Skip to main content
Find my therapist

Privacy Policy for Aligned Therapy

Effective date: 31 August 2026

Last updated 8 October 2026 — we now describe Ally as our AI matching agent. Nothing about how we use your data has changed.

This Privacy Policy explains how Aligned Therapy Ltd, trading as Aligned / Aligned Therapy (“Aligned”, “we”, “us”, “our”) collects, uses, shares, and protects personal data when you use our therapy-matching and introduction service (the “Service”). It applies to both Clients and Therapists.

This policy should be read alongside our Terms of Service.

Summary (plain English)

What we collect:

  • Contact details and basic profile info
  • Therapy-matching intake information (which may include health information)
  • Preferences and practical constraints (budget, availability, location, format)
  • Communications and transcripts (from your matching conversation with Ally, and when you contact us)
  • Limited technical data (device, IP address, cookies—where enabled)

Why we collect it:

  • To provide matching and introductions to independent therapists
  • To operate, secure, and improve the Service
  • To provide support and handle complaints
  • To meet legal, tax, and regulatory obligations (where relevant)

Who we share with:

  • Independent therapists (only after you approve an introduction, and only what’s necessary)
  • Service providers who help us run the Service (e.g., hosting, email, analytics, AI/transcription) under contract
  • Advertising platforms (currently Google and OpenAI) — hashed contact identifiers and conversion reports used to measure our advertising — only where you have given cookie consent
  • Authorities only where legally required

How long we keep it:

  • Typically 3 years for client health/intake data (unless you withdraw consent earlier)
  • Typically 5 years for non-health client account/support data
  • Typically 7 years for therapist account/financial records

Your rights:

  • Access, correction, deletion, restriction, objection, portability, and withdrawal of consent (where we rely on consent)

1) Who we are (Data Controller) and how to contact us

Data Controller: Aligned Therapy Ltd (England and Wales)

Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ

Contact (privacy and data requests):

Email: support@aligned.co.uk

Alternative: liam@aligned.co.uk

If you contact us, we may need to verify your identity before actioning a request.

ICO registration: Aligned Therapy Ltd is registered with the Information Commissioner's Office (ICO) under registration reference ZC114778.

Data Protection Officer: Given the current scale of our operations, we have assessed that we are not required to appoint a Data Protection Officer under UK GDPR Article 37. We keep this assessment under review as the business grows. For any data protection queries, please contact us using the details above.

2) What data we collect

We group data into categories so we can evolve forms and processes without constantly rewriting the policy.

2.1 Client data (examples)

  • A. Identity & contact — Name, email, phone number
  • B. Matching intake (may include special category/health data) — What you want help with, relevant history (if you choose to share it), therapy goals. Risk flags you volunteer (e.g., “I feel unsafe”) — note: we are not a crisis service
  • C. Preferences & constraints — Budget, availability, location, online/in-person preference. Therapist preferences (e.g., style, experience)
  • D. Communications — Messages you send us and we send you. Where you choose WhatsApp introductions, the content you exchange with us in WhatsApp threads/groups we set up
  • E. AI matching conversations and transcripts — What you share with Ally, our AI matching agent, in a text conversation (and audio recordings and transcripts, where a voice option is offered and you choose it), plus summaries and metadata (time/date, duration)
  • F. Technical and usage — IP address, device/browser information, approximate location (derived from IP), log data. Cookie and analytics data where enabled (see Cookies section). A one-way hashed device signal used only for fraud prevention (see Section 4.1F)

2.2 Therapist data (examples)

  • A. Identity & contact — Name, professional email, phone, practice details
  • B. Professional credentials — Professional body memberships/registration details, qualifications, insurance confirmation (as applicable)
  • C. Practice info — Modalities, fees, availability, client groups, working preferences
  • D. Communications and onboarding — Messages with us; onboarding/interview notes or transcripts (where used)
  • E. Financial/administrative — Invoicing and accounting records (where relevant)

3) Where data comes from

  • Directly from you (forms, calls, your matching conversation with Ally, emails/WhatsApp)
  • From therapists (their profile information and responses)
  • From public sources (limited checks where relevant, such as professional registers or public websites)
  • From your device/browser (technical logs, cookies—where enabled)

4) Why we use your data and our lawful bases

UK GDPR requires a lawful basis. Where we process health data (special category data), we also need an additional condition.

4.1 Clients

A. Provide the matching and introduction service — Purpose: collect intake information, assess preferences/constraints, identify potential therapist matches, and (if you approve) introduce you. Lawful basis (Article 6): contract and/or legitimate interests. Special category condition (Article 9): explicit consent for health/special category data where required.

