Privacy Policy

Effective Date: 1 October 2025

Last Updated: 16 March 2026

1. Introduction

Psychology AI Ltd ("Psychology AI", "we", "our", or "us") respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our services, including the Psychology AI platform and website (the "Services").

Our Services provide AI-assisted wellbeing support and reflective coaching. They are not medical or clinical services and do not provide diagnosis, treatment, or crisis intervention.

Psychology AI Ltd acts as the data controller for the purposes of the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

2. Personal Data We Collect

We may collect and process the following categories of data:

a) User Inputs

Any text, messages, or information you voluntarily provide while using the Services.

b) AI Outputs

Responses generated by the AI system based on user inputs.

c) Account Data

Information used to create and maintain your account, including your name, email address, authentication credentials, and account identifiers.

d) Device & Usage Data

Technical information about how the Services are accessed, including IP address, browser type, operating system, device type, timestamps, and interaction data.

e) Cookies & Tracking Data

Information collected via cookies and similar technologies used to operate and improve the website (see Section 13).

f) Special Category Data

Due to the nature of the Services, user inputs may contain special category personal data under UK GDPR, including information related to mental wellbeing, emotional state, or psychological experiences.

We process such information only where explicit consent has been provided.

3. Legal Basis for Processing

We process personal data under the following lawful bases:

• Explicit Consent: For processing special category data relating to wellbeing or emotional information.
• Performance of a Contract: To provide and operate the Services you request.
• Legitimate Interests: To improve system performance, ensure security, detect misuse, and enhance user experience where these interests do not override your rights.
• Legal Obligations: Where processing is required by law or regulatory authorities.

You may withdraw consent at any time.

4. How We Use Your Data

We use personal data to:

• Provide and operate the Services
• Generate AI responses to user inputs
• Maintain and manage user accounts
• Enable continuity of user experience
• Improve system performance and reliability
• Conduct analytics using anonymised or aggregated data
• Communicate service-related notifications
• Send marketing communications where consent has been given
• Detect fraud, misuse, or security incidents

We do not use identifiable personal data to train AI models without explicit consent.

5. Automated Processing and AI Systems

Our Services use automated systems and artificial intelligence models to generate responses based on user inputs.

These systems:

• Do not make legal, medical, or similarly significant decisions
• Are designed for reflection and wellbeing support
• Do not replace professional psychological or medical care

AI responses are generated using machine learning models that process user inputs in order to provide conversational responses.

Users may request clarification about automated processing at any time.

6. AI Technology Providers

To deliver AI-powered responses, certain user inputs may be processed by trusted technology providers operating under strict contractual safeguards.

These providers may include:

• OpenAI: AI model infrastructure used to generate responses
• Supabase: Authentication and database infrastructure
• Vercel: Secure hosting and platform infrastructure
• Stripe: Payment processing services

These providers are required to comply with applicable data protection laws and contractual safeguards.

7. How We Share Your Data

We do not sell personal data.

We may share data only where necessary with:

• Service Providers: Trusted providers who assist with infrastructure, hosting, authentication, analytics, and security.
• Technology Partners: AI processing and system infrastructure partners required to deliver the Services.
• Legal Authorities: Where required by law or necessary to protect legal rights, users, or the public.

All third parties must maintain appropriate technical and organisational security safeguards.

8. International Data Transfers

Some service providers may process data outside the United Kingdom or the European Economic Area.

Where such transfers occur, we ensure appropriate safeguards are in place, including:

• UK Standard Contractual Clauses (SCCs)
• The UK International Data Transfer Addendum
• Adequacy decisions recognised by the UK Government

9. Data Retention

We retain personal data only for as long as necessary to operate the Services.

Typical retention periods include:

• Account Data: Retained until the user deletes their account, plus up to 6 months for secure backups.
• User Inputs and AI Outputs: May be retained for up to 12 months to support conversation continuity, user review, and service improvement.
• Anonymised or Aggregated Data: May be retained indefinitely for research, analytics, and system improvement.

Users may request deletion of their data at any time.

10. Your Rights Under UK GDPR

You have the following rights:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your data ("right to be forgotten").
• Right to Restrict Processing
• Right to Data Portability
• Right to Object
• Right to Withdraw Consent

To exercise these rights contact: info@psychologyai.co.uk

We respond to requests within one month as required by UK GDPR.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

11. Security Measures

We implement strong technical and organisational safeguards including:

• Encryption in transit and at rest
• Role-based access controls
• Secure cloud infrastructure
• Monitoring and abuse detection systems
• Regular security reviews

Users are responsible for maintaining the confidentiality of their login credentials.

12. Children's Privacy

The Services are intended for individuals aged 16 and over.

We do not knowingly collect personal data from children under 16. If such data is identified, it will be deleted promptly.

13. Cookies and Tracking Technologies

We use cookies and similar technologies for:

• Essential website functionality
• Authentication and security
• Analytics
• Personalisation

Non-essential cookies (such as analytics) are used only with user consent, in accordance with the Privacy and Electronic Communications Regulations (PECR).

Users may manage or withdraw cookie consent through the website cookie banner or browser settings.

14. Crisis and Safety Notice

Psychology AI provides reflective wellbeing support only.

The Services are not designed for crisis support or emergency assistance.

If you are in immediate danger or experiencing a mental health crisis, please contact:

• Your local emergency services
• A qualified healthcare professional
• A recognised crisis support service

15. Changes to This Policy

We may update this Privacy Policy to reflect changes in the Services, legal requirements, or data processing practices.

The latest version will always be available at: https://www.psychologyai.co.uk/privacy

16. Contact Information

Psychology AI Ltd
Edinburgh, United Kingdom

Email: info@psychologyai.co.uk
Website: https://www.psychologyai.co.uk

For privacy-related enquiries please contact:
info@psychologyai.co.uk

17. AI Safety and Responsible Use

Psychology AI is designed with safeguards to support responsible and ethical use of artificial intelligence in wellbeing contexts.

Our systems include technical and operational controls intended to:

• Detect and respond to potentially harmful or crisis-related content
• Discourage reliance on AI as a substitute for professional medical or psychological care
• Provide supportive and non-judgmental responses
• Reduce the risk of harmful or inappropriate outputs

While we strive to ensure safe and responsible AI behaviour, AI-generated responses may occasionally be inaccurate or incomplete.

Users should not rely on the Services for:

• Medical advice
• Diagnosis or treatment
• Crisis support or emergency assistance

Where appropriate, users may be encouraged to seek support from qualified professionals.

18. Research, Product Improvement and Aggregated Data

To improve the quality, safety, and effectiveness of our Services, Psychology AI may analyse anonymised or aggregated usage data.

This may include:

• System performance metrics
• Usage patterns
• Anonymised interaction trends
• Product improvement analytics

Where possible, such data is de-identified or aggregated so that individuals cannot be identified.

Aggregated data may be used for:

• Service improvement
• Internal research and development
• Product safety monitoring
• Statistical analysis

We do not use identifiable personal data to train AI models without explicit user consent.