DRAFT. This policy is awaiting review and sign-off by the data controller and is published for transparency while that review completes. It describes our practices accurately to the best of our knowledge, but should not yet be relied upon as a final legal document.

Privacy Policy

Last updated: 2026-08-04 · Draft pending sign-off

Who we are

Healing Space UK ("we") operates this website and the Healing Space platform. The data controller is Healing Space UK (contact: cs@healing-space.org.uk). [Company registration details to be added at sign-off.]

We are working toward the requirements of UK GDPR and the Data Protection Act 2018. A Data Protection Impact Assessment and independent information-governance review are in preparation and have not yet been completed — see the Trust Centre for our current assurance status.

What we collect, and why

If you only visit this website

Enquiry details (name, email, message) if you use the contact form — to respond to you. Lawful basis: legitimate interests (responding to your enquiry).
Technical logs (IP address, request details) — for security and reliability. Lawful basis: legitimate interests (protecting the service).
No analytics, advertising or tracking scripts run on this site.

If you use the platform as a patient

Account details you provide at registration. Lawful basis: performance of the agreement to provide the service.
Health and wellbeing information you choose to record (mood logs, questionnaire answers, journal-style entries, the conversation, safety plans) and information shared with your clinician. This is special-category data; we process it on the basis of your explicit consent, which you can withdraw at any time.
Structured items you confirm from a conversation. Where a conversation contains something you clearly stated — a mood rating, hours slept, or something you want to raise at your next session — the platform may offer to save it. The suggestion is validated against your own words by the application, nothing is saved until you confirm it, and a private record of that suggestion and your decision is kept on your side of the platform so there is an account of how the entry came to exist.
Risk and safety information. If content you enter indicates a risk of serious harm, the platform is designed to alert your clinical team. This is part of how the service works and is explained before you consent to use it.
Audit records of accountable actions — so there is an answer to "who accessed what, when". Lawful basis: legitimate interests (safety and accountability).

Who processes data on our behalf

Railway — cloud hosting of the application and database.
Groq — processes the text of a conversation message to generate the reply, and to identify candidate structured items within that same message. Only the message being replied to is sent: the provider is not told who you are, who your clinician is, or what else is in your record. AI-model training on patient conversations is disabled by default and would require separate governance and consent before ever being enabled.
Email delivery provider — sends transactional email (e.g. password resets, alerts) where configured.

We do not sell personal data to anyone — not advertisers, not insurers, not data brokers — and no part of our business model depends on doing so.

Voice

Speaking rather than typing is being developed and evaluated; it is not offered as a finished capability. The prototype in our development build uses your browser's own speech recognition, which on some platforms sends audio to the browser vendor's service — a processor we do not control and therefore do not present as part of a privacy-preserving architecture. We are investigating on-device or Healing-Space-controlled speech processing instead. Wherever voice appears in the product it states how it is being processed, and typing does the same job.

How long we keep data

[Draft retention schedule — to be confirmed at sign-off.] Enquiries: up to 24 months after the last contact. Platform accounts and clinical records: for the duration of your use of the service and thereafter per the retention schedule agreed with your providing service; you can delete your account and its data from within the platform. Security logs: up to 12 months.

Your rights

Under UK data-protection law you have the right to: access the personal data we hold about you; have it rectified or erased; restrict or object to processing; data portability; and to withdraw consent at any time where processing is based on consent. To exercise any of these, email cs@healing-space.org.uk with "Privacy" in the subject line, or use the contact form. We will respond within one calendar month.

You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint or 0303 123 1113.

An important boundary

Healing Space UK is not an emergency service. In an urgent or life-threatening situation call 999, or Samaritans free on 116 123.