Privacy Policy

Effective date: November 2026

1. Introduction

Spectrum.Life (“Spectrum.Life”, “we”, “us” or “our”) respects your privacy and the confidentiality of your personal data. This Privacy Notice explains how we collect, use, store, share and protect your personal data when you use any of our services, visit our websites or mobile applications, or interact with us.

We have written this Notice in plain language while keeping it legally robust. It is designed to cover all the services we provide in the United Kingdom and Ireland, across all audiences we serve – including users of services provided via an employer, educational institution or insurer, website visitors, customers, and business contacts.

This Notice reflects our obligations under the EU General Data Protection Regulation (GDPR), the UK GDPR, the Data Protection Act 2018, the ePrivacy Regulations, the EU Digital Services Act, the EU NIS2 Directive, the EU Artificial Intelligence Act, and other applicable laws.

This is our full privacy notice. We also give you shorter privacy information at the points where it matters most – for example, when you register, when you start a clinical service, or where a service has its own arrangements. Section 24 explains how these fit together.

2. Who We Are

Spectrum Wellness Limited (trading as Spectrum.Life) and Spectrum Wellness UK Limited are the entities responsible for processing your personal data, depending on where you are based.

• Ireland: The Data Controller is Spectrum Wellness Limited (Company Registration No. 555787), registered office at 38-39 Fitzwilliam Square W, Dublin 2, D02 NX53, Ireland.
• United Kingdom: The Data Controller is Spectrum Wellness UK Limited (Company Registration No. 11815511), registered office at Habib House, 9 Stevenson Square, Manchester, M1 1DB, United Kingdom.

We determine the purposes and means of processing your personal data (acting as “controller”) for most of the services we provide directly to you. In some cases – for example, where we deliver services on behalf of a client organisation such as an employer, college or insurer – we may act as a “processor”, processing your personal data strictly under the client organisation’s instructions. Where this applies, the client organisation is the controller and their own privacy notice governs the processing, alongside this one.

Where we deliver clinical services through an independent clinical partner – for example, where an affiliate clinician or specialist provider delivers physiotherapy, counselling or other referral services – that partner typically acts as a data processor, processing your personal data on our instructions and under our contractual controls. In limited cases, where a partner operates entirely within their own systems and under their own clinical governance (for example, a diagnostic testing provider), they may act as an independent data controller for the services they deliver directly to you. Where this applies, we will make the arrangement clear to you at the point of referral. 

Who is responsible for your information in each service

The table below shows who is responsible (the “controller”) for your personal data in each type of service.

Privacy and Security Team

We have appointed a Privacy and Security Team who are responsible for overseeing compliance with this notice and with data protection law. You can contact the Privacy and Security Team for any privacy-related query or to exercise your rights. If required the Privacy and Security Team can escalate queries to the DPO. 

• Email: gdprspectrumlife@spectrum.life
• Post: Privacy and Security Team, Spectrum Wellness Limited, 38-39 Fitzwilliam Square W, Dublin 2, D02 NX53, Ireland.

Supervisory Authorities

• Ireland: You have the right to lodge a complaint with the Data Protection Commission (DPC) – www.dataprotection.ie.
• United Kingdom: You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) – www.ico.org.uk.

We would appreciate the opportunity to address any concerns directly before you contact a regulator, but you can contact a supervisory authority at any time.

3. Services Covered by This Notice

This Notice applies to all Spectrum.Life services delivered in the United Kingdom and Ireland, including but not limited to:

• Employee Assistance Programme (EAP): 24/7 workplace wellbeing and short-term counselling services for employees of our client organisations.
• Student Assistance Programme (SAP): Counselling and wellbeing support for students of partner educational institutions.
• Coaching: Wellbeing, life, executive and health coaching programmes.
• Clinical Services: Clinical counselling, psychotherapy, digital psychologist support and related health services delivered by qualified professionals.
• Virtual Primary Care (Digital GP / Virtual GP and Advanced Nurse Practitioner services): Remote GP and ANP consultations, including prescription and onward referral. “Digital GP” and “Virtual Primary Care” (VPC) refer to the same underlying service.
• Digital Mental Health (DMH) and iCBT: Self-guided digital programmes, including internet-based Cognitive Behavioural Therapy.
• Neurodiversity Assessments: Online neurodiversity screening and clinical assessment services.
• Online Physiotherapy: Remote physiotherapy consultations and programmes delivered by qualified practitioners.
• Funded Referral Programmes: Services arranged and paid for by an insurer, claims handler or employer for a specific purpose, such as return-to-work support or treatment linked to an insurance claim (see Section 13).
• Adult and Elder Care Signposting: Information and signposting to support caring responsibilities (non-clinical).
• Legal Information Support: General legal information services (non-advisory).
• Financial Wellbeing Support: Financial wellbeing information, guidance, and referral to regulated financial or retirement planning partners.
• Structured Counselling and Professional Referrals: Onward referral to vetted independent clinicians or specialist services.
• Workshops and Training: Wellness workshops, webinars and educational sessions.
• Wellbeing Content: Articles, videos, podcasts and related content on our platforms.
• Spectrum.Life Mobile App: Our mobile application providing access to the services listed above.
• Spectrum.Life Web Platform: Our websites and web portals providing access to the services listed above.
• Transcription (Heidi AI): Optional AI-assisted clinical documentation for certain sessions, as described in Section 9.
• Accessibility Support: Live captions during video sessions where you ask for them (see Section 9).
• Future Services: Any new services we introduce are covered by this Notice unless we tell you otherwise.

