Privacy Policy

Last Modified: October 28, 2026

This Privacy Policy (“Privacy Policy”) governs the processing and transfer of personal data collected or processed by Mentalwell Ltd., collectively with its subsidiaries and affiliated companies (“Company”, “we”, “us” or “our”) when you access or use our website (“website”) or when you use our services through our “platform”, collectively the “services”. This Privacy Policy is an integral part of any other agreement between us. Any capitalised terms not defined herein shall have the meanings ascribed to them in the applicable terms between us (“Terms”), or under the applicable privacy laws.

This Privacy Policy refers to any of our users, including website and platform’s users, either as a clinician, patient, parent, or guardian, as well as any other users of our services (collectively “you”, “your” or “user”).

This Privacy Policy explains what data we may collect from you, how such data may be used or shared with others, how we safeguard it and how you may exercise your rights related to your Personal Data (as defined below), as required under applicable privacy laws, including without limitation the UK GDPR (as defined in section 3(10) of the Data Protection Act 2018); and the Data (Use and Access) Act 2025, each as amended from time to time ("UK Laws").

This Privacy Policy does not pertain to Personal Data relating to our employees, contractors and other staff as part of their employment or engagement with us.

If you have any questions regarding this Privacy Policy or our data practices, you are welcome to contact us at: privacy@mentalwell.co.uk.

You are not required by law to provide us with any Personal Data. However, please note that some of our services require the processing of certain Personal Data and without such data we may not be able to provide you with all or part of such services (e.g., without completing the registration process required to create an account within our platform, we will not be able to provide you with our services).

POLICY AMENDMENTS:

We reserve the right to amend this Policy from time to time. The most recent version of the Policy will always be posted on the website. The updated date of the Policy will be reflected in the “Last Modified” heading. Subject to applicable law, any amendments to the Policy will become effective immediately, unless we notify you otherwise. If we materially change the way in which we process your previously collected Personal Data, we will provide you with prior notice, or where legally required, request your consent prior to implementing such changes. We strongly encourage you to review this Policy periodically to ensure that you understand our most updated privacy practices.

1. CONTACT INFORMATION AND DATA CONTROLLER INFORMATION:

For the purposes of UK Laws, the data controller is Mentalwell Ltd., registered with the UK Information Commissioner’s Office (ICO) under registration number ZB659566.

You may contact us as follows:

By email: privacy@mentalwell.co.uk
By Mail: 3 Waterhouse Square, London, England EC1N 2SW.
To our DPO, Mr. Michael Jefferies-Wilson

2. DATA SETS WE COLLECT AND FOR WHAT PURPOSE:

Below you can find information regarding the purposes for which we process your personal data as well as our lawful basis for processing, the definition of “personal” and “non-personal” data, and how it is technically processed.

Non-Personal Data

Non-Personal Data means data that does not identify an individual and cannot reasonably be used to identify an individual, including aggregated or irreversibly anonymised data. Non-Personal Data may include, for example: Aggregated usage statistics (e.g., number of users accessing certain features, average session duration, feature adoption rates), provided that such data does not enable identification of any individual; Technical and device-related information (e.g., device type, operating system, browser type, general system configurations), where such data is not linked to an identifiable individual; De-identified or anonymised analytics data (e.g., traffic patterns, performance metrics, latency and system logs), processed in a manner that prevents re-identification; High-level geographic or demographic insights (e.g., country-level usage distribution), where no individual can be identified; Aggregated business or performance data derived from user activity (e.g., trends, benchmarks, or statistical models), provided such data does not relate to an identifiable person.

Where we process Personal Data to create anonymised or aggregated datasets, we will implement measures designed to prevent re-identification. To the extent such data does not constitute Personal Data under applicable law, we may use it for legitimate business purposes, subject to applicable law. Pseudonymised data remains Personal Data.

