Privacy Notices

We collect the following personal information about you in several ways:

a) Information you provide to us when you register and use our Service

This includes:

• Registration information - when you register, we collect contact information such as your name, date of birth, email address and mobile number. We also collect information to authenticate you as an eligible patient such as your date of birth; your GP details in case of any safeguarding risk issues; and to authenticate your access to the Service by way of a password for your sign-in security.
• Assessment information - we collect information using standard structured patient assessment questionnaires both to initially establish what treatment plan is likely to be beneficial to your needs, and on an ongoing basis prior to each session of your subsequent care. Assessment information can cover a range of factors relevant to your experiences and how you are feeling in addition to your medical history, lifestyle, family, work and education.
• During the course of your treatment - This includes messaging between you and your therapist between sessions to arrange and provide you with information about your therapy sessions, the sessions themselves, the ‘homework’ activities and questionnaires completed, and the setting of goals. The sessions comprise a verbatim record of conversation between you and your therapist that are retained in the form of a transcript for text therapy or an audio file for video therapy, and which you can access through the account settings of the Service. This will include information relevant to and about how you are feeling at that point in time. You will be encouraged to record goals within your account, and we generate information about these treatment goals and assessment score graphs to help you and us to monitor and understand your progress
• Your queries or comments - we will collect information if you contact us for example with a question or comment about the Service and/ or its content.
• You always have the option to refuse to submit personally identifiable information to us but note that without this information, the Services may be unavailable to you.

b) Information we collect from other sources

We add to the information we collect from you with information we receive from other sources. This includes:

• Any referral information from the Payer, if for example you are referred to our service as part of a research project with a research institution, such as a university.
• Therapist notes - At the end of each session your therapist will produce a short set of clinical notes to summarise the session.
• Supervision notes – a therapist may share some of your details with their supervisor per section 2 below and receive advice and /or feedback. Where this affects the treatment you receive, and/or the outcome, it makes up part of your medical record with us.
• Demographic information - that is publicly available and that enables us to understand anonymous health statistics at postcode level.

c) Information collected automatically from your use of the Service

Certain information is collected automatically from your computer or device about your engagement with the Service. This includes:

• Session activity information - we collect information about you from your use of the Service. (E.g. when you log on, accept an appointment, join a session etc.)
• Device information - this includes information about whether you are using the service on a mobile, tablet or computer. This helps us understand how people interact with our service so that we can ensure the Service is optimised for different devices.
• Log information - we collect technical information such as your Internet Protocol (IP) address, (the unique address that identifies your device or computer on the internet), your browser type and when, how often and for how long you interact with the Service.

See here or read below for further information on cookies

We use the personal information we collect to ensure that we provide you with the best possible treatment both now and in the future. We have appointed a Data Protection Officer and Caldicott Guardian to seek to ensure that our procedures for handling patient information meet with our obligations.

We use the personal and clinical information that we receive under our terms with you and in connection with providing treatment to:

• Assess your suitability and eligibility
• Register you with the Service - to consider requests for use of the Service and to enable sign-in and verified access and use of the Service.
• Assess your treatment needs - to place you with an appropriate therapist, and to aid selection of exercises and questionnaires.
• Provide your treatment - your personal information is shared with your therapist to support your treatment and evaluate your progress, including messaging to arrange sessions, conducting sessions, assessing progress against treatment goals and maintaining your case file. It’s your choice to decide what to share with your therapist, but the more information that your therapist has about you, the more likely it is that they will be able to provide you with highly effective treatment. Your therapist only has access to your personal information during your treatment and for 6 weeks after discharge to allow for reflection and/ or to consider any feedback from you.
• Subject to appropriate safeguards, some of the details of your case may be shared in your therapist’s routine clinical supervision with their Clinical Supervisor if they wish to obtain advice or assurance on the work you are doing together. The British Association of Behavioural & Cognitive Psychotherapies (“BABCP”) requires that all therapists must receive clinical supervision. A Clinical Supervisor is a therapist who has received additional training and is generally more experienced than the therapist. This is to ensure that the therapy you are receiving is the most helpful it can be and remains faithful to best practice evidence. Clinical supervision includes case discussions (and may include referring to messages/ transcripts/ audio recordings) either individually or within a group of therapists, all of whom are bound by confidentiality.

