Effective date: 31st May 2023
Summary of changes in this update
You may contact us to obtain previous versions of this Privacy Notice.
This Privacy Notice describes the privacy practices of Ieso Digital Health (UK) Limited and our subsidiaries and affiliates (including Ieso Digital Health Limited and Ieso Digital Health, Inc.) (collectively, “ieso”, “we”, “us”, or “our”), and how we handle your personal data that we collect through the provision of Cognitive Behavioural Therapy services provided online through iesohealth.uk (the Site) as well as through other activities described in this Privacy Notice, such as our research and product development activities (the Service). We are data controllers of your personal data and are registered with the Information Commissioner (registration numbers ZA239229 and Z5383093). If you require further information on anything below, please contact our Data Protection Officer via firstname.lastname@example.org. Full details on how to contact us can be found in section 9 below.
Here we explain what personal data we collect, how it is used, shared, secured, stored, and how you can exercise choices and manage your personal data. These Privacy Notices reflect legal requirements and regulations.
We understand that the privacy and confidentiality of all the personal data, especially the verbatim records of therapy sessions, that you provide and we handle, is important to you, and our internal policies and procedures reflect this and the need to share the minimum information necessary.
This Privacy Notice describes our processing of your personal data and related clinical information that we collect when you access or use our Service (“Personal Data”), for the purposes of providing and improving the Service, and for scientific research.
We will not sell your Personal Data for direct marketing or other promotional purposes.
This Privacy Notice applies to any Site where it is referenced, regardless of the computer, mobile or other device you use to access or use the Service. The Site and Service may contain links to websites, mobile applications, and other online services operated by third parties. We do not control websites, mobile applications or online services operated by third parties, and we are not responsible for their actions. We encourage you to read the privacy notices or content of such websites, mobile applications and online services you use.
We reserve the right to change this Privacy Notice from time to time by updating the effective date of this Privacy Notice and posting it on the Site. If we make material changes to this Privacy Notice, we will notify you through your account or by email. In all cases, your use of the Service after the effective date of any modified Privacy Notice indicates you have read and understood the modified Privacy Notice.
We collect the following Personal Data about you in several ways:
You always have the option to refuse to submit personally identifiable information to us, but note that without this information the Services may be unavailable to you.
We add to the information we collect from you with information we receive from other sources.
Certain information is collected automatically from your computer or device about your engagement with the Service.
We use the Personal Data we collect to ensure that we provide you with the best possible treatments both now and in the future. We have appointed a Data Protection Officer and Caldicott Guardian to seek to ensure that our procedures for handling patient information and requests meet with our obligations.
We use the Personal Data that we receive under our terms with you to:
These measures include:
We only ever share the minimum information necessary to provide the best treatments, care and protection for yourself or others, to conduct our research, and/or to satisfy legal requirements. For example, depending on your referring healthcare provider, your Personal Data may be shared to update their records and/or as part of the Minimum Data Set required nationally by NHS England for all its patients. We have specific processes in place regarding verbatim records of sessions which are only shared internally, or externally in very limited circumstances, for example we may facilitate joint viewing of/ listening to specific verbatim records of sessions with the contracting NHS service in the case of a serious upheld complaint, see section 3 'When we share your Personal Data'.
We will always seek your permission before disclosing your personal identifiable information to another person or organisation for any other reason than those set out in these privacy notices, unless we have an overriding legal duty to so do (for example, in the prevention and/or detection of a crime).
Legal bases for processing your Personal Data:
We use your Personal Data only as permitted by law, for the purposes for which we collected it. By agreeing to the terms and conditions of the Service you have entered into a contract with us which forms the legal basis for most of the processing of your Personal Data, including processing for service evaluation and improvement purposes which is deemed compatible with the original purposes of processing.
Safeguarding and NHS minimum data set information is processed under legal obligation;
Standard information sharing with GPs or during referrals for secondary care is by consent;
Sharing with an employment assistance service where available is by consent;
Sharing with emergency services when consent is not possible is under vital interests;
Any information held in establishment or defence of a legal claim or complaint is processed in our legitimate interests; and
Processing to uphold NHS Digital opt outs in England is to carry out a public task.
(see also sharing data without your agreement below)
We process your special category data for medical purposes.
As part of our contract with you, we are committed to continued improvement and development. Research supports us to provide you and all our patients with high-quality evidence-based care and products/ tools, and to help more people get treatment earlier. We publish findings (which only ever include aggregated data) in peer reviewed scientific journals, satisfying the legal basis of the special category data processing being necessary for scientific research purposes, which we use for a subset of our research activities. Where we process your deidentified data for research purposes, which is deemed compatible with the original lawful basis, we rely on legitimate interests and, where we process special category data, additionally scientific research purposes.
