Chrysalis Talking Therapies Privacy Policy

1. Introduction

Chrysalis Talking Therapies is operated by Chrysalis Not For Profit Ltd, registered in England and Wales (Company No. 07416132), with a registered office at 30 Angel Crescent, Bridgwater, Somerset, TA6 3EW.

We take your privacy seriously. This policy explains what personal data we collect, how we use it, and your rights. Our aim is to help you feel confident using our platform, knowing your personal information is handled securely and lawfully.

We operate in accordance with the UK Data Protection Act 2018. For more information, visit: ICO's UK GDPR Guidance

Chrysalis Talking Therapies is a platform connecting two types of users:

• Clients – individuals seeking mental health support
• Therapists – qualified mental health professionals offering services

We collect and use different types of data for each group, which we explain below.

2. Our Principles

• We collect only the minimum data necessary to provide our services.
• We only collect data for clear, legitimate purposes.
• We do not repurpose data without consent.
• Data is shared only with third parties essential to our service or with your permission.
• We have safeguards in place to ensure your data rights are protected.
• Your data is stored and processed securely and in compliance with data protection laws.

3. What Data We Collect

We do not knowingly collect data from anyone under 18. By using the platform, you confirm that you are at least 18 years old.

For All Users:

• Email address – Required for login, communications, and to access employer-funded sessions. Not shared with Therapists.
• Name – Clients can use any name; Therapists must use their real, full name.
• Availability – Used to suggest convenient booking times.

Additional Data for Therapists:

To verify professional qualifications and help clients make informed choices, Therapists are asked to provide:

• Professional membership and ID numbers
• Proof of insurance
• Biographical information
• Profile photo and video (optional)
• Credentials from professional bodies (where relevant)

Communications:

We keep a record of communications made through the platform for support and service purposes. We do not record video sessions.

4. How We Collect Data

Data is provided directly by users or collected through standard web interactions (e.g., cookies or metadata).

We may also receive data from:

• Referrals (email addresses only)
• Professional organisations (Therapist details)
• Partner organisations (with consent – e.g., client onboarding from employers or charities)

5. Why We Collect Data

Legal Basis:

• Your consent
• Performance of a contract

Therapist Data:

• To create your account and profile
• To display your public profile to prospective clients
• To manage appointments and payments

Client Data:

• To register and manage your account
• To share your name (only with Therapists you've given consent to)
• To handle bookings and payments

6. How We Use Your Data

To deliver our service:

• Account creation and management
• Profile display and availability scheduling
• Video call functionality
• Appointment booking and payment processing

For communication:

• Platform updates or service changes
• Booking confirmations and reminders
• Responses to user enquiries

For analysis:

• Understanding how users interact with the platform
• Improving usability and service effectiveness
• Monitoring business performance
• Evaluating therapeutic outcomes (in anonymised form)

7. Sharing Your Data

We do not share your data unless:

• It is essential to our service
• You have given permission
• Required by law or legal process

Client names are only visible to selected Therapists with explicit permission, which can be withdrawn at any time.

Therapist profiles are public to support discovery and marketing.

Third-party services we use:

• Auth0 – for secure authentication: Auth0 Privacy Policy
• Stripe – for payment processing: Stripe Privacy Policy
• Whereby – for video calls: Whereby Privacy Policy

All services are GDPR-compliant, and EU data is stored in EU-based servers.

8. Data Storage

We store data securely using AWS (EU-West-1 region, Ireland). Read more about AWS’s GDPR compliance.
 

We take reasonable steps to safeguard your data but cannot guarantee absolute security. You can use the service without sharing any optional personal data.

Data is retained only as long as necessary – typically 7 years for legal and regulatory compliance. You can update or delete your data at any time.

9. Account Security

Your password is your responsibility. Use a strong, unique password and enable two-factor authentication where possible. Keep your login details secure. You are responsible for any activity on your account.

Always log out when you're finished using the platform, especially on shared devices.

10. Marketing

We will only contact you for marketing purposes with your explicit consent. You can unsubscribe at any time using the link in our emails, through your account settings, or by contacting us.

We do not send third-party advertising. If this changes, we’ll ask for your permission before doing so.

We may ask for your permission to share content you’ve created or feedback you’ve provided as part of our promotional materials.

11. Your Rights

Under the UK GDPR, you have the right to:

• Access your data
• Correct inaccurate data
• Request erasure
• Restrict or object to data processing
• Request data portability

To exercise these rights, please contact us at:
Email: support@chrysalistalkingtherapies.co.uk

12. Changes to This Policy

We regularly review and update this policy. Any changes will appear on this page.

13. Contacting the Regulator

If you are unhappy with how your data is handled, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO).

14. Governing Law

This privacy policy and any dispute or claim arising out of or in connection with it shall be governed by and construed in accordance with the laws of England and Wales. Any legal proceedings relating to this policy shall be subject to the exclusive jurisdiction of the courts of England and Wales.