after their data and privacy. Ascenti not only provides care for your well-being; we aim to apply that same level of care to your data and privacy.

This Privacy Notice covers how Ascenti: Collect; Use; Disclose; Transfer; and, Store your data when you use or visit our My Online Therapy website, My Online Therapy Self Care iOS and Android and desktop applications, and My Online Therapy: Therapists iOS, Android and Desktop Applications to obtain and access mental health support.

Ascenti brought the My Online Therapy technology, website and mobile applications in August 2023. If you created an account and used the My Online Therapy website or mobile applications prior to 4th August 2023 this privacy notice does not apply to your data and Ascenti will not hold any of your data.  Your data will be held by the company who ran the website and mobile applications prior to 4th August 2023.

About us

Firstly, some information about us;

We are the Ascenti Group and we act as a data controller responsible for any personal data you provide us when creating an account and using the My Online Therapy Website and mobile applications after 1st August 2023.

The Ascenti Group is Ascenti Physio Limited (Company Number 04530716) and Ascenti Health Limited (Company Number 03225768); both are companies incorporated in England & Wales. Our registered office is Carnac House, Carnac Court, Cams Estate, Fareham, Hampshire, PO16 8UZ.

Your Data Protection Officer

Data Protection Officer: The DPO Centre Limited

Privacy queries: [email protected]

Our commitment to you

Ascenti is committed to protecting and respecting your privacy. Any decision we make regarding data will have considered the 6 principles for processing personal data contained in Data Protection Legislation.

Data Protection Legislation means the Data Protection Act 2018 (DPA 2018), United Kingdom General Data Protection Regulation (UK GDPR), the Privacy and Electronic Communications (EC Directive) Regulations 2003 and any legislation implemented in connection with the aforementioned legislation. Where data is processed by a controller or processor established in the European Union or comprises the data of people in the European Union, it also includes the EU General Data Protection Regulation (EU GDPR). This includes any replacement legislation coming into effect from time to time.

The Information Commissioner’s Office (ICO) is the UK supervisory authority for data protection issues. More information regarding processing principles, as well as information on our additional data protection obligations, can be found on the ICO website .

Scope

This Privacy Notice applies to My Online Therapy service users and visitors to the My Online Therapy website.

We may change this Privacy Notice from time to time, so please check back regularly to keep informed of any updates. This version of the Privacy Notice (version 1.0 My Online Therapy) was updated on 03/08/2023

Information we collect about you

The data we collect depends on the nature of the services we are providing and you access through My Online Therapy but can include:

Information provided when using our digital services, including our online triage tools and our health applications such as ;

Basic details such as name, email address, country of residence, and billing address and card details for card payments;

You can upload a photo or image of yourself to use as your profile image

We collect your date of birth to make sure you are 18 or over before using My Online Therapy services.

The check in for mood, anxiety and depression collect health data regarding your mental health so you can track o and monitor you symptoms and keep track of your progress t hey are not intended as a diagnostic tool.

The online self assessments, helps us match you with the most appropriate therapists and therapy options available to provide you with support and therapy. This assessment will ask an number of questions about your gender, age, physical and mental health, previous treatments, medication, work status, mood and lifestyle such as drug and alcohol use

We may collect details of your insurance provider where relevant

If you book an online therapy session or used the messaging facility we will keep details of contact we have had with you throughout your sessions with our therapists Treatment notes and reports about your health/mental health and any treatment you have received;

Details of the services you have accessed;

Your feedback and treatment outcome information;

Information surrounding complaints and incidents which may have arisen;

Recordings of inbound and outbound telephone calls you make to our support team;

Details of visits to our website (including your IP address, login information, and other analytical information). Please refer to our Cookie Policy for more details; and,

Collect

Your data may be collected:

Via our My Online Therapy website or mobile applications (e.g., when submitting an enquiry on our contact, subscribing to the newsletter, completing the online self-assessment,  mood tracker; our online triage tools, health applications and video-calls, or messaging facility;

By telephone;

By correspondence (including post, text, email or otherwise).

