Emotipal Ltd Privacy Policy

Last updated: 24th March 2025

1. INTRODUCTION

1.1 This privacy notice applies to you, a user of the EmotiPal platform (the “Platform“) or prospective users who are intended to be either clients or practitioners (“you” and “your“). We have developed this Privacy Notice to inform you of the data we collect, what we do with your information, what we do to keep it secure, as well as the rights and choices you have over your personal information. Please read it carefully. 

1.1.1 The “Platform” can be defined as the the web-based application known as “EmotiPal Prep” (as it may be rebranded from time to time) and the cross-platform application software available on iOS, Android and Web, known as “EmotiPal Engage” (as it may be rebranded from time to time). 

1.2 Throughout this document we refer to Data Protection Legislation which means the Data Protection Act 2018 (DPA2018), United Kingdom General Data Protection Regulation (UK GDPR), the Privacy and Electronic Communications (EC Directive) Regulations 2003, all the foregoing as amended from time to time, and any legislation implemented in connection with the aforementioned legislation. Where data is processed by a controller or processor established in the European Union or comprises the data of people of the European Union, it also includes the EU General Data Protection Regulation (EU GDPR). This includes any replacement legislation coming into effect from time to time.

1.3 EmotiPal LTD is the controller for the personal information we process, unless otherwise stated. We are registered with the Information Commissioner’s Office (the ICO) with registration number ZB880085.

1.4 By using our services, you agree to the terms of this policy.

2. ‎WHO WE ARE

2.1 We are EmotiPal. We are a business that provides software for mental healthcare. EmotiPal Ltd is a company registered in England and Wales (Company No. 16171148) with its registered office at 143 Bunning Way, London, England, N7 9UW.  

2.2 If you have any queries regarding this privacy notice or the way in which we process your personal data, please contact us at:

Email: data.privacy@emotipal.com

Postal Address: 143 Bunning Way, London, N7 9UW

3. CHANGES TO YOUR PERSONAL INFORMATION

3.1 It’s important that the personal data we hold about you is accurate and current. Please let us know if your personal data changes or if you become aware that any personal data that we hold about you is not accurate.

4. TYPES OF PERSONAL DATA WE COLLECT

4.1 We may collect and process the following categories of data, based on how you use our Platform:

Data Category	Description
Identity Information	Full name, home address, date of birth, title
Contact Information	Email address, phone number
Communication Records	Details from any correspondence or interactions, including discussions with practitioners or clients, technical support inquiries, customer care requests, and any other information you provide
Platform Usage Data	Information on how you navigate and interact with the Platform (e.g., frequency of platform access, features used)
Health Records	Data you provide manually or automatically through the Platform, or information shared by your practitioner. This may include health history, prescription details, mood tracking, therapy progress responses, clinical questionnaire scores, and other relevant health insights
Practitioner Data	If you are a practitioner, this includes your identity, contact details, workplace, therapy specialization, and a securely stored (hashed) practitioner account password
Technical Information	Includes device type, unique device identifiers (e.g., IMEI, IDFA, IP, or MAC address), network data, operating system, browser, location, time zone, and other related details
User-Generated Image Data	Images or videos submitted via technical support channels while using the Platform, retained for troubleshooting and resolving customer issues
Marketing & Communication Preferences	Includes your marketing and communication preferences, as well as any feedback or reviews you provide

4.2 You are under no statutory or contractual requirement or obligation to provide us with your personal information. We only process personal data which is adequate, relevant and limited to what is necessary to fulfil the purposes set out in this notice.

4.3 We do not process any information about children under the age of 18. If you or any other person becomes aware that a child has accessed or may have accessed the Assistant and provided their personal data without parent consent, they must contact us by email at data.privacy@emotipal.com 

5. HOW WE USE OUR DATA

5.1 We process your personal data only when allowed by law, such as to fulfill agreements, comply with legal obligations, or pursue legitimate interests. These interests may include administrative purposes or commercial activities, and we ensure safeguards are in place to protect your data.