Personal Data

We may also collect from you, directly or indirectly, during your access or interaction with the services, individually identifiable information, namely information that identifies an individual or may, with reasonable effort, be used to identify an individual (“Personal Data”). The types of Personal Data that we collect as well as the purpose for processing and the lawfulness are specified in the table below. If we combine Personal Data with Non-Personal Data, we will treat the combined data as Personal Data.

The table below details the processing of Personal Data, the purpose, lawful basis, and processing operations:

Contact and Customer Support Information:

If you voluntarily contact us in order to receive our support, or purchase our services, e.g., through a “contact us” form in our website, you may be required to provide us with certain Personal Data such as your name, email, phone number, contact type (e.g., patient), relevant documents (optional), and any additional information you decide to share with us.

Purpose and operations: We will use this data to respond to your enquiry or information request.

The correspondence with you may be processed and stored by us to improve our internal operations, as well as in the event we reasonably determine it is needed for future assistance or to handle any dispute you might have with us.

We may retain and manage such information using external services and platforms such as CRM systems.

Lawful basis per UK Laws: We process such Contact Information subject to our legitimate interest.

For enquiries relating to patient care, we rely on the bases set out in the Health Related Data row below.

Business Engagement Information:

If you wish to engage with us as a clinician, or on behalf of a clinic in connection with a business relationship with us, including in the course of initiating, negotiating, or managing such relationship, you may be required to provide us with certain Personal Data such as your name, email, and any additional information you decide to share with us.

Further, we will record and retain the content of our communications and interactions, including in connection with contractual arrangements.

Purpose and operations: We will use this data to communicate with you, and to evaluate, establish and manage the business relationship between us.

Lawful basis per UK Laws: We process such information subject to our legitimate interest, and per the contract between us.

Online Identifiers and Advertising and Targeting data:

When you interact with our public website, we may collect online identifiers such as your Internet Protocol address (IP), Cookie-ID, etc., and other information that relates to your activity through the services, such as pages viewed, click stream data, login time and date stamp, etc. This data might be collected directly by us or through our use of third parties' cookies and advertisement platforms.

Please see more in the Cookies section below.

Purpose and operations: Collection of device identifiers is needed for the following purposes:

(i) Internal statistics and analysis, for which device identifiers might be combined with usage data, for example, to analyse how many visitors have accessed certain content and from which country (where the country is extracted from the IP address) in order to enhance and improve our services.

(ii) Marketing and advertising purposes. Our partners will process this data to manage and deliver advertisements and content more effectively and personally, including contextual, behavioural, and interests-based advertising based on your activity, preferences or other data available to us or to our business partners and advertisers, including for re-targeting purposes. This does not include Health-Related Data, clinical records or information submitted through the patient portal.

Lawful basis per UK Laws: Our lawful basis for processing this data for technical and security purposes is based upon our legitimate interest.

For advertising cookies and other non-exempt cookies, we rely on your consent.

For analytics that qualify for the statistical-purposes exception under the Privacy and Electronic Communications Regulations 2003 (“PECR”), we rely on our legitimate interest in improving the website. You may withdraw consent or object to exempt analytics at any time through our cookie settings.

Platform’s Account Basic Information:

Following a private booking or acceptance of an NHS referral, we will grant you access to our platform. The information provided during the registration process may include your name, date of birth, address, email, phone number, username and password.

Additionally, we may collect Health Related Data and further Personal Data for KYC purposes, as described below.

Purpose and operations: We will process this information to verify your identity and grant you access to our services. As part of that we may use your email or phone number as part of a Multi-Factor-Authentication process.

We may also use this information in order to provide you with account management, to provide the services as well as to send you needed information related to provide you with our services and which related to our business engagement (e.g., send you a welcome message, notify you regarding any updates to our services, send applicable invoices, etc.) and additional occasional communications and updates related to the services. Such messages may be delivered to you through email or SMS in accordance with applicable law. We may also use the WhatsApp Business API for referral and other administrative messages directing you to email or the patient portal, with your prior optional permission, which you may withdraw at any time by replying STOP or contacting us.

