Effective date for users who register from 07 March 2022: 07 March 2022
Effective date for users who registered before 07 March 2022: 07 April 2022
Previous versions can be obtained from the Data Protection Officer.
We are committed to protecting your privacy and confidentiality.
These are the Privacy Notices that cover the supply of Cognitive Behavioural Therapy services provided online (the Service) through https://my.iesohealth.uk (the Site) and our research and product development activities. The Site and the Service are provided by Ieso Digital Health (UK) Ltd. In this Privacy Notice, the terms ieso, we, us, or our refer to Ieso Digital Health (UK) Ltd and our group of companies (that also includes Ieso Digital Health Ltd and Ieso Digital Health, Inc.). Ieso Digital Health (UK) Ltd and Ieso Digital Health Ltd are data controllers of UK personal data and are registered with the Information Commissioner (registration numbers ZA239229 andZ5383093). If you don’t understand or require further information on anything below, please contact our Data Protection Officer h.simpson@iesohealth.com. Full details on how to contact us can be found in section 9 below.
By agreeing to the terms and conditions of the Service you have entered into a contract with us which forms the legal basis for most of the processing of your personal information, including for research compatible with the original purposes of processing. Safeguarding and NHS minimum data set information is processed under legal obligation; standard information sharing with GPs is by consent; any information held in establishment or defence of a legal claim or complaint is processed in our legitimate interests; and processing to uphold NHS opt outs is to carry out a public task. We process your special category data for medical purposes. As part of our contract with you, we are committed to continued improvement and development. Research supports us to provide you and all our patients with high-quality evidence-based care and products, and to help more people get treatment earlier. We publish findings (which only ever include aggregated data) in peer reviewed scientific journals, satisfying the legal basis of the special category data processing being necessary for scientific research purposes, which we use for a subset of our research activities.
Here we explain what personal information we collect, how it is used, shared, secured, stored, and how you can exercise choices and manage your data. These Privacy Notices reflect legal requirements, regulations, and best practice.
We understand that the privacy and confidentiality of all the personal information, especially the verbatim records of therapy sessions, that you provide and we handle, is important to you, and our internal policies and procedures reflect this and the need to share the minimum information necessary.
These Privacy Notices describe our treatment of personal and clinical information that we collect when you access or use our Service.
We describe here how we handle your personal and clinical information for the purposes of providing and improving the Service and for scientific research.
We will not sell your personal information for direct marketing or other promotional purposes.
These Privacy Notices apply to any Site where they are referenced, regardless of the computer, mobile or other device you use to access or use the Service. The site and Service includes links to websites that are owned and operated by third parties. We are not responsible for the privacy policies or content of such websites.
We reserve the right to change these Privacy Notices from time to time by changing them on the Site and by notifying you through your account or by email. Amended terms will take effect 30 days after they are published.
We collect the following personal information about you in several ways:
We collect the following personal information about you in several ways:
You always have the option to refuse to submit personally identifiable information to us but note that without this information, the Services may be unavailable to you.
We add to the information we collect from you with information we receive from other sources. This includes:
See here or read below for further information on cookies
Certain information is collected automatically from your computer or device about your engagement with the Service. This includes:
We use the personal information we collect to ensure that we provide you with the best possible treatments both now and in the future. We have appointed a Data Protection Officer and Caldicott Guardian to seek to ensure that our procedures for handling patient information meet with our obligations. We use the personal and clinical information that we receive under our terms with you to:
These measures include:
(We may anonymise patient data to use for new product development of products intended to help more people get treatment earlier. Although this is not then personal data, you may be interested in reading about an example of this research here.)
Much of our research is based on the NHS Minimum data set (see section 3below), but we also use machine learning, natural language processing (NLP) and artificial intelligence (AI) on questionnaires, communications between you and your therapist, and on therapist summaries of the sessions. Click here for more information about this.