Where a specific service has additional privacy considerations (for example, EAP confidentiality towards your employer, or duty-of-care arrangements in SAP), we have called these out in Section 12.

4. Personal Data We Collect

We only collect the personal data we need to provide our services and to meet our legal, regulatory and contractual obligations. The types of personal data we may process are summarised below.

• Identity Data: Name, date of birth, gender, and the organisation you are associated with (for example, your employer, college or insurer).
• Contact Data: Email address, phone number and postal address.
• Account Security and Sign-in Data: The mobile number we use to send you sign-in verification codes, records of sign-in and verification events (date and time, IP address and device type), and whether you have chosen to trust a device.
• Health and Wellbeing Data: Information relating to your health, wellbeing or mental health that you share with us during clinical, coaching or support interactions. This includes medical history, symptoms, assessment scores, clinician notes and prescription information (special category data under GDPR / UK GDPR).
• Outcome Measures: Your answers to standardised questionnaires (for example, wellbeing, mood, or work and functioning measures) and the resulting scores. We use these to plan your care and track your progress, and in de-identified form to evaluate our services.
• Referral Data: Information an organisation gives us when it arranges your access or refers you – for example, your name, contact details and an employee, member, policy or claim reference. For a funded referral, this may also include the reason for the referral and limited health or work information needed to arrange your care.
• Accessibility Preferences: Adjustments you ask us to make, such as live captions during video sessions. These may reveal information about your health, so we treat them with the same care as health data.
• Technical Data: IP address, device type, operating system, browser, unique device identifiers and usage logs collected automatically when you use our apps or websites.
• Usage Data: Information about how you interact with our services – pages or features used, content viewed, clicks, sessions, crash reports, engagement statistics.
• Transaction and Billing Data: Invoice references, payment confirmations and limited financial information where you pay us directly for a service. Card data is handled by our PCI-DSS accredited payment processor and is not stored by us.
• Communication Data: The content of messages you send to us or through our services – including emails, chat messages, SMS, support tickets, forum or community posts and survey or feedback responses.
• Audio and Transcript Data: We may record calls or voice sessions for quality, training and safeguarding purposes; where we do, recordings are retained for up to 12 months before secure deletion. Separately, where you and your clinician agree to use AI-assisted transcription, short-lived audio from that session is processed solely to generate a draft transcript. Only clinician-approved notes are saved to your record; the audio is deleted once transcription is complete, and the draft note is held by our transcription provider for no more than 3 days while it is transferred to your record. You may decline AI-assisted transcription at any time without affecting your access to the underlying service
• Profile Data: Username, avatar, goals, preferences and other information you add to your account.
• Cookies and Tracking Data: Information collected via cookies, pixels and similar technologies, as described in Section 11.
• Service-Specific Data: Some services require particular information – for example, prescription details for Virtual Primary Care, neurodiversity assessment responses, or workshop attendance. We will always tell you at the point of collection what information is needed.

Where you integrate a third-party app or device, we only receive and use the data you have authorised, and only for the purposes of the service you have chosen.

5. How We Collect Your Data

• Directly from you: When you register, complete a wellbeing assessment, attend a session, contact support, or otherwise interact with us.
• Through your use of our services: Technical and usage data are collected automatically through cookies, analytics and similar technologies.
• From the organisation that arranged or referred you: Your employer, educational institution, insurer, claims handler or the organisation running a scheme you belong to may give us your details so that you can access their service, or to refer you for a specific service. In this case the information comes from that organisation rather than from you. The types of information we may receive are described under Referral Data in Section 4.
• From healthcare providers or referral partners: For example, a GP, student support team or partner clinician may share relevant information with your consentas part of a referral you have agreed to to facilitate a referral or continuity of care.
• From integrated third-party apps or devices: Where you choose to connect a third-party service (for example, Apple Health or Google Fit), we receive the data you authorise.

6. How We Use Your Data

We use your personal data for the following purposes. Each purpose is underpinned by a lawful basis, as set out in Section 7.