Communicate with you

• via email or messages between sessions if/ when appropriate, to confirm appointments, confirm payments, remind about incomplete questionnaires, about Service availability and related Service updates or notifications, or reply to your enquiries, requests or complaints, for example.
• via text message to remind you about upcoming appointments
• via voicemail (where you have agreed to this) or post for missing information or questionnaires
• Where you have indicated to us on a questionnaire or in response to an email that you would be happy to share your experience of receiving therapy provided by Ieso to raise awareness of our service or for therapist training purposes, or to participate in some user experience evaluations, for example, we will use your contact details to give you more information. If you subsequently consent, we will process your information further for this purpose, which would include wider sharing of your personal data as agreed with you.
• We also contact you after you’ve completed treatment to ask for feedback and to check on your wellbeing.

Protect you and/or others - and seek to maintain a confidential and safe environment.These measures include: user authenticated access controls to the service

• restricted access to patient identifiable information. Access to patient records within Ieso is limited on a strictly 'need to know' basis and wherever possible processed by reference to indirect rather than directly identifying information, such as case reference numbers.
• ongoing review of the care and help our professional therapists provide to make sure it meets our quality standards. This includes training, case management support, moderation, supervision and monitoring of messaging and treatment sessions;
• developing learning/ training programmes for our therapists.
• administering our professional compliance duties and obligations.

Conduct analysis and research to improve our service delivery, patient recovery rates and service development. We are passionate about learning from these data by conducting high-quality scientific research to feed into treatment to further improve outcomes. We believe research can help provide a greater understanding of both the causes of mental illness and the effectiveness of treatments for different subgroups of patient. We have internal procedures in place to safeguard your privacy so that only the minimum necessary information is used to conduct the research on the most de-identified data possible.

Much of our research is based on questionnaire scores and responses, in combination with some or all of: number of sessions, age, gender, diagnoses and partial post codes; but we also use machine learning, natural language processing (NLP) and artificial intelligence (AI) on the communications between you and your therapist. Click here for more information about how Ieso uses your data for research.

We only ever share the minimum information necessary to provide the best treatment, care and protection for yourself or others, or to satisfy legal requirements. We have specific processes in place regarding transcripts and messaging, which have restricted access internally, and are only shared externally in very limited circumstances where required to do so by law.

We will always seek your permission before disclosing your personal identifiable information to another person or organisation for any other reason than those set out in these privacy notices, unless we have an overriding legal duty to so do (for example, in the prevention and/or detection of a crime).

We appreciate and respect that the confidentiality of your interactions with the Service are of utmost importance to you. Information is only shared on a strictly ‘need to know’ basis. Anyone receiving information about you will be under an equal legal duty to keep it confidential.

The confidentiality of all information shared between yourself and your therapist is upheld to the highest level possible. We recognise that you may consider some information you give to us, and that may be recorded in the verbatim records of therapy sessions and/or messaging, as particularly sensitive. Relevant internal policies and procedures are designed to share the minimum information necessary to provide the best treatment, care and protection for yourself or others.

In delivering the Service to you, we share minimum personal data with systems we use to process the data - your email address for automated emails, your case reference number if the case is discussed in supervision sessions, and your IP address. (See sections 5 ‘How we store your information’ and section 7 ‘Cookies and tracking’ below.)

The confidentiality of all information shared between yourself and your therapist is upheld to the highest level possible. We recognise that you may consider some information you give to us, and that may be recorded in the transcripts and/or messaging, as particularly sensitive. Relevant internal policies and procedures are designed to share the minimum information necessary to provide the best treatment, care and protection for yourself or others.

Outside the normal course of providing services

We also share the minimum necessary information where required or entitled by law, legal process, or professional ethical or law enforcement reporting purposes. This may include notifying appropriate authorities, regulators or law enforcement agencies, or allowing them confidential access to specific information as part of an inspection or review, or to prevent fraud or cybercrime or any threats. If these circumstances arise, we will inform you wherever possible.

Where you have indicated to us on a questionnaire or in response to an email that you would be happy to share your experience of receiving therapy provided by Ieso to raise awareness of our service, or to participate in some user experience evaluations, we will use your contact details to give you more information and process your information further for this purpose if you subsequently give your consent, which would include wider sharing of your personal data as agreed with you.