5.2 We may also process your data based on your consent, which you can withdraw at any time.

5.3 Special categories of personal data (e.g., health data) are processed with explicit consent or when required by law for public interest or legal claims. You are not obligated to provide this data, but refusing may affect our ability to deliver services.

5.4 Anonymized data may be used for internal research and development to improve our services, and we retain ownership of any intellectual property resulting from it.

5.5 We may process your data for multiple purposes based on different legal grounds. If we need to use your data for an unrelated purpose, we will notify you and re-secure consent if necessary. In some cases, we may process data without consent as required by law.

6. OUR LEGAL BASES FOR PROCESSING YOUR PERSONAL DATA

6.1 We process your data for the following purposes:

Purpose	Data Categories Used	Legal Basis
Product and services provisioning – Allow your practitioner to invite you to the Platform – Offer our Platform to you – Allow practitioners nominated by you to process your data – Apply proprietary technology to your Health Data	– Personal Identification Data – Contact Details – Communication Data – Platform Usage Data – Health Records – Practitioner Data – Technical Data – Support & Media Data	Explicit consent (for Health Data) Contractual Necessity Legal obligation Legitimate Interests to fulfil our obligations to you
IT operations and platform maintenance – To manage and secure the Platform, covering troubleshooting, incident management, testing, code maintenance, data analysis, reporting, customer care, and data hosting	– Personal Identification Data – Contact Details – Communication Data – Platform Usage Data – Health Records – Practitioner Data – Technical Data – Support & Media Files	Explicit consent (for Health Data) Contractual Necessity Legal obligation Legitimate Interests to fulfil our obligations to you
Research and development – Use anonymised data to improve our services to you and improve general quality of care, sharing data with other health services (e.g. NHS) or academic institutions	– Communication Data – Platform Usage Data – Health Records – Practitioner Data – Technical Data	Public Health Legitimate Interests to improve our offering
Marketing and Advertising – Promote our value proposition – Ask to rate us, leave us a review or take part in a survey – Use analytics to improve our Platform experience	– Personal Identification Data – Contact Details – Platform Usage Data – Marketing & Communication Preferences	Explicit content (opt-in) Legitimate Interests to promote our offering
Business Management – To manage our business activities, including maintaining financial and accounting records, performing audits and testing, and ensuring compliance with reporting and corporate governance obligations. – To inform you about any changes to our terms or this privacy notice	– Personal Identification Data – Contact Details – Communication Data – Platform Usage Data – Technical Data	Legal obligation Legitimate Interests to exercise our right, operate our business, and fulfil our obligations to you

7. WHO WE MIGHT SHARE YOUR INFORMATION WITH

7.1 We may share your personal data with other organisations in the following circumstances:

7.1.1. If the law or a public authority says we must share the personal data;

7.1.2. If we need to share personal data in order to establish, exercise or defend our legal rights (this includes providing personal data to others for the purposes of preventing fraud and reducing credit risk); or

7.1.3. From time to time, we employ the services of other parties for dealing with certain processes necessary for the operation of the Platform. However, all the information we share will be collected and anonymised, so neither you nor any of your devices can be identified from it.

7.1.4. We use data processors who are third parties to provide elements of services for us. We have Data Processing Agreements in place with our data processors. This means that they are only able to process your personal information under our strict instructions. They may only share your personal information with other organisations apart from us if we have provided them with prior written consent for this sharing. In addition, these other organisations must comply with our Data Processing Agreement. They will hold your personal data securely and retain it for the period we instruct. 

7.2 We may, from time to time, expand or reduce our business and this may involve the sale and/or the transfer of control of all or part of our business. Any personal data that you have provided will, where it is relevant to any part of our business that is being transferred, be transferred along with that part and the new owner or newly controlling party will, under the terms of this Privacy Notice, be permitted to use that data only for the purposes for which it was originally collected by us.

8. INTERNATIONAL TRANSFERS OF YOUR PERSONAL DATA

8.1 From time to time it may be necessary for us to transfer your information internationally. In particular, your information may be transferred to and/or stored on the servers of third parties identified in section 8 which are based outside of the UK or the EEA.