• To deliver our services and manage your account: Registering you, authenticating you, scheduling and delivering sessions, providing clinical or coaching interventions, and giving you access to content.
• To keep your account secure: Verifying that it is you when you sign in, including by sending one-time codes to your mobile number, and monitoring sign-in activity to detect and prevent unauthorised access.
• To provide Virtual Primary Care and related clinical services: Taking a clinical history, conducting consultations, issuing prescriptions and making onward referrals, in line with professional clinical standards.
• To provide optional AI-assisted clinical documentation: Where you and your clinician agree, processing short-lived audio to create a draft transcript or summary that a clinician reviews before it is saved to your record (see Section 9).
• To provide live captions where you ask for them: Converting speech to on-screen text during a video session so that you can follow the conversation (see Section 9).
• To personalise your experience: Tailoring content and recommendations based on your preferences and interaction history.
• To communicate with you: Sending service-related messages (appointment reminders, Notice updates, security alerts) and – where you have opted in – newsletters and promotional communications.
• To maintain and improve our services: Analysing usage, debugging issues, developing features and improving performance and accessibility. Where feasible we use aggregated or pseudonymised data.
• To ensure security and compliance: Detecting and preventing fraud or misuse, securing our systems and infrastructure, and meeting obligations under data protection, cyber-security and clinical governance rules.
• To meet legal and contractual obligations: For example, retaining financial records for tax and audit, responding to lawful requests from authorities, or fulfilling a contract with your sponsoring organisation.
• To operate insurance-funded services and manage billing: Where your service is funded through a private medical insurer, confirming eligibility and processing invoices, and managing any shortfall billing as described in Section 12.
• To deliver funded referral programmes: Accepting referrals from an insurer, claims handler or employer, keeping the referrer updated on case status and attendance, and sharing an outcome report where you agree (see Section 13).
• To conduct research and analytics: Using aggregated or pseudonymised data to analyse outcomes and publish trends. We would only use data that could identify you for research with your explicit consent or under another appropriate legal basis.
• For marketing (with consent): Sending you information about our services that we think may interest you. See Section 17.

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider we need to use it for another compatible purpose and are permitted by law. If we need to use your data for an unrelated purpose, we will inform you and explain the legal basis first.

7. Legal Bases for Processing

Depending on the context, one or more of the following lawful bases under GDPR and UK GDPR will apply.

Purposes, legal bases and conditions

The table below links each main purpose to the legal basis we rely on under Article 6 and, where health or other special category data is involved, the condition we rely on under Article 9 of the GDPR and UK GDPR.

The legitimate interests we rely on

Where we rely on legitimate interests, those interests are: keeping our platform and your account secure; delivering and administering services that an organisation has arranged and funded for you, including telling a referrer whether you have taken up a funded service; improving our services using pseudonymous data; communicating with business contacts; recovering unpaid balances; and establishing or defending legal claims. We assess these interests against your rights before relying on them, and you can object at any time (see Section 21).

Agreeing to take part in a service is not the same as consent

When you start a clinical service, your clinician will ask whether you agree to take part. This agreement is part of good clinical practice and professional standards. It is not the legal basis we use to process your personal data, which is set out in the table above.

We only use consent under data protection law for specific optional activities, such as sharing an outcome report with a referrer, live captions, optional third-party integrations and marketing. You can withdraw consent at any time. Withdrawing it stops that activity from that point onwards but does not affect what happened before, and it does not affect your access to your care.

Summary of the legal bases we use

• Performance of a contract (Article 6(1)(b)): Where processing is necessary to deliver a service you have requested, or to carry out pre-contractual steps at your request.
• Consent (Article 6(1)(a)) and Explicit Consent (Article 9(2)(a)): Where you have given us clear, specific, informed and freely-given consent – for example, for marketing communications, optional integrations, sharing outcome reports with a referrer, live captions, and certain processing of special category data outside the healthcare context.
• Legitimate interests (Article 6(1)(f)): Where processing is necessary for our legitimate interests (or those of a third party) and not overridden by your rights – for example, to secure our platforms, to improve our services, or to communicate with business contacts. We balance our interests against your rights each time we rely on this basis.
• Legal obligation (Article 6(1)(c)): Where we need to process data to comply with a legal or regulatory obligation (for example, tax law, clinical record-keeping obligations, or safeguarding duties).
• Vital interests (Article 6(1)(d)): In rare, emergency situations where processing is needed to protect your life or the life of someone else.
• Provision of health or social care (Article 9(2)(h)): For the processing of health data by or under the responsibility of a health professional or someone subject to an equivalent duty of confidentiality – this is our primary basis for processing special category clinical data.
• Employment and social protection (Article 9(2)(b)): Where necessary for our client organisation to meet obligations or exercise rights in employment or social protection law (for example, certain EAP contexts).

We may rely on different bases concurrently for different aspects of the same processing. We ensure a valid basis applies to every activity.

8. Special Category Data (Health and Mental Health Information)

Many Spectrum.Life services involve health and mental health data. This is “special category” data under GDPR and UK GDPR and receives additional protection.

• Who accesses it: Only authorised clinicians, coaches, clinical supervisors and – on a strict need-to-know basis – named technical support staff. All staff are bound by confidentiality obligations, and clinicians are additionally bound by the standards of their professional regulator.
• What we do with it: We use health and mental health data to deliver the services you have requested, to ensure your safety, to meet our contractual and legal obligations, to report anonymised aggregate statistics to a sponsoring organisation and, for funded referral programmes, to share the limited information described in Section 13. We do not use your health or sensitive data for marketing or advertising.
• Transcription: Where AI-assisted transcription is used in a clinical session, processing is carried out by or under the responsibility of clinicians bound by confidentiality. You may decline transcription at any time without affecting access to the underlying service.
• Clinical partners: Where clinical services are delivered through an independent clinical partner, they remain bound to the same confidentiality and security standards, and we make the partner arrangement clear to you.