If you agree to leave a review of our service on an external site, then the process will include giving a name, email address, star-rating, comment and optional photograph to the 3rd party site e.g. Trustpilot, who will then be the controller of this data. The third-party will not receive any data before your agreement.

In order to conduct research to improve treatment, we sometimes partner with researchers outside of Ieso, e.g. university research groups. When this happens, we remove directly identifiable information from the data we share with them, so they will be unable to identify anyone personally. All partners also sign a legal agreement that any data they receive is kept confidential and secure.

Where you are accessing these services as part of a research project led by another organisation, you will have consented with them to share the relevant data back to them for their research. For the avoidance of doubt this will not include verbatim records of your therapy sessions.

We have internal procedures in place to safeguard your privacy, so that only the minimum necessary information is used to conduct research on the most de-identified data possible. We will always seek your permission ahead of disclosing any information that identifies you directly to any other person or organisation or for any other reason than those set out in this policy without your knowledge or permission unless we have an overriding legal duty to do so.

Sharing your personal information without your consent

The sharing of information about you without your consent is strictly controlled by law. In exceptional situations we may need to share information (only the minimum necessary) without your permission if: • A serious crime has been committed • Withholding information could endanger someone’s life • A child or vulnerable adult is at potential risk or • We are ordered to by a court of law

In such circumstances, we would inform you wherever possible.

Transferring data outside the UK, and holidays during treatment

We seek where possible to prevent any transfers of your personal information to countries which have not been assessed as having adequate data protection standards.

Post Brexit, the UK has accepted all adequacy decisions made by the European Commission. (Decisions on the adequacy of the protection of personal data in third countries, where the Commission have decided that personal data can flow safely between countries). Data can therefore flow freely in the European Union, the European Economic Area (EEA), and 12 other territories without any further safeguards being necessary. (https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en)

Accessing our Services when outside these territories is considered a transfer of data to a third country by data protection legislation. It is at your own risk if you decide to attend therapy sessions whilst you are visiting countries not listed at the web reference above. Our therapists are not permitted to access the Service from outside these territories, so will notify you of any necessary short breaks in your treatment due to travel.

We will not sell or share your personal information for direct marketing or other promotional purposes.

We place great importance on the security of personal identifiable information associated with our patients. We have put controls in place to safeguard the personal information that you provide, applying physical, technical and procedural measures against the loss, misuse and alteration of personal information under our control.

All information submitted by you is encrypted in transit using best-practice Transport Layer Security (TLS) with at least 128-bit encryption. All clinical data is encrypted using the industry-standard AES-256 cipher and stored at hosted facilities with dedicated physical access controls and restricted system access.

We have achieved the International Standard certification for information security (ISO 27001), Cyber Essentials Plus certification, and satisfy the requirements of the NHS Data Security and Protection Toolkit requirements.

Remember also that you are responsible for keeping your password secret at all times when accessing and using the Service.

Ieso Digital Health headquarters are in the United Kingdom (UK), and information about you submitted via the Services is used by us and hosted by our service provider, Microsoft Azure, on secure servers in the UK. As detailed in the Security section of these Privacy Notices, such information is stored in an encrypted state, both in transit and at rest, meaning the provider cannot lawfully access identifiable information.

We use a small number of well-known SaaS (Software as a System) providers to store subsets of your information and enable the uses of information described in these notices. We have Data Processor Agreements in place with each. Where possible these providers store the data in the UK or EEA. Where they are located outside the UK / EEA we ensure they are either party to an adequacy decision or have in place one of the additional safeguards necessary to make the transfer such as Binding Corporate Rules or EU Model Clauses (Standard Contractual Clauses) to uphold your legal data protection rights.

We retain your information and health record as a resource that you can return to at any time you wish. This can help you remember coping strategies, techniques or processes that you learnt in therapy. If you were to experience a setback between sessions or after you’ve completed treatment, you may find it useful to refer to the transcripts/ audio recordings of your therapy sessions and messages. Also, if you were to require further therapy sessions at any time in the future, your therapist would be able to access all your therapy notes. We retain your clinical record by reference to the NHSX Records Management Code of Practice https://www.nhsx.nhs.uk/media/documents/NHSX_Records_Management_Code_of_Practice_2020_3.pdf and to support our legal obligations to be accountable for your care.