We appreciate and respect that the confidentiality of your interactions with the Service are of utmost importance to you. Information is only shared on a strictly ‘need to know’ basis. Anyone receiving information about you will be under an equal legal duty to keep it confidential.
The confidentiality of all information shared between yourself and your therapist is upheld to the highest level possible. We recognise that you may consider some information you give to us, and that may be recorded in the verbatim records of therapy sessions and/or messaging, as particularly sensitive. Relevant internal policies and procedures are designed to share the minimum information necessary to provide the best treatments, care and protection for yourself or others, and to conduct our research.
In delivering the Service to you, your Personal Data may be shared with:
Outside the normal course of providing services
If we believe that care is required for a severe and enduring mental illness, we will discuss this with you and, with your consent, refer relevant personal data to a secondary care (psychiatry led care) provider.
We also share the minimum necessary information where required or entitled by law, legal process, or professional ethical or law enforcement reporting purposes. This may include notifying appropriate authorities, regulators or law enforcement agencies, or allowing them confidential access to specific information as part of an inspection or review, or to prevent fraud or cybercrime or any threats. This would include the sharing of specific information required by government and/ or contracts with our NHS payers (e.g., specific employment information for the Department of Work and Pensions). If these circumstances arise, we will inform you wherever possible.
If you self-refer to ieso from a region where ieso do not directly submit Minimum Data Set statistics to NHS Digital in England, and are unsuitable for our services, your Personal Data will be shared with the NHS healthcare provider who would have funded your treatment with us.
If you indicate to us on a questionnaire or in response to an email that you would be happy to share your experience of receiving therapy provided by ieso to raise awareness of our service or for therapist training purposes, or to participate in some user experience evaluations, we will use your contact details to give you more information and process your Personal Data further for this purpose if you subsequently give your consent, which would include wider sharing of your Personal Data as agreed with you.
If you agree to leave a review of our service on an external site, then the process will include giving a name, email address, star-rating, comment and optional photograph to the 3rd party site e.g., Trustpilot, who will then be the controller of this Personal Data. The third-party will not receive any Personal Data before your agreement.
In order to conduct research and development to improve treatment outcomes and help more people get treatment earlier, we sometimes partner with external researchers, e.g. university researchers or potential future commercial partners. When this happens, we ensure that the data is deidentified and that they will be unable to identify anyone personally. All partners also sign a legal agreement that any Personal Data they receive is kept confidential and secure.
Where you are accessing these services as part of a research project led by another organisation, you will have consented with them to share the relevant Personal Data back to them for their research. For the avoidance of doubt this will not include verbatim records of your therapy sessions.
We have internal procedures in place to safeguard your privacy, so that only the minimum necessary information is used to conduct research and development on the most de-identified data possible. We will always seek your permission before disclosing your personal identifiable information to another person or organisation for any other reason than those set out in these privacy notices, unless we have an overriding legal duty to so do (for example, in the prevention and/or detection of a crime).
Sharing your Personal Data without your agreement
The sharing of your Personal Data without your agreement is strictly controlled by law.
In exceptional situations we may need to share information (only the minimum necessary) without your permission if:
In such circumstances, we would inform you wherever possible.
Transferring Personal Data outside the UK/European Union, and holidays during treatment
We seek where possible to prevent any transfers of your Personal Data to countries which have not been assessed as having adequate data protection standards.
The European Commission makes decisions on the adequacy of the protection of personal data in third countries and have decided that personal data can flow safely between countries in the European Union, the European Economic Area (EEA), and other listed territories without any further safeguards being necessary. Post UK departure from the EU, the UK has been granted adequacy by the EU, and the UK has accepted the European Commission’s adequacy decisions for the UK too, and also included Gibraltar.
If we transfer your Personal Data out of the EEA and the UK to a country not deemed by the relevant regulatory authority to provide an adequate level of personal information protection, the transfer will be performed (i) pursuant to the recipient’s compliance with standard contractual clauses (with additional technological and organisational controls as necessary or appropriate) or Binding Corporate Rules; (ii) pursuant to your consent; or (iii) as otherwise permitted by applicable data protection requirements.
You may contact us if you want further information on the specific mechanism used by us when transferring your personal information out of the United Kingdom and the EEA.
We will not sell your Personal Data for direct marketing or other promotional purposes.
We place great importance on the security of personal identifiable information associated with our patients. We have put controls in place to safeguard the Personal Data that you provide, applying physical, technical and procedural measures against the loss, misuse and alteration of Personal Data under our control.
