Privacy policy.

MINDYOURSELF PRIVACY NOTICE

Version 2.1.2

Last updated: 01 September 2026

This notice explains how MindYourself App Ltd collects, uses, protects and shares personal information when you use the MindYourself website or app, request or receive peer support, ask for professional support, or otherwise interact with the MindYourself programme.

AT A GLANCE

We collect only the personal information reasonably needed to operate the service and arrange support.

You can browse wellbeing resources without being asked to disclose the content of any personal issue to your employer.

The initial peer-support request form is deliberately minimal and does not ask for medical history, diagnosis or details of a health condition. It collects only the information needed to arrange contact.

During peer support, a trained peer may collect relevant health or wellbeing information. A brief, proportionate summary case note is retained separately in WriteUpp for clinical governance. Access to stored peer-support case notes in WriteUpp is restricted to the MindYourself Clinical Lead.

Client reporting is designed to be anonymous and aggregated. Client organisations do not receive access to identifiable peer-support case notes. We may combine or suppress small-number reporting where there is a risk that an individual could be identified.

We do not sell personal information and we do not use it for advertising profiling.

KEY POINT

If your employer or another organisation makes MindYourself available to you, that does not mean they can see that you have requested peer support or what you discuss.

We provide client organisations with anonymised or aggregated programme information, not the content of confidential peer-support conversations, except in the limited circumstances explained in this notice.

  1. WHO WE ARE

MindYourself App Ltd (company number 14202590) provides peer-support, wellbeing and related support services, including a web-based app and support-request service.

Registered / correspondence address:

Unit 18T8
Brooke’s Mill
Armitage Bridge
Huddersfield
West Yorkshire
HD4 7NR

Privacy contact: contactus@mindyourselfapp.com

MindYourself App Ltd is the data controller for personal information we collect directly to operate the app and peer-support programme, unless we tell you otherwise.

For some client-specific activities we may instead act as a processor on the client organisation’s instructions. Our role is assessed for each processing activity and is documented in the relevant client arrangements.

  1. WHAT THIS NOTICE COVERS

This notice applies when you:

  • use the MindYourself website or web app;

  • access wellbeing information, tools or programme resources;

  • submit a request for peer support;

  • receive support from a trained peer supporter through the programme;

  • ask MindYourself to help arrange professional or clinical support;

  • contact MindYourself through our website, enquiry forms or email to ask about our services, or with a question, complaint or data-rights request; or

  • interact with MindYourself in relation to programme administration, events or business communications.

  1. INFORMATION WE MAY COLLECT

The information we collect depends on how you use the service.

We separate the minimum information needed to arrange peer support from the more sensitive information that may arise later during a peer-support conversation.

APP AND ACCESS INFORMATION

This may include:

  • organisation or programme access information;

  • a user or account identifier where used; and

  • login or access events.

We use this information to provide access, maintain security and operate the service.

TECHNICAL AND USAGE INFORMATION

This may include:

  • IP address;

  • browser or device information;

  • diagnostic information;

  • page or feature interactions; and

  • session information where generated by the platform.

We use this information to keep the service secure, understand how it is used and improve reliability and usability.

PEER-SUPPORT REQUEST INFORMATION

When you request peer support, we may collect:

  • your name;

  • contact details;

  • preferred time for contact;

  • your organisation or programme; and

  • whether the request relates to personal circumstances, work, or both.

We use this information to receive, allocate and administer your request and arrange contact with a peer supporter.

The request form is deliberately limited. We ask only for the information needed to arrange contact and administer the request.

We do not ask you to provide a diagnosis, medical history, details of treatment or a description of the issue you want to discuss on the initial request form.

HEALTH AND WELLBEING INFORMATION DISCUSSED DURING PEER SUPPORT

During peer support, you may choose to discuss information about:

  • your mental or physical health;

  • wellbeing or stress;

  • personal circumstances;

  • work-related issues; or

  • risks or concerns relevant to the support conversation.

We use this information to enable the trained peer to provide safe and appropriate support and to identify whether referral, safeguarding or clinical escalation may be needed.