The Code is based on current legal requirements and professional best practice.

Research records and data are kept for a minimum of 20 years in accordance with Medical Research Council guidance.

Our data retention practices are reviewed at least annually in conjunction with industry standards and best practice.

You can access specific details relating to your treatment through the Service online at any time directly through your account, these will therefore remain resources available to you after the conclusion of your treatment. These include messaging between you and your therapist between sessions, the sessions themselves, the ‘homework’ activities, questionnaires completed, and any goal setting activities. The sessions comprise a verbatim record of conversation between you and your therapist that are retained in the form of a transcript for text therapy or an audio file for video therapy. You can also update or amend some key registration and contact details directly through your account.

If you feel there is an error of fact on your health record held by us, you can contact us. If we agree the information is incorrect, the alteration will be made. If we are not satisfied the information is factually incorrect, a note will be made of the information you consider is inaccurate. You will be notified of either the correction or the note.

Data protection law also includes the right to data portability and to make other requests to seek to erase, object to and restrict personal data processing where certain limited grounds apply. Note however that data processed for health/treatment and legal purposes, or where other legitimate grounds for the processing apply, are examples of circumstances where some of these rights can be restricted or not apply in practice. Specifically, the right to erasure does not apply when processing is necessary for the provision of healthcare or the management of healthcare systems or service.

If you need assistance or have an enquiry about accessing, updating or amending your records, or where applicable, about receiving or transmitting a file of the data you have provided (for example to your GP) please write to: The Chief Clinical Officer, Ieso Digital Health, Jeffreys Building, Cowley Road, Cambridge, CB4 0DS

Or by email, For the Attention Of the Chief Clinical Officer, to info@iesohealth.com

Our complaints procedure is available on the site, and there is a link to it here.

If you remain unhappy with a response you receive, you can also refer the matter to the Information Commissioner's Office.

We use cookies or similar technologies such as device IDs, pixel tags and web beacons (collectively described here as 'cookies') to collect information about the access to and use of the Ieso site and Service. These typically include a unique reference code that relates to, or is accessed from, a user's device and that enables that device to be remembered when next visiting the site or using the Service and that sometimes track information about a user.

We use cookies for the following reasons:

• Secure login and navigation - we use necessary session cookies to help verify and authenticate your access to the Services and to let you smoothly navigate the Service and use its features.
• Functionality - these cookies allow us to optimise the Service to you. For example, you can shut your browser but not be logged out, as long as an hour of inactivity does not pass, to enable you to complete questionnaires, ‘homework’ etc.
• Analytics and performance - we use cookies to collect information about how you use the site and Service or engage with communications about the Service and which enables us to improve the way each works. These cookies provide us with overall statistics about the number of unique interactions there are with the Site and Service and provides aggregate information on overall patterns of usage. We use a third-party provider, Google Analytics to collect and provide this information by reference to the cookie id and IP of your device and the log information about the use of the site or Service affiliated to that cookie id to measure these activity levels. This information is transmitted to and stored on the servers of Google. You can opt-out from the collection of this information by Google by downloading and installing a browser plug-in at https://tools.google.com/dlpage/gaoptout.

Computers and mobile devices may automatically accept cookies, but you can change your browser to prevent that or to notify you each time a cookie is set. You can also learn more about cookies by visiting www.allaboutcookies.org which includes additional useful information on cookies and how to block cookies using different types of browser. Please note however, that by blocking or deleting cookies you may not be able to take full advantage of the site or Service.

You can also learn more about our use of cookies by visiting our cookies policy.

If you have any questions or comments about these notices, please let us know:

By email: info@iesohealth.com (or for technical support questions contact our technical support team: support@iesohealth.com)

By telephone: on 0800 074 5560

Or by post to: Ieso Digital Health, Jeffreys Building, Cowley Road, Cambridge, CB4 0DS

To reach our data protection officer please use the above details and mark your communication for the attention of: Helen Simpson

In an emergency please contact: • Your GP surgery or local A&E • Urgent Care (for out of hours access to GP):111 • The Samaritans 116 123 or jo@samaritans.org • Emergency Services 999

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.