9. Artificial Intelligence in Our Services

Spectrum.Life uses artificial intelligence (AI) to support – not to replace – the people who deliver our services. This section explains how we use AI today, how we may use it in future, and the safeguards we apply. It reflects our obligations under the EU AI Act, GDPR / UK GDPR and relevant clinical governance standards.

Our guiding principles

• Human oversight first: Any output from an AI system that could materially affect you is reviewed by a suitably qualified human before it reaches your record, informs a clinical decision, or is acted upon.
• No solely-automated decisions with significant effects: In line with Article 22 of GDPR / UK GDPR, we do not make decisions that produce legal or similarly significant effects on you based solely on automated processing, including profiling.
• Purpose limitation: AI is only used for clearly defined purposes that support the delivery, safety and quality of our services.
• No training on your data without lawful basis: We do not permit third-party AI providers to use your personal or clinical data to train their own general-purpose models. Any model improvement that uses your data is carried out under appropriate contractual controls, with your rights preserved.
• Transparency: Where AI is used in a way that directly affects your experience, we tell you – at the point of use where practical.
• Data protection by design: We carry out Data Protection Impact Assessments (DPIAs) and, where required, AI-specific assessments before deploying AI systems that process personal data.

Current uses of AI

• Clinical documentation assistance (Heidi AI): Optional, consent-based transcription and note-drafting to support clinicians during or after a session. Audio is held on file for 3 days then deleted. Draft notes are reviewed, edited and approved by the clinician before being saved to your record.
• Content recommendations: Lightweight algorithms that surface wellbeing content we think may be relevant based on your stated preferences and engagement. These recommendations do not produce legal or similarly significant effects.
• Analytics and service improvement: AI and machine-learning techniques applied to aggregated or pseudonymised data to understand engagement, improve our platform and identify usability issues.
• Security and abuse prevention: Automated tools that help us detect fraud, spam, abusive content (on any community features) and security threats.
• Assistive chat / AI-supported self-help: Conversational tools that provide information and signposting, with clear disclosure that you are interacting with an AI and with fast, visible routes to a human where appropriate.
• Live captions for accessibility: If you ask for captions, we use the automated speech-to-text feature of the video service used for your session to show captions on screen as you talk. Captions are only switched on when you ask, are not added to your clinical record and are not used to make decisions about you. Automated captions can contain mistakes, so please tell your clinician if anything is unclear. We ask for your consent before switching captions on, and you can turn them off at any time.

Potential future uses of AI

As we develop our platform we may expand our use of AI to include, for example:

• Clinical triage support: AI-assisted triage to help route you to the most appropriate service or clinician. Any triage outcome that affects the service offered to you will be reviewed or confirmed by a qualified human.
• Summarisation: AI-generated summaries of clinical encounters, coaching sessions or long-form content, always reviewed by a human before being saved or shared.
• Personalisation: Richer personalisation of wellbeing content and programme recommendations, subject to your settings and consents.

Before we introduce any new AI use that could materially affect you, we will update this Notice, complete a DPIA and – where required by the AI Act – complete a Fundamental Rights Impact Assessment.

Classification under the EU AI Act

We classify every AI system we operate under the EU AI Act’s risk framework. We do not use, and will not use, AI systems that fall into the Act’s “prohibited practices” category. Where a system we operate is considered “high-risk” (for example, if it is used for clinical triage in a way the Act designates as high-risk), we will meet the corresponding obligations, including risk management, data governance, technical documentation, logging, human oversight and post-market monitoring. Where a system is limited-risk (for example, an AI chat interface), we will provide clear transparency to you.

Your rights around AI

• Right to a human review: You can ask for human review of any significant outcome that has been informed by an AI system, and you can contest that outcome.
• Right to object: You can object to processing based on legitimate interests, including any AI-driven personalisation; we will stop unless we have compelling legitimate grounds that override your rights, or we need to continue for the establishment, exercise or defence of legal claims. Objecting will not stop us keeping a clinical record we are required to hold or using information needed to establish or defend legal claims.
• Right to decline optional AI features: Optional AI features (such as transcription) are exactly that – optional. Declining will not reduce your access to the underlying service.

10. Automated Decision-Making

As set out in Section 9, Spectrum.Life does not make decisions that produce legal effects concerning you, or similarly significantly affect you, based solely on automated processing (including profiling). If we ever introduce such a decision-making process, we will update this Notice, tell you directly, obtain any required consent, and give you meaningful information about the logic, significance and expected consequences – together with clear rights to obtain human intervention, express your point of view, and contest the decision.

11. Cookies and Tracking Technologies

Our websites and apps use cookies, pixels, local storage and similar technologies. On your first visit we present a cookie banner that allows you to accept all, reject non-essential, or make a granular choice. You can change your choices at any time through the banner or your browser settings.

Categories of cookies we use

• Strictly necessary: Required for the platform to function – for example, authentication, session, load-balancing and security. These cannot be switched off.
• Functional: Remember preferences such as language or display settings.
• Analytics / performance: Help us understand how the platform is used so we can improve it. We use Google Analytics and Posthog  for this purpose. Analytics cookies are only set where you consent. When you are signed in to our platform, we also collect pseudonymous usage data for analytics without using cookies, based on our legitimate interests (see Section 7).
• Marketing / advertising: Set only with your explicit consent, to deliver or measure our own marketing (we do not sell your data to third parties for their own marketing).
• Third-party cookies: Embedded content (such as a third-party video player) may set its own cookies. Those are governed by the relevant third party’s privacy notice.