OPERATIONAL PEER-SUPPORT INFORMATION

Our programme administration system may hold information such as:

  • request date;

  • allocation;

  • contact attempts;

  • preferred contact timing;

  • request status;

  • response times; and

  • closure information.

This information is held in monday.com.

We use it to manage the programme, ensure requests are followed up, monitor service delivery and maintain an anonymised programme record for the relevant client contract.

PEER-SUPPORT SUMMARY CASE NOTE

Following peer-support contact, a brief and proportionate summary case note is created.

This may contain:

  • relevant wellbeing or health information;

  • support provided;

  • any identified risk;

  • agreed actions; and

  • any referral or escalation.

It is not a verbatim transcript of the conversation.

The summary case note is stored in WriteUpp for clinical governance, supervision, continuity, risk management and appropriate oversight.

Access to the stored WriteUpp record is restricted to the MindYourself Clinical Lead.

SAFETY, SAFEGUARDING OR ESCALATION INFORMATION

We may hold limited factual information where there is:

  • a serious safety concern;

  • a safeguarding issue;

  • a complaint; or

  • a referral to professional support.

We use this information to protect individuals, manage risk, meet legal or professional responsibilities and document necessary action.

COMMUNICATIONS AND ENQUIRIES

If you contact MindYourself about our services, we may collect:

  • your name;

  • organisation and job role where relevant;

  • email address;

  • telephone number;

  • the nature of your enquiry; and

  • information you choose to include in website forms, emails or other correspondence.

We use this information to respond to enquiries, provide information about our services, manage prospective and existing client relationships, deal with feedback or complaints and maintain appropriate business records.

  1. CONFIDENTIALITY OF PEER SUPPORT

Confidentiality is a core part of the MindYourself programme.

Information you disclose during peer support is not routinely shared with your employer, manager or HR team.

A trained peer supporter may discuss and collect information relevant to your health, wellbeing, personal circumstances or work situation where this is appropriate to understanding your circumstances and providing safe and effective peer support.

This information may constitute special category personal data under UK data protection law.

Following peer-support contact, a brief and proportionate summary case note is created for clinical governance.

This may include relevant wellbeing or health information, the support provided, any identified risk, agreed actions and any referral or escalation.

It is not intended to be a verbatim transcript or a detailed narrative of the conversation.

The summary case note is stored in WriteUpp, and access to the stored record is restricted to the MindYourself Clinical Lead.

Client organisations, managers and HR teams do not have access to these case notes.

WHEN CONFIDENTIALITY MAY BE LIMITED

There are limited circumstances where information may need to be shared.

These may include where:

  • you ask us to share information or agree to a referral;

  • there is a serious and immediate concern about your safety or another person’s safety;

  • there is a safeguarding concern that requires action;

  • we are required to disclose information by law, court order or a lawful regulatory requirement; or

  • sharing is necessary to establish, exercise or defend legal claims.

Where it is safe and lawful to do so, we will aim to tell you before sharing identifiable information in these circumstances and will share no more than is reasonably necessary.

  1. WHAT YOUR EMPLOYER OR CLIENT ORGANISATION RECEIVES

Client organisations may receive programme-level reporting so they can understand whether the service is being used, whether it is responsive and whether there are broad themes that may help them improve organisational wellbeing or safety.

This may include:

  • overall numbers of peer-support requests;

  • response times and service activity;

  • broad categories such as work-related, personal or other;

  • high-level, anonymised themes or trends; and

  • programme engagement and peer-supporter activity at an aggregate level.

We do not provide routine client reports containing:

  • the names of people who have requested support;

  • the content of individual peer-support conversations; or

  • access to WriteUpp case notes.

Where numbers are small, we may combine categories, broaden reporting periods or suppress data to reduce the risk of identifying an individual.

  1. OUR LAWFUL BASES FOR USING PERSONAL INFORMATION

UK data protection law requires us to have a lawful basis for using personal information.

Where information is special category data, such as health information discussed during peer support, we must also identify an additional condition under Article 9 UK GDPR and, where relevant, the Data Protection Act 2018.

The basis depends on the purpose and circumstances of the processing.

OPERATING AND SECURING THE APP, WEBSITE AND PROGRAMME

Our lawful basis is our legitimate interests in providing, securing and improving our services, and contract where processing is necessary to provide a service directly to you.