Further, we may send you promotional and marketing emails, to the extent we are allowed to do so under applicable law (“Promotional Marketing” as detailed hereunder).

We may also process your account information by using “cookies”.

Lawful basis per UK Laws: For private services, we rely on performance of our contract. For NHS-funded care, we rely on the public-task basis described in the Health Related Data row below. Where the patient is not a party to a contract, we rely on our legitimate interest in arranging and providing their care.

Please note that if you provide us with information related to a minor user, you hereby warrant that you are authorised under applicable law as a parent or other person with parental responsibility or other lawful authority to share such information.

We may further analyse and process your login data for security purposes, upon our legitimate interests.

In some cases, and where required under applicable law, using your data for promotional purposes will be subject to your consent. In such instances, you may always withdraw your consent at any time by contacting us or unsubscribe from any marketing list through the designated feature included in such message.

KYC Information:

During the registration process you may be requested to provide our designated service provider with Personal Data for identity verification and patient safety purposes.

Such information may include identification details, date of birth, etc. The provider may collect a scan of your identity document and a face photo for comparison and verification. We receive the verification result, not the underlying document images.

Purpose and operations: We may use this information, where applicable, to verify your identity and comply with applicable legal and regulatory obligations.

We may share verification results with personnel and service providers responsible for registration and patient safety.

Lawful basis per UK Laws: We process such information on the same bases as Platform’s Account Basic Information above.

Health Related Data:

Before and during provision of our services, we may collect certain Health-Related Data, including prescription-related information provided by your general practitioner (“GP”), medical and developmental history, clinical questionnaires, your GP’s contact details, and other treatment-related information. We also collect an informant’s contact details, relationship to the patient and responses about the patient.

Moreover, in cases where you have been referred to our services by the National Health Service (“NHS”), we may collect your NHS number, details of the relevant NHS organisation, and other information received through NHS referral systems.

Additionally, during the use of our services the designated clinician may record medical related data, including consultation notes, clinical assessments and reports, your ADHD or Autism diagnosis, recommended medication and follow-up information.

Purpose and operations: We process such information and analyse it to provide you with our services, including assessment, treatment, clinical quality assurance and follow-up.

Moreover, we use this information to receive and manage relevant NHS organisation referrals, including through the Right to Choose pathway where applicable.

We never share Health Related Data with third parties for marketing purposes.

Lawful basis per UK Laws: For private services, we rely on performance of our contract with you. Where we process such information of a person who is not a party to the contract, we rely on our legitimate interest. For NHS-funded services, we rely on the public task of providing NHS-commissioned care under Article 6(1)(e) of the UK GDPR, within the framework of the National Health Service Act 2006.

For Health-Related Data, we also rely on Article 9(2)(h) and Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018 for medical diagnosis, treatment and management of healthcare services, under duties of confidentiality.

For clinical recordkeeping and mandatory reporting, we rely on legal obligations under Article 6(1)(c). For legal claims, we rely on our legitimate interests under Article 6(1)(f) and Article 9(2)(f).

Where safeguarding requires disclosure without consent to protect a child or adult at risk, we rely on the legitimate interests and other lawful bases recognised under applicable law.

We may also use Health-Related Data in an anonymised and aggregated form that does not permit reasonable identification of individuals for research, analytics, and improvement purposes, subject to applicable law.

Services Use Data:

As part of your usage of our services, we may retain, keep and manage information relating to your interaction with the platform, including your usage patterns and configurations, and any other information collected and processed as part of your use of the services.

Purpose and operations: We will use this information in order to provide you with our services.

We may use specific third parties for the collection, analysis and management of such information.

Lawful basis per UK Laws: We process such data for the purpose of performing our contract with you. For NHS-funded care and patients who are not parties to a contract, the care-related bases set out above apply.

Surveys:

We may ask you to participate in occasional surveys regarding our services. If you choose to participate in our survey, we may collect your contact information such as your name, email address, etc.

Purpose and operations: We use this information to improve, revise and enhance our service, as well as optimise and customise the services.