All information submitted by you is encrypted in transit using best-practice Transport Layer Security (TLS) with at least 128-bit encryption. All clinical data is encrypted using the industry-standard AES-256 cipher and stored in Microsoft Azure, on secure servers in the UK, managed by ieso.
We have achieved the International Standard certification for information security (ISO 27001), Cyber Essentials Plus certification, and satisfy the requirements of the NHS Data Security and Protection Toolkit requirements.
Remember also that you are responsible for keeping your password secret at all times when accessing and using the Service.
ieso’s headquarters are in the United Kingdom (UK), and information about you submitted via the Services is stored securely in the UK/European Union and managed by ieso. Until our change of patient management system is complete, the storage will be hosted by Microsoft Azure; after a successful integration and migration stage, your patient file will be stored in the iaptus patient management system (used by over 200 NHS customers and vetted by ieso) which is hosted by Amazon Web Services (in the UK). We will continue to use Microsoft Azure for storage of our research and service evaluation data. Both software providers may access your data in specific, approved circumstances and we have Data Processor Agreements in place with Mayden House who develop and own iaptus, and Microsoft. As detailed in the Security section of this Privacy Notice, such information is stored in an encrypted state, both in transit and at rest.
We also use a small number of well-known SaaS (Software as a Service) providers to store smaller subsets of your Personal Data and enable the uses of the Personal Data as described in this privacy notice. We have Data Processor Agreements in place with each SaaS provider. Where possible these providers store the Personal Data in the UK or EEA. Where they are located outside the UK / EEA we ensure they are either party to an adequacy decision or have in place one of the additional safeguards necessary to make the transfer such as Binding Corporate Rules or Standard Contractual Clauses (with additional technological and organisational controls as necessary or appropriate) to uphold your legal data protection rights.
We retain your Personal Data for as long as necessary to fulfil the purposes for which we collected it. To determine the appropriate retention period for Personal Data, we consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements.
In particular, we retain records in accordance with NHSX Records Management Code of Practice:
When we no longer require the Personal Data we have collected about you, we will either delete or anonymise it or, if this is not possible (for example, because your Personal Data has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible. If we anonymise your personal information (so that it can no longer be associated with you), we may use this information indefinitely without further notice to you.
You can access specific details relating to your treatment through the Service online at any time directly through your account, these will therefore remain resources available to you after the conclusion of your treatment. These include messaging between you and your therapist between sessions, the sessions themselves, the ‘homework’ activities, questionnaires completed, and any goal setting activities. The sessions comprise a verbatim record of conversation between you and your therapist that are retained in the form of a transcript for text therapy or an audio file for video therapy. You can also update or amend some key registration and contact details directly through your account.
If you feel there is an error of fact on your health record held by us, you can contact us, or in respect of your wider medical record your referring healthcare service or GP. If we or they agree the information is incorrect, the alteration will be made. If we or they are not satisfied the information is factually incorrect, a note will be made of the information you consider is inaccurate, and you will be notified of either the correction or the note.
Data protection law also includes the right to data portability and to make other requests to seek to erase, object to and restrict Personal Data processing where certain limited grounds apply. Note however that Personal Data processed for health/treatment and legal purposes, or where other legitimate grounds for the processing apply, are examples of circumstances where some of these rights can be restricted or not apply in practice. Specifically, the right to erasure does not apply when processing is necessary for the provision of healthcare or the management of healthcare systems or service.
If you need assistance or have an enquiry about accessing, updating or amending your records, or where applicable, about receiving or transmitting a file of the Personal Data you have provided (for example to your GP) please contact us.
Our complaints procedure is available on the site, and there is a link to it here. If you remain unhappy with a response you receive, you can also refer the matter to the Information Commissioner's Office.
Computers and mobile devices may automatically accept cookies, but you can change your browser to prevent that or to notify you each time a cookie is set. You can also learn more about cookies by visiting www.allaboutcookies.org which includes additional useful information on cookies and how to block cookies using different types of browser. Please note however, that by blocking or deleting cookies you may not be able to take full advantage of the site or Service.
Our Services are not intended for use by anyone under 16 years old. Our contract with your healthcare provider determines the lower age limit for our Services. As standard it is 18, but specific contracts also include 16 and 17 year olds.
If you have any questions or comments about this privacy notice, please let us know:
By email: email@example.com (or for technical support questions contact our technical support team: firstname.lastname@example.org)
By telephone: on 0800 074 5560
Or by post to: Ieso Digital Health, Jeffreys Building, Cowley Road, Cambridge, CB4 0DS
To reach our data protection officer please use the above details and mark your communication for the attention of: Helen Simpson
In an emergency regarding your health please contact:
It is important that the Personal Data we hold about you is accurate and current. Please keep us informed if your Personal Data changes during your relationship with us.