- Determine whether or not a patient is eligible and suitable for participation in one of our clinical trials/ studies. We are data-driven research orientated company who passionately believe in responsible innovation to increase the understanding of mental health, improve treatments and widen access to treatment, and our clinical team may review your data to identify participants.
We only ever share the minimum information necessary to provide the best treatments, care and protection for yourself or others, or to satisfy legal requirements. For example, depending on your referring healthcare provider, your data may be provided to update their records and/or as part of the Minimum Data Set required nationally by NHS England for all its patients. We have specific processes in place regarding verbatim records of sessions which are only shared internally or externally in very limited circumstances, for example we may facilitate joint viewing of/ listening to specific verbatim records of sessions with the contracting NHS service in the case of a serious upheld complaint, see section 3 'When we share your information'. We will always seek your permission before disclosing your personal identifiable information to another person or organisation for any other reason than those set out in these privacy notices, unless we have an overriding legal duty to so do (for example, in the prevention and/or detection of a crime).
We use the personal information we collect to ensure that we provide you with the best possible treatments both now and in the future. We have appointed a Data Protection Officer and Caldicott Guardian to seek to ensure that our procedures for handling patient information meet with our obligations. We use the personal and clinical information that we receive under our terms with you to:
These measures include:
(We may anonymise patient data to use for new product development of products intended to help more people get treatment earlier. Although this is not then personal data, you may be interested in reading about an example of this research here.)
Much of our research is based on the NHS Minimum data set (see section 3below), but we also use machine learning, natural language processing (NLP) and artificial intelligence (AI) on questionnaires, communications between you and your therapist, and on therapist summaries of the sessions. Click here for more information about this.
- Determine whether or not a patient is eligible and suitable for participation in one of our clinical trials/ studies. We are data-driven research orientated company who passionately believe in responsible innovation to increase the understanding of mental health, improve treatments and widen access to treatment, and our clinical team may review your data to identify participants.
We only ever share the minimum information necessary to provide the best treatments, care and protection for yourself or others, or to satisfy legal requirements. For example, depending on your referring healthcare provider, your data may be provided to update their records and/or as part of the Minimum Data Set required nationally by NHS England for all its patients. We have specific processes in place regarding verbatim records of sessions which are only shared internally or externally in very limited circumstances, for example we may facilitate joint viewing of/ listening to specific verbatim records of sessions with the contracting NHS service in the case of a serious upheld complaint, see section 3 'When we share your information'. We will always seek your permission before disclosing your personal identifiable information to another person or organisation for any other reason than those set out in these privacy notices, unless we have an overriding legal duty to so do (for example, in the prevention and/or detection of a crime).
We place great importance on the security of personal identifiable information associated with our patients. We have put controls in place to safeguard the personal information that you provide, applying physical, technical and procedural measures against the loss, misuse and alteration of personal information under our control.
All information submitted by you is encrypted in transit using best-practice Transport Layer Security (TLS) with at least 128-bit encryption. All clinical data is encrypted using the industry-standard AES-256 cipher and stored in Microsoft Azure, on secure servers in the UK, managed by ieso.
We have achieved the International Standard certification for information security (ISO 27001), Cyber Essentials Plus certification, and satisfy the requirements of the NHS Data Security and Protection Toolkit requirements.
Remember also that you are responsible for keeping your password secret at all times when accessing and using the Service.
ieso’s headquarters are in the United Kingdom (UK),and information about you submitted via the Services is used by us and hosted by our service provider, Microsoft Azure, on secure servers in the UK, managed by ieso. As detailed in the Security section of these Privacy Notices, such information is stored in an encrypted state, both in transit and at rest, meaning the provider cannot lawfully access identifiable information.
We use a small number of well-known SaaS (Software as a Service)providers to store subsets of your information and enable the uses of information described in these notices. We have Data Processor Agreements in place with each. Where possible these providers store the data in the UK or EEA. Where they are located outside the UK / EEA we ensure they are either party to an adequacy decision or have in place one of the additional safeguards necessary to make the transfer such as Binding Corporate Rules or Standard Contractual Clauses (with additional technological and organisational controls as necessary or appropriate) to uphold your legal data protection rights.