Blocking strictly necessary cookies will prevent parts of our services from working. Our apps do not currently respond to browser “Do Not Track” signals in a standardised way; we rely on your consent choices in the banner and your browser settings.

12. Who We Share Your Data With

Spectrum.Life does not sell your personal data. We do, however, need to share personal data with a limited set of trusted third parties so that we can run our operations and deliver services. We do so only in the ways described below.

Group companies

We may share personal data with other entities within the Spectrum.Life group where needed to deliver or support the services (for example, Spectrum Health for online physiotherapy). Section 2 explains who is responsible for your information in each service.

Sub-processors and service providers

We use trusted third-party providers to help us deliver our services. Each is contractually bound to process your data only on our documented instructions, to keep it confidential, to implement appropriate technical and organisational security measures, and not to use your data for their own purposes. Our current sub-processors and key third-party providers are set out in the table below. We maintain this list and will keep it updated.

A full, current list of our sub-processors is maintained internally and is available on request from our privacy and security team.

Independent clinicians, consultants and agents

We engage qualified clinicians, coaches, medical consultants and specialist contractors to deliver parts of our service. They are bound by strict confidentiality obligations and, in the case of healthcare professionals, the ethical rules of their professional regulator. IT and security consultants with incidental access to systems containing personal data are bound by equivalent contractual obligations and act only on our instructions.

Insurance partners (for insurance-funded services)

Where your service is funded by a private medical insurer, we may share limited information with that insurer for eligibility and billing purposes – for example, confirming the number of sessions you have used, a membership reference, or an invoice reference. We do not share clinical content, session notes or diagnostic information with insurers unless you have explicitly consented or we are legally required to do so. Further detail on employer, educational-institution and insurer information-sharing is set out in Section 13. Different arrangements apply to funded referral programmes, as described in Section 13.

Payment and billing partners

Payments for services you pay us for directly (including private appointments and any shortfall balance not covered by an insurer) are processed by a PCI-DSS-compliant payment processor acting as our processor. Where a shortfall balance remains unpaid after reasonable efforts, we may refer limited billing details (name, contact details, invoice reference) to a regulated debt-collection partner following an internal clinical and compliance review. Financial records are retained for seven years in line with tax and accounting requirements. You can object to processing for debt recovery at any time by contacting our Privacy and Security Team.

Business transfers

If Spectrum.Life undergoes a merger, acquisition, restructuring or asset sale, personal data may be transferred as part of the transaction. Your data will continue to be protected in line with this Notice or a superseding notice we will make available to you before any changes take effect.

Legal and regulatory disclosures

We may disclose personal data where required by law, to respond to lawful requests from authorities, to protect the rights, property or safety of Spectrum.Life or others, to investigate or defend against legal claims, or to prevent fraud. Where we can lawfully notify you of a request, we will.

We do not sell your data

We do not sell your personal data, and we do not allow our service providers to use it for their own marketing or unrelated purposes.

13. Sharing with Employers, Educational Institutions and Insurers

Many Spectrum.Life services are made available to you through your employer, college or insurer. We understand that confidentiality of your use of these services matters – especially in a workplace, educational or insurance context. This section explains exactly what is, and what is not, shared with those sponsoring organisations.

Employee Assistance Programme – confidentiality with your employer

If you access the EAP through your employer, the content of your counselling sessions, assessments and interactions is strictly confidential.

• Aggregate reporting: Your employer may receive periodic anonymised and aggregated reports on EAP usage across their workforce (for example, total uptake and broad categories of presenting issues). These reports do not identify individuals.
• Registration or eligibility confirmation: In some cases, and only where necessary, minimal information may be provided for programme administration (for example, confirming that a named employee has registered, to support billing). We will never share the content of your sessions or the issues you discussed with your employer.
• Emergency situations: In extremely rare cases involving a grave and immediate risk (for example, a credible threat of serious harm), we may need to involve emergency services or, where appropriate, designated safeguarding contacts. We limit any disclosure to what is strictly necessary.

Student Assistance Programme – working with your institution

For SAP, we operate within the institution’s duty of care to students. At the start of the service, you will be asked to agree to a defined scope of information-sharing with designated staff at your institution (for example, confirmation of engagement, or a support recommendation). We do not share session notes or sensitive clinical detail for academic or disciplinary purposes. In emergency situations – for example, where there is a serious immediate risk to you or others – we may contact an appropriate institutional safeguarding contact even where consent has not been given at that moment, limited to what is needed to address the emergency.

Insurance-funded services

Where your service is funded by a private medical insurer:

• Administrative information only: We typically share only the minimum information needed for eligibility verification and billing (for example, membership reference, number of sessions, invoice reference). The insurer does not receive clinical notes or diagnostic detail.
• Programme-level reporting: Insurers may receive aggregated, anonymised reports on usage and outcomes across their covered population.
• Claims and complaints: If your service is tied to an insurance claim, or if a complaint requires us to respond to your insurer, we limit disclosure to what is necessary and will normally redirect or seek your consent for anything beyond basic usage confirmation.
• Shortfall billing: Where your insurer does not cover the full cost of treatment, we may invoice you for the shortfall. We process limited personal and financial information for this purpose. Payment is handled by our PCI-DSS-compliant payment processor. See Section 12 for further detail.