Special category information is not normally involved in this activity.

RECEIVING AND ADMINISTERING A PEER-SUPPORT REQUEST

Our lawful basis is our legitimate interests in providing and safely administering the peer-support service and fulfilling our programme arrangements.

The initial request form does not ask for health information or a description of the issue, so a special category condition will not normally be required at this stage.

PROVIDING PEER SUPPORT AND MAINTAINING THE SUMMARY CASE NOTE

Our lawful basis is our legitimate interests in providing a confidential peer-support service, maintaining appropriate clinical governance and managing safety and quality.

Where health or wellbeing information constitutes special category data, we may rely on Article 9(2)(h) of UK GDPR relating to health or social care, together with the relevant condition in Schedule 1 of the Data Protection Act 2018, where the processing is necessary for the service and is carried out under the responsibility of the Clinical Lead and appropriate duties of confidentiality.

In exceptional circumstances another applicable Article 9 condition may apply, for example vital interests or legal claims.

RESPONDING TO A SERIOUS SAFETY EMERGENCY

We may rely on vital interests where processing is necessary to protect someone’s life, and/or legal obligation where applicable.

For special category information, vital interests may apply where the individual is physically or legally incapable of giving consent. Another Article 9 condition may apply depending on the circumstances.

SAFEGUARDING, LEGAL OR REGULATORY MATTERS

We may rely on legal obligation and/or legitimate interests depending on the circumstances.

Where special category information is involved, a condition permitted by data protection law may apply, such as substantial public interest, legal claims or another applicable condition.

SERVICE EVALUATION AND CLIENT REPORTING

We rely on our legitimate interests in evaluating, governing and improving the programme and meeting client reporting requirements.

We use anonymised or aggregated information wherever reasonably possible.

Where information has been effectively anonymised, it is no longer personal data.

Identifiable special category information is not included in routine client reporting.

RESPONDING TO WEBSITE AND BUSINESS ENQUIRIES

We rely on our legitimate interests in responding to enquiries and developing and managing our services, or taking steps at your request before entering into a contract where applicable.

MARKETING AND OPTIONAL COMMUNICATIONS

We rely on consent where required, or legitimate interests where the law permits.

Where consent is used for a particular disclosure or referral, it may be withdrawn for future processing.

However, MindYourself does not rely on consent for every part of the programme and may need to retain or use limited information where another lawful basis applies, for example clinical governance, legal obligations, safeguarding, vital interests or legal claims.

  1. PROFESSIONAL OR CLINICAL SUPPORT

If you ask MindYourself to arrange additional professional or clinical support beyond peer support, we will explain what information needs to be shared for that referral.

We will normally share only the information needed to make the connection and, where appropriate, will ask for your agreement before doing so.

A psychologist, therapist, healthcare professional or external clinical provider may be a separate data controller for the clinical service they provide.

If so, they are responsible for their own clinical records and will provide their own privacy information.

Those records are separate from the peer-support summary case note retained by MindYourself in WriteUpp for programme clinical governance.

  1. WHERE INFORMATION COMES FROM

Most information is collected directly from you.

We may also receive limited information from:

  • the client organisation that makes the programme available, where needed to establish access or eligibility;

  • a peer supporter recording a brief summary case note following peer-support contact;

  • a MindYourself administrator recording the operational information needed to manage a request;

  • a clinician or other professional where you have asked for coordinated support or where a lawful safeguarding or safety reason applies; and

  • our technology providers through ordinary security, diagnostic and usage logs.

  1. WHO WE MAY SHARE INFORMATION WITH

We restrict access to personal information to people and organisations that need it for a defined purpose.

Depending on the service, this may include:

  • authorised MindYourself administrators;

  • the trained peer supporter allocated to your request;

  • the MindYourself Clinical Lead, for access to peer-support summary case notes, clinical governance, supervision, risk management and appropriate escalation;

  • a clinician or professional support provider where you have requested or agreed to a referral, or where a lawful safety or safeguarding basis applies;

  • technology suppliers that host or support our systems, including our form/work-management platform, clinical record system, app platform, website hosting, email or IT-security providers; and

  • professional advisers, insurers, auditors, regulators, law-enforcement bodies, courts or other authorities where disclosure is reasonably necessary, required or permitted by law.