B. AI matching conversations — Purpose: capture, transcribe and summarise what you share with Ally to support matching and service delivery. Our AI language-model provider (US-based) processes the conversation on our behalf to do this. Lawful basis (Article 6): contract and/or legitimate interests. Article 9: explicit consent where health data is involved. We tell you clearly that Ally is an AI service before you start a conversation, and we ask for your explicit consent (including for any health information you have shared) before you submit your matching request.

C. Support, quality, and improvement — Purpose: customer support, troubleshooting, preventing misuse, improving match quality. Lawful basis: legitimate interests; in some cases contract. Where special category data is used for improvement: we rely on explicit consent where required, and we minimise/aggregate/anonymise where possible.

D. Legal and compliance — Purpose: respond to lawful requests, exercise or defend legal claims, comply with legal obligations. Lawful basis: legal obligation and/or legitimate interests.

E. Marketing-measurement and audience targeting (where you have given cookie consent) — Purpose: measure how effective our advertising is and find similar prospective clients. We do this by sharing hashed versions of email and (where present) phone number with Google Ads (Customer Match), by sending conversion reports to the advertising platforms our visitors come from (currently Google, and OpenAI for ChatGPT advertising), and by storing ad-click identifiers (such as Google’s gclid and equivalent identifiers from other advertising platforms) with our analytics data. Lawful basis (Article 6): consent (via cookie settings). No special category / health data is shared for this purpose. See Section 6.3 for the operational detail.

F. Fraud and abuse prevention — Purpose: spotting repeat or fraudulent submissions made under different identities. When you submit a form we create a one-way, salted cryptographic hash of your IP address and browser details. The raw values are not stored for this purpose, and the hash is deleted automatically after 90 days. Lawful basis (Article 6): legitimate interests (protecting the Service, our clients and our therapists from fraudulent or abusive use). You have the right to object to processing based on legitimate interests — see Section 9.

4.2 Therapists

A. Onboarding and eligibility checks — Purpose: confirm suitability to receive referrals and maintain service quality. Lawful basis: contract; legitimate interests; and legal obligation where applicable.

B. Matching operations — Purpose: share anonymised client summaries to check fit/availability; facilitate introductions after client approval. Lawful basis: contract and legitimate interests.

C. Administration and accounting — Purpose: invoicing, record keeping, dispute handling. Lawful basis: contract and legal obligation.

5) How introductions work (and what we share)

5.1 Anonymised outreach first (where helpful) — To check fit and availability, we may contact therapists with an anonymised summary (for example: presenting issues, preferences, timing, format). This summary should not include your name or direct contact details.

5.2 Identifiable details only after you approve — We will only share your name and contact details with a therapist after you explicitly agree to be introduced.

5.3 Email and WhatsApp — Introductions and updates are sent by email and, where you have given us a mobile number, by WhatsApp. Messages you exchange with us on WhatsApp are processed by WhatsApp (Meta Platforms) as an independent third-party service under their own terms and privacy practices. On our side, we use WhatsApp to facilitate your matching journey and introductions, and message history is kept in our WhatsApp business account for our records. If you would rather not be contacted on WhatsApp, tell us at any time and we will use email only. You can also ask us to delete your WhatsApp message history by emailing admin@aligned.co.uk.

6) Who we share data with

We do not sell your personal data. We share data only with:

6.1 Therapists (independent practitioners) — When: only after you approve an introduction (for identifiable details), or earlier only as an anonymised summary. What: the minimum necessary information for matching/introduction.

6.2 Service providers (processors) — We use third parties to run the Service, under contracts that require appropriate security and confidentiality. Key processors include:

  • Cloudflare (website hosting, infrastructure, and database)
  • ElevenLabs (AI voice conversations, where a voice option is offered and you choose it, plus transcripts of past voice conversations)
  • Deepgram (call transcription, where applicable)
  • Resend (transactional email delivery)
  • Airtable (client and therapist record management)
  • Google Analytics (analytics and product measurement, where you opt in via cookie settings)
  • Cookiebot (cookie consent management)
  • Our AI language-model provider (a US-based provider of AI text processing — helps us summarise and organise matching conversations and related records)
  • Statsig (product analytics and session recordings, where you opt in via cookie settings)
  • Dialpad (our phone system — call handling and recording for phone and callback contact)
  • Google Workspace (our team’s email and document tools, used to prepare and send communications)
  • Google Tag Manager (delivers the consent-gated analytics and advertising tags described in Section 10)
  • Accounting/bookkeeping tools

6.3 Advertising platforms — Where you have given marketing-cookie consent, we may share limited data with the advertising platforms our visitors come from — currently Google Ads and OpenAI (ChatGPT advertising): hashed versions of contact identifiers (email address and, where present, phone number — never the plain values), conversion reports confirming that an advertising visit led to an enquiry (which can include your IP address and browser details), and ad-click identifiers stored with our analytics data to measure advertising effectiveness. We never share your intake responses, or any health or matching information, with advertising platforms. You can withdraw consent at any time via the cookie settings link.