Funded referral programmes (insurer, claims and return to work)

Some services are arranged and paid for by an organisation for a specific purpose – for example, an insurer funding treatment linked to a claim, or an employer arranging return-to-work support. Because the referrer needs to know that the service it has funded is being delivered, these programmes work differently from a confidential EAP. We will explain the arrangement when you are referred and before your first session.

• Always shared, to run the service: That we have received your referral and contacted you; whether you have booked, attended, cancelled or missed appointments and how many sessions have been used; whether your case is open, on hold or closed; and the name and reference needed to match this to your referral.
• Shared only with your agreement: An outcome or progress report, such as a summary of your progress, recommended next steps or return-to-work recommendations. We will explain what the report will contain before you decide. If you do not agree, we will not send it. Your care will continue, but the referrer may not have the information it needs for decisions it makes, such as on a claim or a return-to-work plan. You can withdraw your agreement for future reports at any time, but this cannot undo a report already sent.
• Never shared: Your session notes or full clinical record, the detail of what you discuss with your clinician, health information that is not relevant to the reason you were referred and any information for marketing purposes.

As with all our services, in an emergency involving a serious risk to you or others we may share information with emergency services or a designated safeguarding contact, limited to what is necessary.

14. International Data Transfers

Spectrum.Life primarily stores and processes personal data within the European Economic Area (EEA) and the United Kingdom. Some of our sub-processors are based outside the UK and EEA or use global infrastructure. These are listed in the table below. Where personal data is transferred outside the EEA or the UK to a country that is not considered to have an adequate level of data protection, we put one or more of the following safeguards in place:

Our other suppliers listed in Section 12 process personal data in the UK or EEA. If we add a supplier that processes personal data outside the UK or EEA, we will update this list. Where we rely on any of the safeguards below, they apply as follows:

• Standard Contractual Clauses (SCCs): The European Commission’s approved SCCs, together with the UK International Data Transfer Addendum where UK personal data is transferred.
• EU-US Data Privacy Framework (DPF) and UK Extension (“Data Bridge”): Where a US recipient is certified under the DPF, we may rely on the Framework and its UK Extension for UK personal data.
• Binding Corporate Rules (BCRs): Where a provider has approved BCRs, we may rely on those for intra-group transfers.
• Article 49 derogations: In narrow, specific cases – for example, with your explicit consent or where a transfer is necessary to perform a contract with you.

Post-Schrems II, we conduct transfer impact assessments for transfers to third countries and apply supplementary measures (for example, encryption in transit and at rest) where appropriate. You can request details of the safeguards in place for any specific transfer by contacting the Privacy and Security Team. 

15. Your Choices and Control

• Providing data: You can decide not to provide certain personal data, but some services cannot be delivered without specific information.
• Communication preferences: Manage marketing and notification preferences in your account settings or via the unsubscribe link in any marketing message.
• Integrations: Connect or disconnect third-party apps and devices at any time in your settings.
• Privacy settings: Adjust any in-app privacy settings (such as profile visibility in community features).
• Withdrawal of consent: Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of past processing.
• Transcription opt-out: You can decline the use of AI-assisted transcription at any time and request a non-transcribed session.
• Reports to a referrer: For funded referral programmes, you decide whether an outcome report is shared with the organisation that referred you, and you can change your mind for future reports.
• Live captions: You decide whether captions are used, and you can turn them off at any time.

16. Data Retention

We keep personal data only for as long as needed for the purposes we collected it, subject to legal, regulatory and clinical-governance requirements. Our headline retention periods are:

When personal data is no longer needed, we either securely delete it or anonymise it so it can no longer be associated with you.

How we set these periods: We base them on professional and clinical record-keeping standards (including the NHS England Records Management Code of Practice 2023 in the UK and the HSE National Records Retention Policy 2024 in Ireland), the time limits for bringing legal claims, tax and accounting law, our contracts with the organisations that arrange our services, and whether we still need the information to provide a service to you. We review them at least once a year.

17. Data Security

Information security is central to what we do. Our controls are aligned with ISO/IEC 27001 and with the heightened cyber-security standards under the EU NIS2 Directive. Key measures include:

• Encryption: Personal data is encrypted in transit (TLS) and at rest.
• Access control: Role-based access, least privilege, and multi-factor authentication for staff and administrators.
• Multi-factor authentication for platform users: When you access the Spectrum.Life web platform or mobile app, we may ask you to confirm your identity using a one-time passcode sent by SMS to your registered mobile number. Sign-in events (date and time, device type and IP address) are logged for security monitoring and deleted automatically after 90 days. If you choose the “Stay logged in on this device” option, a device trust token is stored on your device for up to 30 days so that you are not asked for a new code on that device. This is optional and can be removed at any time in your account settings. Please do not use it on shared or public devices.
• Network and platform security: Firewalling, monitoring, vulnerability management, secure software development and regular patching.
• People security: Pre-employment screening, confidentiality obligations, and regular mandatory security and privacy training.
• Testing and assurance: Regular internal audits, independent penetration testing, and third-party security due diligence.
• Incident response: A documented incident response and breach notification process. We will notify the relevant supervisory authority within the statutory timeframe (generally 72 hours) where required and notify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms. If we need to tell you about a breach, we will contact you directly using the contact details we hold (for example, by email, phone or in-app message) and explain in plain language what happened, the likely consequences, what we are doing about it and any steps you can take to protect yourself.
• Your part: Use a strong, unique password, enable any multi-factor authentication we offer, and never share your credentials. We will never ask for your password by email. Please report any suspected unauthorised access to our Privacy and Security Team  immediately.