Our current core systems include:

  • monday.com for peer-support request administration and programme management;

  • WriteUpp for restricted peer-support summary case notes and clinical governance;

  • Adalo for the MindYourself web app; and

  • Squarespace for hosting the MindYourself website and website pages through which some forms and service information are provided.

These providers process information in accordance with their role in delivering the relevant service and our contractual arrangements with them.

  1. INTERNATIONAL DATA TRANSFERS

Some technology providers or their sub-processors may process personal information outside the United Kingdom.

Where personal information is transferred internationally, we require an appropriate lawful transfer mechanism and safeguards in accordance with UK data protection law.

These may include:

  • UK adequacy regulations;

  • the UK Extension to the EU-US Data Privacy Framework where applicable; or

  • approved contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses.

We keep our supplier and international-transfer arrangements under review as systems and sub-processors change.

  1. HOW LONG WE KEEP INFORMATION

We keep identifiable information only for as long as it is needed for the purpose for which it was collected.

We distinguish between the operational request record held in monday.com, the anonymised programme record used for the client contract, and the separate peer-support summary case note held in WriteUpp.

IDENTIFIABLE PEER-SUPPORT REQUEST DETAILS IN MONDAY.COM

These are kept only for as long as the individual reasonably needs to be identified to administer and complete the request.

Once identification is no longer operationally required, name, contact details and other identifying information are removed from the monday.com record.

ANONYMISED MONDAY.COM PROGRAMME RECORD

After identifying information is removed, the anonymised programme record may be retained for the duration of the relevant client contract.

This allows MindYourself to monitor activity, response times, service performance and broad trends.

At contract close it is deleted in accordance with contract close-out arrangements or retained only as fully anonymised aggregate statistics where appropriate.

PEER-SUPPORT SUMMARY CASE NOTES IN WRITEUPP

A brief summary case note is retained separately in WriteUpp under the MindYourself clinical-records retention schedule.

The retention period is determined by clinical governance, professional, safeguarding, insurance and legal requirements and is reviewed separately from the monday.com administration record.

SAFETY, SAFEGUARDING, COMPLAINT OR LEGAL RECORDS

These are kept for as long as reasonably necessary having regard to the nature of the issue, applicable legal or professional requirements, insurance requirements and limitation periods.

RECORDS HELD BY AN EXTERNAL CLINICAL PROVIDER

These are held under the retention rules of the relevant clinical provider where that provider is a separate controller.

These records are separate from MindYourself peer-support administration records and WriteUpp summary case notes.

APP ACCOUNT OR ACCESS DATA

Where an individual account exists, this information is normally retained for as long as the account is active and for a short period afterwards where needed for security, recovery or deletion processes, unless a longer period is required by law.

SECURITY AND TECHNICAL LOGS

These are retained for the period reasonably necessary for security, diagnostics and incident investigation, subject to the settings and retention cycles of our technology providers.

FULLY ANONYMISED PROGRAMME STATISTICS

These may be retained for longer where they no longer identify, and cannot reasonably be used to identify, an individual.

WEBSITE AND BUSINESS ENQUIRIES

These are normally retained for up to 24 months after the last meaningful contact, unless the information forms part of an ongoing contract, complaint or legal matter.

ANONYMISATION

Where an operational record is anonymised, identifying fields and any link that would enable MindYourself to reconnect the record to the individual are removed.

If a record can still be linked back to a person using a separate key or other information, we treat it as pseudonymised personal data rather than anonymous data.

Deletion from active systems may not immediately remove information from encrypted backups, which expire through the relevant provider’s backup and deletion cycle.

  1. HOW WE PROTECT INFORMATION

We use technical and organisational measures intended to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

These measures include:

  • access controls;

  • restricted administrator permissions;

  • multi-factor authentication where supported;

  • secure cloud services;

  • confidentiality requirements for staff and peer supporters;

  • data minimisation;

  • separation of administration and clinical records;

  • restricted access to WriteUpp case notes by the Clinical Lead; and

  • procedures for responding to information-security incidents.