Use

In general we use your data to provide our services to you, including the following specific purposes:

  • Provision of healthcare services and assessments;
  • Sending you your service-related information;
  • Supporting you through your treatment journey,
  • Record keeping and administration purposes;
  • Quality, risk management and training purposes;
  • Compilation of statistical data (Personal Data will not be published or passed on without consent);
  • We want to hear what you think and your contact information may be used to provide an option to complete a satisfaction survey;
  • To facilitate marketing and business development; only with your consent.
  • To allow the billing of services provided and to obtain payment;
  • To process and respond to any complaints, concerns, incidents or safeguarding issues;
  • To investigate/ provide feedback to relevant persons and to use our lessons learned to improve our processes;
  • For training purposes, where relevant;
  • To comply with any other legal, professional or regulatory obligations imposed on us; and,
  • To audit our services and the use of our websites.

We rely on the following legal reasons for processing your Personal Data:

Contractual necessity: We will process your Personal Data when it is necessary to perform a contract you have entered into, when booking a therapy session and making an online payment or in order to take steps at your request prior to entry into a contract.

Consent: You can choose to upload an image of yourself to add to your profile, you can also provide subscribe to receive our mental health and well-being newsletter.

Explicit Consent: We require explicit consent to process your Health Data. We provide transparency information at each and every point when collecting your health data to make sure that you are aware of how your health data will be used and that you can wortraw you consent at any time by contacting us.

Vital interests: In rare instances, we may need to process your data to protect your vital interests, for example, if we become concerned for your or anyone else’s health and safety during the course of your therapy.

As a provider of healthcare services and assessments, our clinicians are under a legal requirement to document your treatment. These treatment notes will necessarily include data pertaining to your health which is defined as ‘special category data’. Further to the legal grounds for processing above we will process this data special category data on the basis:

  • That it is necessary for medical diagnosis and the provision of health care services – processing of this data will be done by professionals under a common law and contractual duty of confidentiality; or
  • Explicit Consent to process your health data, for example where our digital services such as our online triage tools and health applications (‘apps’) use your health data to make automated decisions based upon health data you provide. If you have given consent, you can change your mind at any time and withdraw it by contacting us.

In certain circumstances where we need to process ‘special category data’ in the context of our services but outside the scope of our services, for example, in order for us to audit the quality of our service, for the establishment, exercise or defence of legal claims or in the public interest in the area of public health, such as protecting against cross-border threats to health or ensuring high standards of quality and safety of health care.

Our use of automated decision making: Our digital services such as our online self assessment tool and health applications (‘apps’) are programmed to make automated decisions based upon personal and health data you provide, to match you with the most appropriate therapists and therapy options to meet your current presentation. This automated decision making allows us to recommend content and treatment that we consider is most likely to benefit you based on the information that you provide. The data you provide will determine the type of therapists that are recommended only. The benefit of automated decision making is to provide innovative and accessible healthcare services to users. The algorithms informing automated decision making are reviewed at least annually, and we may look at your personal and health data in different ways to help us understand more about you and people like you with similar or differing health presentations (we call this ‘profiling’). Profiling helps us to evaluate and improve our services and the clinical algorithms we use, which we can then use as factors within our automated decision-making process. You have rights relating to automated decision making and profiling, please see the ‘your rights’ section below.

We will only use your Personal Data for the purpose, or purposes, for which we have obtained it. If we reasonably consider that we need to use it for another reason we will only do so if that reason is compatible with the original purpose. If we need to use your Personal Data for an unrelated purpose, we will inform you and explain the legal basis which allows us to do so.

Please contact our DPO using the details above if you would like further information on the exact lawful basis for any specific data processing activity.

Disclose

We will share your data with carefully selected third parties when:

  • You specifically request it, or a disclosure is required in order for us to provide our services and/or fulfil our contractual obligations to you;
  • We are under a legal or regulatory duty to disclose your information; or,
  • As a result of any changes in business ownership or organisation.

Ascenti may share your personal information, where required and to the extent permitted and on which we have a lawful basis, with:

  • Any member of our group (e.g. our holding company).
  • Any 3rd party who provides your treatment (where we do, we will ensure that they process information in accordance with our confidentiality and security requirements).
  • Solicitors, Insurers, or any other instructing party;
  • Our auditors and external accreditation bodies;
  • Law enforcement agencies and regulators (e.g. CQC);
  • Parties contracted to provide accounting / finance service, including, for example, our auditors and advisors;
  • Public bodies;
  • Our external service suppliers who provide business support services (including IT, security, building maintenance, archiving, data storage, sales and marketing, communication platforms and workflow management);
  • Analytics and search engine providers who assist in improving our website; and,
  • Any other third party you may ask us to share your data with.