18. Marketing Communications

Spectrum.Life may send you communications to keep you informed about our services, new content and wellbeing resources. You remain in control of what you receive.

• Service communications: Regardless of your marketing preferences, we will send you essential service messages that are necessary for the performance of our contract with you or for security and administrative reasons. These include appointment reminders, account confirmations (such as password resets), critical service updates, changes to terms or policies, and security or downtime alerts. You cannot opt out of these messages because they are not promotional. They are necessary for the safe and effective use of the service.
• Newsletters and wellbeing content: Where you have opted in, we may send periodic newsletters containing general wellbeing content, articles, success stories or wellness challenges.
• Promotional communications and new services: With your consent, we may send you information about new Spectrum.Life services or programmes, events such as webinars or workshops, or relevant offers. We may also notify you of complementary services from our partners, but those communications will always come from Spectrum.Life. We do not give your contact information to third parties for them to contact you directly without your separate consent.
• Channels: We may communicate with you via email, in-app messaging, push notifications, SMS or occasionally by telephone. The channel used will depend on the contact information you have provided and the nature of the message. Standard messaging and data rates may apply for SMS.
• Opting in: When you first register or use our services, we will ask for your consent before sending marketing or non-essential communications. If you do not consent, you will not receive them.
• Details supplied by your organisation: Where your employer, college, insurer or another organisation gives us your details so that you can access a service, we use them only to provide that access and send related service messages. We do not use them to send you marketing unless you separately opt in.
• Opting out: You can opt out of marketing communications at any time by:
  • clicking the unsubscribe link in any marketing email;
  • replying STOP to any SMS;
  • updating your preferences in your account settings; or
  • contacting the Privacy and Security Team at gdprspectrumlife@spectrum.life.

We will process opt-out requests as soon as possible. Even if you opt out of marketing, you will still receive essential service communications as described above. Your decision on marketing will not affect your access to core services.

• Frequency: We aim to keep our communications useful and proportionate. You can typically expect a monthly newsletter and occasional announcements.
• Third-party marketing: Spectrum.Life will not share or sell your contact information to third-party companies for their own direct marketing unless you separately consent to that with the relevant partner. Any promotional message you receive should be from Spectrum.Life. If you receive marketing from a third party and believe we shared your data improperly, please contact the Privacy and Security Team immediately.
• Business-to-business communications: If you represent a company or organisation that uses or has expressed interest in our services, we may send business-to-business communications to your work contact information on the basis of legitimate interest. For example, information about new programmes relevant to your organisation. These communications have their own opt-out process and are managed on a separate marketing list. This Notice primarily addresses personal consumer data.
• No sale of data: We do not sell or rent your contact information to third parties for their own marketing or unrelated purposes.

19. Children’s Privacy

Spectrum.Life’s general wellness platform is intended for adults. However, we do offer specialist clinically-led services for children and young people – including short-term counselling, psychotherapy, digital psychologist support, iCBT and neurodiversity assessments – with the involvement of a parent or guardian where this is required, and in line with professional standards on consent to treatment and applicable law.

• Age eligibility: Who can use each service, including any minimum age and whether family members are covered, depends on the programme arranged by your employer, college or insurer. Our services are designed for adults, young people and children. Our in-app wellbeing companion is only for adults aged 18 and over. Our clinical live chat is available to people aged 16 and over.
• Specialist services – under-16s: For services designed for children under 16, we involve a parent, guardian or sponsoring institution as appropriate. Information provided to minors is age-appropriate.
• Specialist services – 16 and 17 year olds accessing services in Ireland: Under the Mental Health Act 2026 (Ireland), people aged 16 and 17 who access mental health services from within Ireland have the independent legal right to consent to or refuse treatment. Parental or guardian consent is not required and cannot override the young person’s decision. People in this group are treated as adults for consent and confidentiality purposes under Irish law.
• Jurisdiction note: Which consent framework applies depends on where the young person is physically located when they access the service, not on where their employer, college or client organisation is based. If you are 16 or 17 and access our services from within the Republic of Ireland, the Mental Health Act 2026 framework applies to you. If you access them from Northern Ireland or elsewhere in the UK, UK law and professional standards on consent to treatment apply.
• How we handle children’s information: We use it only to provide the service and we keep it under our clinical records schedule (Section 16). Young people can exercise their own data protection rights once they are mature enough to understand them. Where they are not, a parent or guardian can act on their behalf. This does not apply to 16 and 17 year olds accessing services in Ireland, who exercise their rights themselves (see below and Section 21). In every case, we put the young person’s best interests and safety first.
• Accidental collection: If we become aware that we have inadvertently collected personal data from a child without the required consent, we will delete it unless retention is legally required (for example, safeguarding).
• Parents and guardians – under-16s: If you believe a child under 16 has submitted personal data to us without the required consent, please contact Privacy and Security Team and we will act promptly.
• Parents and guardians – 16 and 17 year olds in Ireland: Where a young person aged 16 or 17 accesses our services from within Ireland, they have adult-equivalent confidentiality rights under the Mental Health Act 2026. We cannot share information about their use of our services with a parent or guardian without the young person’s consent, except where a safeguarding concern arises. Safeguarding obligations always take precedence. 
• No marketing to children: We do not profile, target market or advertise to children.

