Privacy Policy

Effective Date: 1 October 2025

Last Updated: 16 March 2026

1. Introduction

Psychology AI Ltd ("Psychology AI", "we", "our", or "us") respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our services, including the Psychology AI platform and website (the "Services").

Our Services provide AI-assisted wellbeing support and reflective coaching. They are not medical or clinical services and do not provide diagnosis, treatment, or crisis intervention.

Psychology AI Ltd acts as the data controller for the purposes of the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

2. Personal Data We Collect

We may collect and process the following categories of data:

a) User Inputs

Any text, messages, or information you voluntarily provide while using the Services.

b) AI Outputs

Responses generated by the AI system based on user inputs.

c) Account Data

Information used to create and maintain your account, including your name, email address, authentication credentials, and account identifiers.

d) Device & Usage Data

Technical information about how the Services are accessed, including IP address, browser type, operating system, device type, timestamps, and interaction data.

e) Cookies & Tracking Data

Information collected via cookies and similar technologies used to operate and improve the website (see Section 13).

f) Special Category Data

Due to the nature of the Services, user inputs may contain special category personal data under UK GDPR, including information related to mental wellbeing, emotional state, or psychological experiences.

We process such information only where explicit consent has been provided.

3. Legal Basis for Processing

We process personal data under the following lawful bases:

Explicit Consent: For processing special category data relating to wellbeing or emotional information.
Performance of a Contract: To provide and operate the Services you request.
Legitimate Interests: To improve system performance, ensure security, detect misuse, and enhance user experience where these interests do not override your rights.
Legal Obligations: Where processing is required by law or regulatory authorities.

You may withdraw consent at any time.

4. How We Use Your Data

We use personal data to:

Provide and operate the Services
Generate AI responses to user inputs
Maintain and manage user accounts
Enable continuity of user experience
Improve system performance and reliability
Conduct analytics using anonymised or aggregated data
Communicate service-related notifications
Send marketing communications where consent has been given
Detect fraud, misuse, or security incidents

To deliver the Services, user inputs may be processed by third-party AI providers (such as OpenAI) acting under contractual data protection safeguards.

We do not use identifiable personal data for external AI model training without explicit consent.

5. Automated Processing and AI Systems

Our Services use automated systems and artificial intelligence models to generate responses based on user inputs.

These systems:

Do not make legal, medical, or similarly significant decisions
Are designed for reflection and wellbeing support
Do not replace professional psychological or medical care

AI responses are generated using machine learning models that process user inputs in order to provide conversational responses.

Users may request clarification about automated processing at any time.

Billing and Payments

Payments are processed by Stripe, which acts as an independent payment processor for card and billing transactions.

Psychology AI does not store full payment card details. We retain billing-related records only as necessary for contract administration, fraud prevention, and compliance with legal and tax obligations.

6. AI Technology Providers

To deliver AI-powered responses, certain user inputs may be processed by trusted technology providers operating under strict contractual safeguards.

These providers may include:

OpenAI: AI model infrastructure used to generate responses
Supabase: Authentication and database infrastructure
Vercel: Secure hosting and platform infrastructure
Stripe: Payment processing services

These providers are required to comply with applicable data protection laws and contractual safeguards.

7. How We Share Your Data

We do not sell personal data.

We may share data only where necessary with:

Service Providers: Trusted providers who assist with infrastructure, hosting, authentication, analytics, and security.
Technology Partners: AI processing and system infrastructure partners required to deliver the Services.
Legal Authorities: Where required by law or necessary to protect legal rights, users, or the public.

All third parties must maintain appropriate technical and organisational security safeguards.

8. International Data Transfers

Some service providers may process data outside the United Kingdom or the European Economic Area.

Where such transfers occur, we ensure appropriate safeguards are in place, including:

UK Standard Contractual Clauses (SCCs)
The UK International Data Transfer Addendum
Adequacy decisions recognised by the UK Government

9. Data Retention

We retain personal data only for as long as necessary to operate the Services and meet legal obligations, and for no longer than the periods set out below unless deleted earlier by you.