Where our professional duties of confidence as medical clinicians require that we seek your consent before sharing your Personal Data with a third party, we will do so. Such consent has a different legal basis to consent for the purposes of EU/UK privacy law and seeking consent further to our professional duties will not therefore affect the basis of processing in privacy law. The processing under privacy EU/UK privacy law will be on the bases as set out above.

Transfer

Ascenti will not typically transfer any of your data outside of the UK or EEA.

If we do have occasions to transfer your data outside of the UK or EEA to countries not deemed by the ICO (and/or European Commission as relevant) to provide an adequate level of personal information protection, the transfer will be based on safeguards that allow us to conduct the transfer in accordance with the data protection legislation, such as the specific contracts approved by the ICO (or European Commission as relevant), plus transfer impact assessments to identify any additional safeguards or supplementary measures  required to provide adequate protection of personal information,

Store

Ascenti has in place physical, electronic and operational procedures intended to safeguard and secure the information we collect. These measures are updated as necessary and audited on a regular basis.

How long we retain your data for will vary from matter to matter but will be determined in accordance will the following criteria:

  • The length of time necessary to complete our contract with you;
  • Any time limits for establishing or defending legal claims or responding to complaints/incidents;
  • Any period necessary to comply with our legal obligations under EU/UK law; and,
  • Any periods for retention that is recommended by regulators or professional bodies.

Ascenti provide healthcare services; as such there is a legal and regulatory obligation for records to be kept for a minimum period of time. We will typically keep your data processed in connection with these services for a period of 10 years, after which time it will be destroyed, if it is no longer required for the lawful purposes for which it was obtained. Closed files are archived after 12 months resulting in restricted access and additional security.

Your rights

You have the right to obtain confirmation from us as to whether we are processing your Personal Data and, if we are, to request a copy of the Personal Data we hold about you. This is known as a ‘subject access request’.

If you wish to make a subject access request, please request this at [email protected]

For all other types of data subject rights requests (below), please email [email protected]

You also have the right to ask that we update any information we hold about you that may be incorrect. It is important that the information we hold about you is accurate and up to date. If any of your personal information changes please let us know.

In certain circumstances you have the right to request that we restrict the way in which we process your data, or that we erase all personal information that we hold about you.

You have the right to object to certain types of processing.

We will try our best to comply with any request to restrict, object or erase your data, however processing of some data may still be required for legitimate business purposes or to comply with legal obligations. Please note that if you want us to restrict or stop processing your data this may prevent us from providing our services to you.

You have the right to request that we send a copy of your data, that you have provided to us, to another organisation for your own purposes (e.g. if you wish to change service provider). This data must be provided in a structured and usable format. This right only applies to Personal Data processed by way of consent or in pursuant to our contract with you. If you wish us to transfer your Personal Data in accordance with this right please let us know.

As part of the processing of your personal and health data, decisions may be made by automated means using clinical algorithms. An automated decision is one that is made by our systems rather than a person. Under data protection laws, you have the right to:

  • Express your concerns and object to a decision taken by purely automated means; and
  • Request that a person review that decision.
  • If you would like us to review a decision we have made about you, such as a recommendation for a treatment pathway, please contact us.

Where you have used our digital services such as our online self-assessment and health applications  and we have used your personal and health data to create a profile of you, your right to request a copy of the Personal Data that we hold about you includes not only the Personal Data used to create the profile but also the information on that profile itself. Where there are any inaccuracies in the profile (or the information that we have used to create that profile) you have the right to ask that we update the profile or any information we hold about you that is incorrect.

Concerns

If you wish to raise a query on how we have handled your Personal Data you can contact our Data Protection Officer using the details above.

You have the right to raise a concern at any time to the Information Commissioner’s Office (“ICO”) who is the UK supervisory authority for data protection issues. However, we hope that you would consider raising any concern you have with us first. Your satisfaction is extremely important to us, and we will always do our very best to solve any problems you may have. For more information on submitting a concern to the ICO, or the data protection regime in general, please visit the ICO’s website.