6.4 Professional/regulatory bodies and authorities — Only where required by law, or to exercise/defend legal claims.

7) International transfers

Some of our providers process data in the United States — including our AI language-model provider and the analytics and advertising platforms described above — and some may process data in other countries outside the UK. Where data is transferred internationally and the destination is not covered by a UK adequacy decision, we use appropriate safeguards (such as the UK International Data Transfer Agreement and/or the UK Addendum to the EU Standard Contractual Clauses) and, where appropriate, carry out transfer risk assessments.

You can request more information about safeguards by emailing support@aligned.co.uk.

8) Retention (how long we keep data)

We keep personal data only as long as necessary for the purposes described, including legal and operational needs.

8.1 Clients — Health/special category intake data (including transcripts/summaries where applicable): typically up to 3 years from collection, unless you withdraw consent earlier. Non-health account/support data: typically up to 5 years after your last interaction.

8.2 Therapists — Account/profile and operational records: typically up to 7 years after deactivation. Onboarding/interview transcripts (if used): typically up to 3 years.

8.3 Legal holds — We may retain limited data longer where necessary to comply with legal obligations or to establish, exercise, or defend legal claims.

9) Your rights (UK GDPR)

You have rights including:

  • Access (get a copy of your data)
  • Rectification (correct inaccurate data)
  • Erasure (delete data in certain circumstances)
  • Restriction (limit processing)
  • Portability (receive data in a usable format where applicable)
  • Objection (to processing based on legitimate interests)
  • Withdraw consent (where we rely on consent) — see below

To exercise any of these rights, email admin@aligned.co.uk. We aim to respond within one month.

Withdrawing consent: Where we process your data based on consent (including health data and AI matching conversations), you can withdraw that consent at any time by emailing admin@aligned.co.uk. Once we receive your request, we will stop the relevant processing promptly. Withdrawal does not affect the lawfulness of processing carried out before you withdrew. If you withdraw consent for health-data processing, we will delete or anonymise that data unless we have another lawful basis to retain it (for example, a legal obligation).

ICO complaint right: You can complain to the Information Commissioner’s Office (ICO). We encourage you to contact us first. ICO contact details: ico.org.uk, telephone 0303 123 1113, or write to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

10) Cookies and analytics

We use cookies, similar browser storage, and analytics to operate and improve the Service.

10.1 What we use — Strictly necessary cookies keep the site secure and remember your consent choices (set by us and by Cookiebot, our consent manager). Statistics cookies and similar storage help us understand how the site is used — set by Google Analytics and Statsig, and only if you opt in. Marketing cookies measure whether our advertising works — set by Google Ads and OpenAI (ChatGPT advertising), and only if you opt in. We also use your browser’s local storage for the same consent-gated analytics purposes.

10.2 The full list — The cookie banner’s “Show details” view lists every cookie we use — who sets it, what it is for, and how long it lasts — and is kept up to date automatically.

10.3 Managing preferences — Use the cookie settings link to change your choices at any time. You can also control cookies in your browser settings.

11) Security

We use appropriate technical and organisational measures, such as encryption in transit and at rest, role-based access controls, logging and monitoring, minimisation and anonymisation, and incident response processes. No method is 100% secure, but we work to protect your information with proportionate safeguards.

12) Automated processing and profiling

We may use technology (including AI tools) to help organise, summarise, and interpret information for matching. We do not make decisions with legal or similarly significant effects solely by automated means.

13) Third-party links

Our website may link to third-party sites. This policy does not apply to those sites.

14) Children’s data

The Service is for adults aged 18+. We do not knowingly collect personal data from children.

15) Changes to this policy

We may update this policy. The “Effective date” will change. If changes are material, we will take reasonable steps to notify users.

Contact

For privacy questions or to exercise your rights: support@aligned.co.uk (or liam@aligned.co.uk)