Typical retention periods include:

Account Data: Retained until you delete your account, plus up to 6 months for secure backups.
User Inputs and AI Outputs: Retained for up to 12 months to support conversation continuity, user review, and service improvement, unless deleted earlier by you.
Anonymised or Aggregated Data: May be retained indefinitely for research, analytics, and system improvement.
Billing Records: Certain billing and transaction records may be retained for the period required by applicable legal, accounting, and tax obligations.

You can delete your data at any time using the in-app "Delete All Data" control. This deletes chat history, AI memories, mood reflections, and preferences while keeping your account active and usable.

You can also delete your account using the in-app "Delete Account" control. Account deletion permanently deletes your profile, login access, and associated personal data, and cannot be undone.

After account deletion, we retain a minimal, non-identifiable audit record in our deletion_log containing only a hashed user identifier for legal, security, and audit purposes.

10. Your Rights Under UK GDPR

You have the following rights:

Right of Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete data.
Right to Erasure: Request deletion of your data or deletion of your account ("right to be forgotten").
Right to Restrict Processing
Right to Data Portability
Right to Object
Right to Withdraw Consent

For erasure requests, you may either delete your data (which removes content data but keeps your account active) or delete your account (which permanently removes your profile, login access, and personal data).

To exercise these rights contact: info@psychologyai.co.uk

We respond to requests within one month as required by UK GDPR.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

11. Security Measures

We implement strong technical and organisational safeguards including:

Encryption in transit and at rest
Role-based access controls
Secure cloud infrastructure
Monitoring and abuse detection systems
Regular security reviews

Users are responsible for maintaining the confidentiality of their login credentials.

12. Children's Privacy

The Services are intended for individuals aged 16 and over.

We do not knowingly collect personal data from children under 16. If such data is identified, it will be deleted promptly.

13. Cookies and Tracking Technologies

We use cookies and similar technologies for:

Essential website functionality
Authentication and security
Analytics
Personalisation

Non-essential cookies (such as analytics) are used only with user consent, in accordance with the Privacy and Electronic Communications Regulations (PECR).

Users may manage or withdraw cookie consent through the website cookie banner or browser settings.

14. Crisis and Safety Notice

Psychology AI provides reflective wellbeing support only.

The Services are not designed for crisis support or emergency assistance.

If you are in immediate danger or experiencing a mental health crisis, please contact:

Your local emergency services
A qualified healthcare professional
A recognised crisis support service

15. Changes to This Policy

We may update this Privacy Policy to reflect changes in the Services, legal requirements, or data processing practices.

The latest version will always be available at: https://www.psychologyai.co.uk/privacy

16. Contact Information

Psychology AI Ltd
Edinburgh, United Kingdom

Email: info@psychologyai.co.uk
Website: https://www.psychologyai.co.uk

For privacy-related enquiries please contact:
info@psychologyai.co.uk

17. AI Safety and Responsible Use

Psychology AI is designed with safeguards to support responsible and ethical use of artificial intelligence in wellbeing contexts.

Our systems include technical and operational controls intended to:

Detect and respond to potentially harmful or crisis-related content
Discourage reliance on AI as a substitute for professional medical or psychological care
Provide supportive and non-judgmental responses
Reduce the risk of harmful or inappropriate outputs

While we strive to ensure safe and responsible AI behaviour, AI-generated responses may occasionally be inaccurate or incomplete.

Users should not rely on the Services for:

Medical advice
Diagnosis or treatment
Crisis support or emergency assistance

Where appropriate, users may be encouraged to seek support from qualified professionals.

18. Research, Product Improvement and Aggregated Data

To improve the quality, safety, and effectiveness of our Services, Psychology AI may analyse anonymised or aggregated usage data.

This may include:

System performance metrics
Usage patterns
Anonymised interaction trends
Product improvement analytics

Where possible, such data is de-identified or aggregated so that individuals cannot be identified.

Aggregated data may be used for:

Service improvement
Internal research and development
Product safety monitoring
Statistical analysis

We do not use identifiable personal data to train AI models without explicit user consent.