Privacy Policy
Who we are
Healing Space UK ("we") operates this website and the Healing Space platform. The data controller is Healing Space UK (contact: cs@healing-space.org.uk). [Company registration details to be added at sign-off.]
We are working toward the requirements of UK GDPR and the Data Protection Act 2018. A Data Protection Impact Assessment and independent information-governance review are in preparation and have not yet been completed — see the Trust Centre for our current assurance status.
What we collect, and why
If you only visit this website
- Your email (your address and what you write) if you email us — to respond to you. Lawful basis: legitimate interests (responding to your enquiry).
- Technical logs (IP address, request details), kept by Cloudflare, which hosts this website — for security and reliability. Lawful basis: legitimate interests (protecting the service).
- No analytics, advertising or tracking scripts run on this site.
If you use the platform as a patient
- Account details you provide at registration. Lawful basis: performance of the agreement to provide the service.
- Health and wellbeing information you choose to record (mood logs, questionnaire answers, journal-style entries, the conversation) and information shared with your clinician. This is special-category data; we process it on the basis of your explicit consent, which you can withdraw at any time.
- Structured items you confirm from a conversation. Where a conversation contains something you clearly stated — a mood rating, hours slept, or something you want to raise at your next session — the platform may offer to save it. The suggestion is validated against your own words by the application, nothing is saved until you confirm it, and a private record of that suggestion and your decision is kept on your side of the platform so there is an account of how the entry came to exist.
- Risk and safety information. Healing Space does not monitor what you enter for risk and does not alert your clinical team or anyone else. If you talk about being in danger, it points you to real-world help such as 999 or Samaritans.
- Audit records of accountable actions — so there is an answer to "who accessed what, when". Lawful basis: legitimate interests (safety and accountability).
Who processes data on our behalf
- Cloudflare — hosts this public website and keeps technical request logs for security.
- Google Cloud — will host the application and its database in the EU (Belgium) when the application returns (it is offline while its hosting moves), and of Healing Space's own voice service (EU) where Talk is switched on.
- Groq — generates the reply in the conversation. For that it receives your message, the last few turns of the conversation, your first name, short excerpts from the context Healing Space remembers for you that relate to what you are talking about (which you can see and remove), the support priorities you have written, and anything your clinician wrote for you after your last session. It also looks at your latest message on its own to identify things you might want to save. If certain crisis words appear, the application itself recognises them, without a separate check by Groq, so that nothing is offered and the reply points you to real-world help. If you choose to generate insights in the app, a summary of your own records is sent to produce them. The application never adds your surname, date of birth, contact details, NHS number, address or account identifiers. AI-model training on patient conversations is disabled by default and would require separate governance and consent before ever being enabled.
- Freeola — sends transactional email from Healing Space UK's own mailboxes (for example password resets, invitations and appointment reminders).
We do not sell personal data to anyone — not advertisers, not insurers, not data brokers — and no part of our business model depends on doing so.
Voice
Where Talk is switched on, your device sends your voice to a speech service that Healing Space operates itself, hosted in the EU. It turns what you said into text and returns only that text; audio is held in memory only, is discarded, and is never stored or logged. No outside speech provider is used, and your browser's own speech recognition is not used. The text is then handled exactly as if you had typed it. Talk has been built and tested in an evaluation environment and is not switched on for patients; where it appears, it offers Type instead.
How long we keep data
[Draft retention schedule — to be confirmed at sign-off.] Enquiries: up to 24 months after the last contact. Platform accounts and clinical records: for the duration of your use of the service and thereafter per the retention schedule agreed with your providing service; you can ask us to delete your account and its data using the contact details below. Security logs: up to 12 months.
Your rights
Under UK data-protection law you have the right to: access the personal data we hold about you; have it rectified or erased; restrict or object to processing; data portability; and to withdraw consent at any time where processing is based on consent. To exercise any of these, email cs@healing-space.org.uk with "Privacy" in the subject line, or use the contact form. We will respond within one calendar month.
You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint or 0303 123 1113.
An important boundary
Healing Space UK is not an emergency service. In an urgent or life-threatening situation call 999, or Samaritans free on 116 123.