However, we won’t transfer your personal data outside of the UK or the EEA unless:

8.1.1 such transfer is to a country or jurisdiction which the EU Commission or the UK (as applicable) has approved as having an adequate level of protection;

8.1.2 appropriate safeguards are in place in accordance with data protection laws. These safeguards include the use of standard contractual clauses or binding corporate rules; or

8.1.3 the transfer is otherwise allowed under data protection laws (including where we have consent or the transfer is necessary for important reasons of public interest, is necessary for the establishment, exercise or defence of legal claims or is necessary for the performance of a contract with the data subject).

8.2 We’ll ensure that where your personal data is transferred outside of the UK or the EEA, it is afforded an essentially equivalent level of protection as would be afforded to it within the location from which it is transferred.

9. HOW LONG WE KEEP YOUR INFORMATION FOR 

9.1 We retain a record of your personal information to provide you with a high-quality and consistent service, as well as to fulfill our legal and regulatory obligations. As a minimum, we need to store your personal data for as long as is necessary to enable us to fulfill the purpose for which it is processed, including providing and operating our services, and to exercise or defend any legal claims.

9.2 We follow generally accepted industry standards and maintain reasonable safeguards to ensure the security, integrity, and privacy of the information you have provided. All data is stored on our secure servers.

9.3 If we believe that there has been a personal data breach which could adversely affect your rights and freedoms, we will notify you without undue delay in accordance with data protection laws. 

10. GIVING YOUR REVIEWS AND SHARING YOUR THOUGHTS

10.1 When using our Platform, you may be able to share information through social networks like Instagram and Facebook. For example, when you ‘like’, ‘share’ or review our Services. When doing this, your personal information may be visible to the providers of those social networks and/or their other users. Please remember it is your responsibility to set appropriate privacy settings on your social network accounts so you are comfortable with how your information is used and shared on them.

11. YOUR RIGHTS OVER YOUR INFORMATION 

11.1 Subject to any conditions and requirements set out in data protection laws, you may have some, or all, of the following rights in relation to the personal data we hold about you:

Right to be Informed about Our Collection and Use of Personal Data	You have the right to be informed about the collection and use of your personal data. We ensure this by providing you with this Privacy Notice, which is regularly reviewed and updated to reflect our data processing activities.
Right to Access Your Personal Information	You have the right to request access to the personal information we hold about you, often called a ‘Data Subject Access Request.’ We will provide it free of charge and respond within one calendar month. Proof of identity may be required.
Right to Rectification of Your Personal Information	You can ask us to correct any inaccurate, incomplete, or outdated personal information we hold about you.
Right to Stop or Limit Our Processing of Your Data	You can object to the processing of your personal data, request its deletion if it’s held for too long, or request restrictions on how it’s processed in specific circumstances.
Right to Erasure	You have the right to request the erasure of your personal data, known as the ‘right to be forgotten,’ which applies only in certain situations.
Right to Data Portability	You have the right to receive your personal data in a structured, machine-readable format and request that it be transmitted to another data controller.
For More Information about Your Privacy Rights	The Information Commissioner’s Office (ICO) regulates data protection in the UK. You can visit their website for more information or to make a complaint about how we use your data. We hope you’ll raise any concerns with us first.

11.2 We will respond to a request to exercise your rights as set out in this section as we can, and in any event within two months.

12. HOW TO CONTACT US

12.1 If you would like to exercise one of your rights as set out above, or you have a question or a complaint about this policy, the way your personal information is processed, please contact us by one of the following means:

Email: data.privacy@emotipal.com

Postal Address: 143 Bunning Way, London, N7 9UW

12.2 You have the right to make a complaint at any time to the relevant supervisory authority for data protection issues, which in the UK is the Information Commissioner’s Office (ICO) (www.ico.org.uk).

Thank you for taking the time to read our Privacy Notice.

EmotiPal LTD

This Policy was published and last updated on 24 March 2025