Lawful basis per UK Laws: We process such information subject to our legitimate interest in improving our services. For clinical service-quality feedback containing Health-Related Data, we also rely on the healthcare condition above; other voluntary health surveys require your explicit consent.

Payment Related Information:

When you make a payment to receive our services, you will be asked to submit payment information data such as your credit card number, debit card, etc.

Purpose and operations: We will use the information to provide you with the requested services.

We may use third-party payment processors and any transactions that are processed by these third-party payment processors will be governed by their privacy policies and terms which we recommend that you review.

Lawful basis per UK Laws: We process such data for the purpose of performing our contract with you.

Certain payment data is being retained by us as part of our legal obligations (e.g., bookkeeping).

Promotional Marketing:

As a user of our services, we may send you materials and marketing content through the email information you provided during your registration.

Purpose and operations: We will use this information to keep you updated with offers and content such as updates, new capabilities and features, and to send supporting documentation.

Lawful basis per UK Laws: We rely on your consent or, where the existing-customer exception under PECR applies to our own similar services, our legitimate interest in promoting those services.

You can opt-out at any time through the "unsubscribe" link within the email or by contacting us directly.

However certain operational content will still be sent.

Recruitment Data:

In the event you wish to apply for a job, you may voluntarily provide us with your CV through our means of communication.

Purpose and operations: We will use the CV and information you provide to process your job application for recruitment purposes and check your suitability.

Lawful basis per UK Laws: We will process basic recruitment data subject to our legitimate interests to consider your application and respond.

If we move forward with you in the recruitment process, or where you have initiated the recruitment application, at an advanced stage of the negotiations we will process your data as part of our contractual relationship with you.

If we choose to retain your data for any other future positions that may apply to you, we will ask for your explicit consent to the extent required by applicable law.

Please note that the actual processing operation for each purpose of use and lawful basis detailed in the table above may differ. Such processing operation usually includes a set of operations made by automated means, such as collection, storage, use, disclosure by transmission, erasure, or destruction. The transfer of Personal Data to third-party countries, as further detailed in the Data Transfer Section below, is based on the same lawful basis as stipulated in the table above.

In addition, we may use certain Personal Data to prevent potentially prohibited or illegal activities, fraud, misappropriation, infringements, identity thefts, and any other misuse of the services and to enforce the Terms, as well as to protect the security or integrity of our databases, services, and the website, and to take precautions against legal liability. Such processing is based on our legitimate interests.

3. HOW WE COLLECT YOUR INFORMATION:

Depending on the nature of your interaction with us, we may collect the above detailed information from you, as follows:

Automatically – we may use cookies or similar tracking technologies (such as pixels, tags, agent, etc.) to gather some information automatically, or automatically through the use of our services.
Provided by you or about you voluntarily – we will collect information if and when you choose to provide us with the information, through the contact form, when you register to our services, etc.
Provided from third parties – we may receive your contact and referral details and Health-Related Data from your GP, relevant NHS organisations (including through NHSmail and the e-Referral Service), other treating professionals, a parent or guardian, or an informant such as a family member or partner. We may also receive identity-verification results and payment confirmations from our service providers.

4. COOKIES

When you access or use our services, we may use “cookies” or similar tracking technologies, which store certain information on your device (i.e., locally stored). The use of cookies is standard industry-wide practice. A “cookie” is a small piece of information that a website assigns and stores on your computer while you are viewing a website. Cookies are used by us for various purposes, including allowing you to navigate between pages efficiently, as well as for statistical purposes, analytic purposes and advertising. You can find more information about our use of cookies here: www.allaboutcookies.org.