No internet or cloud service can be guaranteed to be completely secure.

We therefore review our systems and suppliers and aim to limit the amount of identifiable information held in the first place.

  1. WEBSITE, EMBEDDED FORMS, COOKIES AND ANALYTICS

Our public website is hosted using Squarespace.

When you visit the website, Squarespace and the technologies used to operate the site may process technical information such as:

  • your IP address;

  • browser or device information;

  • security and diagnostic information;

  • pages viewed;

  • interactions with the site;

  • referral source; and

  • the date and time of your visit.

This information is used to operate, secure, maintain and, where applicable, understand use of the website.

EMBEDDED PEER-SUPPORT FORMS

Some peer-support request forms are provided by monday.com and are embedded within pages on the MindYourself website.

The website provides the page through which the form is accessed, while the information you submit through the peer-support request form is processed through our monday.com programme administration system as described elsewhere in this notice.

When embedded content is loaded, the relevant technology provider may also receive limited technical information needed to deliver and secure that functionality.

WEBSITE AND SERVICE ENQUIRIES

If you contact MindYourself through a website enquiry form, by email or through another online channel to ask about our services, we may collect:

  • your name;

  • contact details;

  • organisation and job role where relevant;

  • the nature of your enquiry; and

  • any information you choose to include.

We use this information to respond to you, provide information about our services, manage prospective and existing client relationships and maintain appropriate business records.

Our lawful basis for handling ordinary website and business enquiries will normally be our legitimate interests in responding to enquiries and managing and developing our services, or taking steps at your request before entering into a contract where applicable.

We normally retain website and business enquiry information for up to 24 months after the last meaningful contact, unless it becomes part of an ongoing contract, complaint, legal matter or other record that needs to be kept for longer.

COOKIES AND ANALYTICS

Our website and app may use essential cookies or similar technologies needed for security, login, navigation and service functionality.

We may also use analytics or other non-essential technologies to understand how our website and services are used.

Where consent is required for non-essential cookies or similar technologies, they will be used in accordance with your cookie preferences.

More information about the cookies and similar technologies used on our website is provided through our Cookie Notice and cookie-preference controls.

  1. YOUR DATA PROTECTION RIGHTS

Depending on the circumstances, you may have the right to:

  • ask for a copy of personal information we hold about you;

  • ask us to correct inaccurate or incomplete information;

  • ask us to delete information in certain circumstances;

  • ask us to restrict how information is used in certain circumstances;

  • object to processing based on legitimate interests;

  • receive certain information in a portable format where the right applies; and

  • withdraw consent at any time where we rely on consent.

These rights are not absolute and the right that applies can depend on the lawful basis and the circumstances.

To exercise a right, contact us at:

contactus@mindyourselfapp.com

We may need to take reasonable steps to confirm your identity before responding.

  1. AUTOMATED DECISION-MAKING AND SALE OF DATA

We do not sell personal information.

We do not use personal information to make solely automated decisions about you that produce legal effects or similarly significant effects.

  1. PEOPLE UNDER 18

The standard MindYourself workplace peer-support service is intended for adults aged 18 or over unless a specific programme has been expressly designed and agreed for younger users with appropriate safeguards and privacy information.

If we become aware that information about a child has been collected in error, we will take appropriate steps to protect and, where appropriate, delete it.

  1. QUESTIONS, CONCERNS AND COMPLAINTS

If you have a question or concern about how we use your information, or you want to make a data-protection complaint, please contact us first so that we can investigate and respond.

Email:

contactus@mindyourselfapp.com

Post:

MindYourself App Ltd
Unit 18T8
Brooke’s Mill
Armitage Bridge
Huddersfield
West Yorkshire
HD4 7NR

You also have the right to raise a concern with the UK Information Commissioner’s Office (ICO).

Information about making a complaint is available at ico.org.uk.

ICO helpline: 0303 123 1113

  1. CHANGES TO THIS NOTICE

We review this notice periodically and whenever there is a material change to the way we use personal information.

The current version will be published on our website and/or made available through the MindYourself service.

Where a change significantly affects how we use existing personal information, we will take reasonable steps to bring it to your attention before the new use begins.