Privacy Policy

Effective Date: 1 October 2025

Last Updated: 12 January 2026

1. Introduction

Psychology AI Ltd ("Psychology AI", "we", "our", or "us") respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our services, including Psychology AI (the "Services").

Our Services provide AI-assisted wellbeing support and reflective coaching. They are not medical or clinical services and do not provide diagnosis, treatment, or crisis intervention.

Psychology AI Ltd is the data controller for the purposes of the UK General Data Protection Regulation ("UK GDPR").

2. Personal Data We Collect

We may collect and process the following categories of data:

a) User Inputs

Any text, messages, or information you choose to provide while using the Services.

b) AI Outputs

Responses generated by the AI based on your inputs.

c) Account Data

Name, email address, username, and authentication credentials.

d) Device & Usage Data

IP address, device type, operating system, browser information, timestamps, and interaction data.

e) Cookies & Tracking Data

Information collected via cookies and similar technologies (see Section 12).

f) Special Category Data

Due to the nature of our Services, user inputs may include special category personal data under UK GDPR, such as information related to mental wellbeing, emotional state, or psychological experiences.

We only process special category data where explicit consent has been provided.

3. Legal Basis for Processing

We process personal data under the following lawful bases:

• Explicit Consent: For processing special category (mental wellbeing) data.
• Performance of a Contract: To provide and operate the Services.
• Legitimate Interests: For security, analytics, and service improvement, where these do not override your rights.
• Legal Obligations: Where processing is required by law.

You may withdraw consent at any time (see Section 9).

4. How We Use Your Data

We use your data to:

• Provide and personalise the Services
• Maintain and manage user accounts
• Enable continuity of user experience
• Improve system performance and user experience
• Conduct analytics and service optimisation using anonymised or aggregated data
• Communicate important service-related messages
• Send marketing communications only where consent is given
• Prevent fraud, misuse, and security incidents

We do not use identifiable personal data to train AI models without explicit consent.

5. Automated Processing

Our Services use automated systems to generate responses based on user input.

These systems:

• Do not make legal, medical, or similarly significant decisions about users
• Do not replace human professionals
• Are designed to support reflection and wellbeing only

You may request clarification or human review of automated processing at any time.

6. How We Share Your Data

We do not sell your personal data.

We may share data with:

• Service Providers: Hosting, analytics, security, and infrastructure providers.
• Technology Partners: Only where necessary to deliver the Services and under strict contractual safeguards.
• Legal or Regulatory Authorities: Where required by law or to protect legal rights.

All third parties are required to comply with UK GDPR and maintain appropriate security measures.

7. International Data Transfers

Your data may be transferred outside the UK or European Economic Area.

Where this occurs, we ensure appropriate safeguards are in place, including:

• UK Standard Contractual Clauses (SCCs)
• The UK International Data Transfer Addendum
• Adequacy decisions issued by the UK Government

8. Data Retention

We retain personal data only for as long as necessary:

• Account Data: Until account deletion, plus up to 6 months for secure backups.
• User Inputs & AI Outputs: Up to 12 months to support continuity, user review, and safeguarding.
• Anonymised or Aggregated Data: May be retained indefinitely for analytics and system improvement.

You may request deletion of your data at any time.

9. Your Rights Under UK GDPR

You have the right to:

• Access: Request a copy of your personal data.
• Rectification: Correct inaccurate or incomplete data.
• Erasure: Request deletion of your data ("right to be forgotten").
• Restriction: Limit how your data is processed.
• Data Portability: Receive your data in a structured format.
• Object: Object to certain processing activities.
• Withdraw Consent: At any time, without affecting prior processing.

To exercise your rights, contact: info@psychologyai.co.uk

We respond within one month, in line with UK GDPR requirements.

10. Security Measures

We implement strong technical and organisational safeguards, including:

• Encryption of data in transit and at rest
• Role-based access controls
• Secure cloud infrastructure
• Regular security reviews

Users are responsible for keeping their login credentials secure.

11. Children's Privacy

Our Services are intended for individuals aged 16 and over.

If we become aware that we have collected personal data from a child under 16, we will delete it promptly.

12. Cookies & Tracking Technologies

We use cookies and similar technologies for:

• Essential website functionality
• Analytics
• Personalisation

Non-essential cookies are used only with user consent, in accordance with the Privacy and Electronic Communications Regulations (PECR).

You can manage or withdraw cookie consent via our website banner or browser settings.

13. Updates to This Policy

We may update this Privacy Policy to reflect changes in our Services, legal requirements, or data practices.

The latest version will always be available at: www.psychologyai.co.uk/privacy

14. Contact Information

Psychology AI Ltd
Edinburgh, United Kingdom

Email: info@psychologyai.co.uk
Website: www.psychologyai.co.uk