Privacy Policy for Aligned Therapy

Data Controller: Aligned Therapy Ltd (England and Wales)

Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ

Contact (privacy and data requests):

Email: support@aligned.co.uk

Alternative: liam@aligned.co.uk

If you contact us, we may need to verify your identity before actioning a request.

ICO registration: Aligned Therapy Ltd is registered with the Information Commissioner's Office (ICO) under registration reference ZC114778.

Data Protection Officer: Given the current scale of our operations, we have assessed that we are not required to appoint a Data Protection Officer under UK GDPR Article 37. We keep this assessment under review as the business grows. For any data protection queries, please contact us using the details above.

5.1 Anonymised outreach first (where helpful) — To check fit and availability, we may contact therapists with an anonymised summary (for example: presenting issues, preferences, timing, format). This summary should not include your name or direct contact details.

5.2 Identifiable details only after you approve — We will only share your name and contact details with a therapist after you explicitly agree to be introduced.

5.3 Email vs WhatsApp — You can choose whether introductions happen via email or WhatsApp (where available). If you choose WhatsApp, messages are processed by WhatsApp (Meta Platforms) as an independent third-party service under their own terms and privacy practices. On our side: we use WhatsApp solely to facilitate the introduction you requested. We retain WhatsApp messages only for as long as needed to complete the introduction and for reasonable record-keeping (typically up to 3 years, consistent with our health-data retention period). You can request a switch to email at any time, and you can ask us to delete your WhatsApp message history by emailing admin@aligned.co.uk.

6.1 Therapists (independent practitioners) — When: only after you approve an introduction (for identifiable details), or earlier only as an anonymised summary. What: the minimum necessary information for matching/introduction.

6.2 Service providers (processors) — We use third parties to run the Service, under contracts that require appropriate security and confidentiality. Key processors include:

• Cloudflare (website hosting, infrastructure, and database)
• ElevenLabs (AI voice and text intake, where you opt in)
• Deepgram (call transcription, where applicable)
• Resend (transactional email delivery)
• Airtable (client and therapist record management)
• Mixpanel and Google Analytics (analytics and product measurement, where you opt in via cookie settings)
• Cookiebot (cookie consent management)
• Accounting/bookkeeping tools

6.3 Advertising platforms (hashed identifiers only) — Where you have given cookie consent, we may share hashed versions of contact identifiers (email address and, where present, phone number) with Google Ads (Customer Match) to measure marketing effectiveness and reach similar audiences. Identifiers are hashed with SHA-256 on our infrastructure before upload — the platform never receives your plain email or phone. We never share intake responses, health or matching data this way. Membership lasts up to 540 days from the most recent upload, after which Google automatically removes the entry. You can withdraw consent at any time via the cookie settings link.

6.4 Professional/regulatory bodies and authorities — Only where required by law, or to exercise/defend legal claims.

Some providers may process data outside the UK. Where data is transferred internationally and the destination is not covered by an adequacy decision, we use appropriate safeguards (such as the UK International Data Transfer Agreement and/or UK Addendum to EU SCCs) and, where appropriate, carry out transfer risk assessments.

You can request more information about safeguards by emailing support@aligned.co.uk.

8.1 Clients — Health/special category intake data (including transcripts/summaries where applicable): typically up to 3 years from collection, unless you withdraw consent earlier. Non-health account/support data: typically up to 5 years after your last interaction.

8.2 Therapists — Account/profile and operational records: typically up to 7 years after deactivation. Onboarding/interview transcripts (if used): typically up to 3 years.

8.3 Legal holds — We may retain limited data longer where necessary to comply with legal obligations or to establish, exercise, or defend legal claims.

To exercise any of these rights, email admin@aligned.co.uk. We aim to respond within one month.

Withdrawing consent: Where we process your data based on consent (including health data and AI/voice intake), you can withdraw that consent at any time by emailing admin@aligned.co.uk. Once we receive your request, we will stop the relevant processing promptly. Withdrawal does not affect the lawfulness of processing carried out before you withdrew. If you withdraw consent for health-data processing, we will delete or anonymise that data unless we have another lawful basis to retain it (for example, a legal obligation).

ICO complaint right: You can complain to the Information Commissioner’s Office (ICO). We encourage you to contact us first. ICO contact details: ico.org.uk, telephone 0303 123 1113, or write to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

10.1 Cookie types — Strictly necessary cookies: required for basic functionality. Optional analytics cookies: used to understand website usage; only set if you opt in.

10.2 Managing preferences — Use the cookie settings link (where available) to adjust optional cookies. You can also control cookies in your browser settings.