There are several types of cookies, including without limitation:

Essential, Functionality, Operation & Security Cookies. These cookies are used where strictly necessary for the service you request, including navigation, website operation and security (i.e., used to authenticate visitors, prevent fraudulent use, and protect visitor data from unauthorised parties). These cookies are used without consent; disabling them through your browser may prevent certain features from working.
Analytic, Measurement & Performance Cookies. These cookies are used to collect information about how visitors use our website, in order to improve our website, content, and the way we offer them, as well as assess the performance of the content and marketing campaigns. These cookies enable us, for example, to assess the number of visitors who have viewed a certain page as well as their country of origin. It enables our website to remember information that changes the way it behaves or looks, such as your preferred language.
Preference, Targeting & Advertising Cookies. These cookies are used to advertise across the internet and to display relevant ads tailored to visitors based on the parts of the website they have visited (e.g., the cookie will indicate you have visited a certain webpage and will show you ads relating to that webpage).

You can find more information about the cookies we use, including their providers, purposes, and durations, and opt out of cookies or change your preferences using the cookie setting popup.

Where we use third-party advertising cookies, such third-party may independently collect, through the use of such tracking technologies, Online Identifiers and website activity data described above, including to combine such information with other information they have independently collected relating to your online activities across their network of websites, for the purpose of enhanced targeting functionality and delivering personalised ads, as well as providing aggregated analytics related to the performance of our advertising campaign you interacted with. These third parties collect and use this information under their own privacy policies.

5. DATA SHARING:

We share your data with third parties, including our service providers that help us operate and make the most of the website. You can find here information about the categories of such third-party recipients.

Our Affiliated Companies

We may share Personal Data with our affiliated companies and subsidiaries in order to provide joint services, for example, marketing, improving our services, etc.

Our Service Providers

We share your Personal Data with our trusted service providers that perform business operations for us on our behalf (as data processors) and pursuant to our instructions.

This includes the following categories of service providers:

Identity verification service providers, who assist with registration and patient safety.

Advertising and marketing service providers, who help us with advertising measurements, email marketing, etc.;

Data storage providers, with whom we entrust the hosting and storage of our data;

Consent Manager (CMP), an external service that provides us with the ability to allow website visitors to control and manage their cookies preferences and consent;

General IT and SaaS providers – providing us with IT systems for the management of our daily conduct; This includes video consultation and administrative messaging providers.

Data analytics and data management providers, who help us improve, personalise and enhance our operation.

Data security partners, who help us detect and prevent potentially illegal acts, violations of our policies, fraud and/or data security breaches and ensure compliance with legal obligations.

NHS & GP

We may share relevant Personal Data, including Health-Related Data, with your GP or relevant NHS organisations where it is necessary to manage referrals, coordinate your care or meet applicable reporting requirements, subject to applicable law.

Legal and Law Enforcement

We may disclose certain Personal Data to law enforcement, governmental agencies, healthcare regulators, or authorised third parties, in response to a verified request relating to regulatory oversight, safeguarding, criminal investigations or alleged illegal activity or any other activity that may expose us, you, or any other visitor to legal liability, and solely to the extent necessary to comply with such purpose.

Corporate Transactions

In the event of a corporate transaction (e.g., sale of a substantial part of our business, merger, consolidation, or asset sale) we will share the Personal Data we store with our acquiring company.

In any such case, we will oblige the acquiring company to assume the rights and obligations as described in our Privacy Policy.

When we share information with service providers, we ensure they only have access to such information that is strictly necessary for us to operate the services. These parties are required to secure the data they receive and to use the data for pre-agreed purposes only while ensuring compliance with all applicable privacy laws. Some recipients, including payment and advertising providers, may act as independent controllers for their own processing, as described in their privacy notices.

6. DATA RETENTION:

In general, we retain the Personal Data we collect for as long as it remains necessary for the purposes set forth above, all under the applicable privacy laws.

The circumstances in which we will retain your Personal Data include: (i) where we are required to do so in accordance with legal requirements, or (ii) for us to have an accurate record of your interaction with us in the event of any enquiries or contact requests, or (iii) if we reasonably believe there is a prospect of litigation relating to your Personal Data. Clinical-record retention is determined by the type of record, your age, the date treatment ends, continuing clinical needs and applicable legal and NHS recordkeeping requirements, taking account of the NHS Records Management Code of Practice. Closing your account does not by itself result in deletion of clinical records.