We retain your information and health record as a resource that you can return to for 20 years post discharge. This can help you remember coping strategies, techniques or processes that you learnt in therapy. If you were to experience a setback between sessions or after you’ve completed treatment, you may find it useful to refer to the transcripts/ audio recordings of your therapy sessions and messages. We retain your clinical record by reference to the NHSX Records Management Code of Practice https://www.nhsx.nhs.uk/media/documents/NHSX_Records_Management_CoP_V7.pdf and to support our legal obligations to be accountable for your care.
The Code is based on current legal requirements and professional best practice.Research records and data are kept for a minimum of 20 years in accordance with Medical Research Council guidance.
Our data retention practices are reviewed at least annually in conjunction with industry standards and best practice.
You can access specific details relating to your treatment through the Service online at anytime directly through your account, these will therefore remain resources available to you after the conclusion of your treatment. These include messaging between you and your therapist between sessions, the sessions themselves, the ‘homework’ activities, questionnaires completed, and any goal setting activities. The sessions comprise a verbatim record of conversation between you and your therapist that are retained in the form of a transcript for text therapy or an audio file for video therapy. You can also update or amend some key registration and contact details directly through your account.
If you feel there is an error of fact on your health record held by us, you can contact us, or in respect of your wider medical record your referring healthcare service or GP. If we or they agree the information is incorrect, the alteration will be made. If we or they are not satisfied the information is factually incorrect, a note will be made of the information you consider is inaccurate, and you will be notified of either the correction or the note.
Data protection law also includes the right to data portability and to make other requests to seek to erase, object to and restrict personal data processing where certain limited grounds apply. Note however that data processed for health/treatment and legal purposes, or where other legitimate grounds for the processing apply, are examples of circumstances where some of these rights can be restricted or not apply in practice. Specifically, the right to erasure does not apply when processing is necessary for the provision of healthcare or the management of healthcare systems or service.
If you need assistance or have an enquiry about accessing, updating or amending your records, or where applicable, about receiving or transmitting a file of the data you have provided (for example to your GP) please write to:
The Data Protection Officer, ieso,Jeffreys Building, Cowley Road, Cambridge, CB4 0DS
Or by email, For the Attention of the Data Protection Officer (DPO), to info@iesohealth.com.
Our complaints procedure is available on the site, and there is a link to it here.If you remain unhappy with a response you receive, you can also refer the matter to the Information Commissioner's Office
We use cookies or similar technologies such as device IDs, pixel tags and web beacons (collectively described here as 'cookies') to collect information about the access to and use of the ieso site and Service. These typically include a unique reference code that relates to, or is accessed from, a user's device and that enables that device to be remembered when next visiting the site or using the Service and that sometimes track information about a user.We use cookies for the following reasons:
Computers and mobile devices may automatically accept cookies, but you can change your browser to prevent that or to notify you each time a cookie is set. You can also learn more about cookies by visiting www.allaboutcookies.org which includes additional useful information on cookies and how to block cookies using different types of browser. Please note however, that by blocking or deleting cookies you may not be able to take full advantage of the site or Service.
You can also learn more about our use of cookies by visiting our cookies policy.
Our contract with your healthcare provider determines the lower age limit for our services. As standard it is 18, but specific contracts also include 16 and 17 year olds.
If you have any questions or comments about these notices, please let us know:
By email: info@iesohealth.com (or for technical support questions contact our technical support team: support@iesohealth.com)
By telephone: on 0800 074 5560
Or by post to:ieso, Jeffreys Building, Cowley Road, Cambridge, CB4 0DS
To reach our data protection officer please use the above details and mark your communication for the attention of: Helen SimpsonIn an emergency please contact:
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.
Our service is free for lots of NHS patients.
It only takes a minute or two to check if you are eligible for treatment.