7. SECURITY MEASURES:

We take great care in implementing physical, technical, and administrative security measures for the website and services, that we believe comply with applicable regulation and industry standards to prevent your information from being accessed without the proper authorisation, improperly used or disclosed, unlawfully destructed, or accidentally lost.

If you feel that your privacy was not dealt with properly or was dealt with in a way that was in breach of our Privacy Policy or if you become aware of a third party’s attempt to gain unauthorised access to any of your Personal Data, please contact us at our email.

8. INTERNATIONAL DATA TRANSFER:

We may store or process your Personal Data in the UK and the EEA, or in other countries (whether directly or indirectly through the use of our vendors). If your Personal Data is transferred to and processed in a country outside the UK, we will take appropriate measures to ensure that your Personal Data receives an adequate level of data protection upon its transfer in accordance with applicable law.

Where a transfer is subject to UK Laws and no adequacy regulation applies, we will use an applicable UK transfer mechanism, such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. You may request a copy of the relevant safeguards using the contact details above, subject to appropriate redactions.

In addition, some of the third parties used for cookies management on our website may store and process data globally, including in the US (e.g., Google Analytics servers). Any such transfers will be made in accordance with the applicable transfer mechanisms described above.

9. YOUR RIGHTS

Under UK Laws, your rights regarding your Personal Data, subject to applicable conditions and exemptions, include: (i) request to amend your Personal Data we store; (ii) review and access your Personal Data that we hold; (iii) request to delete your Personal Data that we hold (as long as we do not have a legitimate reason for retaining the data); (iv) restrict or object to the processing of your Personal Data; (v) exercise your right of data portability (vi) contact to a supervisory authority in your jurisdiction and file a complaint; and (vii) withdraw your consent (to the extent applicable). We will not discriminate against you for exercising any of your privacy rights.

For the avoidance of doubt, no significant decisions about you are made solely on the basis of automated processing of your Personal Data, as part of the services.

To exercise your rights set out above, you may send us an email at: Hello@mentalwell.co.uk. Where permitted by applicable law, an authorised agent may submit a request on your behalf.

Right to Object. You may object to processing based on public task, legitimate interests or recognised legitimate interests on grounds relating to your particular situation. You may object to direct marketing, including related profiling, at any time.

When you contact us and request to exercise your rights regarding your Personal Data, we may request certain information reasonably necessary to verify your identity, where verification is required or permitted by applicable law, and to locate your data.

You always have the right to make a data protection complaint directly to us if you believe that we have infringed applicable data protection law in connection with your Personal Data. You may submit such complaint by contacting us at Hello@mentalwell.co.uk. We will always take appropriate steps to review and respond to your complaint without undue delay, including by making appropriate enquiries and keeping you informed of the progress and outcome of the complaint within the timeframes set by applicable law.

Moreover, as a UK resident you can always approach the Information Commissioner’s Office (ICO), at: http://ico.org.uk/make-a-complaint/.

10. THIRD PARTY WEBSITES:

Our Privacy Policy only addresses the use and disclosure of Personal Data we process. To the extent that you disclose your Personal Data to other parties via the website (e.g., by clicking on a link to any other website or location), different rules may apply to their use or disclosure of the Personal Data you disclose to them, and this Privacy Policy does not apply to any such third-party products and services.

11. ELIGIBILITY AND CHILDREN PRIVACY:

Our services are also available to children aged 7 and above, with registration by a parent or other person with parental responsibility or other lawful authority. Information may also be provided by the child, their treating professionals or an informant. Access to a child’s clinical information depends on the child’s capacity and the requesting person’s authority.

We do not sell children’s Personal Data or share it for marketing purposes. If you believe that a child has registered without appropriate authority, please contact us at Hello@mentalwell.co.uk. We will review the matter and take appropriate action in accordance with applicable law.

Recruitment Privacy Policy