20. Links to Other Sites

Our websites and apps may contain links to third-party websites or resources. This Notice does not apply once you leave our platform. Please review the privacy notice of any external site you visit. A link from our platform is not an endorsement.

21. Your Rights

You have the following rights under GDPR and UK GDPR. Most rights can be exercised free of charge, and we will respond within one month (extendable by up to two further months for complex or voluminous requests, in which case we will let you know).

• Right to be informed: This Notice, and the information we give at the point of collection, is how we deliver this right.
• Right of access: You can ask for a copy of the personal data we hold about you, together with information about how we process it.
• Right to rectification: You can ask us to correct inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”): You can ask us to delete your personal data in certain circumstances. Some data may be retained where we are legally required to keep it. Where we hold a clinical record, we are usually unable to delete it before the end of its retention period, because we have professional and legal duties to keep accurate records of the care we provide. We can still correct factual errors and add a note of your views if you disagree with something recorded.
• Right to restrict processing: You can ask us to pause processing in certain circumstances (for example, while the accuracy of data is being checked).
• Right to data portability: Where processing is based on consent or contract and carried out by automated means, you can ask for a machine-readable copy of the data you have provided, or for it to be transmitted directly to another controller where technically feasible.
• Right to object: You can object to processing based on legitimate interests or public-interest tasks, and absolutely to any processing for direct marketing.
• Rights in relation to automated decision-making and AI: As set out in Sections 9 and 10, you have the right not to be subject to solely-automated decisions with legal or similarly significant effects, to obtain human review of significant AI-informed outcomes, and to contest those outcomes.
• Right to withdraw consent: Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of past processing. For example, if you withdraw your agreement to outcome reports being shared with a referrer, we will not send future reports, but we cannot recall a report already sent.
• Right to lodge a complaint: With the Irish Data Protection Commission (DPC) or the UK Information Commissioner’s Office (ICO) – or the supervisory authority in your EU country of residence.

16 and 17 year olds who have independently consented (Ireland)

• Where you are 16 or 17 and have independently consented to services under the Mental Health Act 2026 (Ireland), you can exercise all the rights in this section in your own name, without involving a parent or guardian. This includes the right to access your records, withdraw consent, ask for erasure (subject to the limits on clinical records described above) and make a complaint. A parent or guardian cannot exercise these rights on your behalf without your express consent, except where a safeguarding concern requires us to act. To exercise any of your rights, please contact our Privacy and Security Team directly at gdprspectrumlife@spectrum.life. 

22. How to Contact Us and Exercise Your Rights

• Email: gdprspectrumlife@spectrum.life
• Post: Privacy and Security Team, Spectrum Wellness Limited, 38-39 Fitzwilliam Square W, Dublin 2, D02 NX53, Ireland.

We may need to verify your identity before acting on a rights request, to make sure we do not disclose your data to anyone else. We do not discriminate against people who exercise their rights, and we will explain any case where we cannot fully action a request (for example, where we have a legal obligation to retain particular data).

23. Complaints

If you are not satisfied with how we have handled your personal data or a rights request, you can lodge a complaint with a supervisory authority.

• Ireland – Data Protection Commission (DPC): www.dataprotection.ie. Address: 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland. Phone: +353 578 684 800.
• United Kingdom – Information Commissioner’s Office (ICO): ico.org.uk. Address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom. Phone: +44 303 123 1113.
• Other EU/EEA authorities: Contact details are on the European Data Protection Board (EDPB) website.

We would, however, appreciate the chance to address any concern directly first.

24. Updates to This Notice

We may update this Privacy Notice from time to time to reflect changes in our services, our use of technology (including AI), the third parties we work with, or changes in the law. We will publish the latest version on our website with a revised effective date. Where changes are material, we will also notify you directly – for example, by email, in-app message or on-screen notice – before they take effect. Historical versions are available on request.

How this Notice fits with our other privacy information

We give privacy information in layers, so that you get the right level of detail at the right time:

• This full Notice: published at www.spectrum.life/privacy.
• Registration notice: a short summary shown in our app and web platform when you create your account.
• Clinical intake notice: information given at the start of a clinical service, including how your clinical record is kept and when we may need to share information to keep you or others safe.
• Service-specific summaries: extra information for services with their own arrangements, such as the Student Assistance Programme and funded referral programmes.

Each layer is kept under version control by our Security and Privacy team and reviewed whenever this Notice changes, so that they stay consistent. The shorter notices add detail for a particular service; they do not replace this Notice. If anything seems inconsistent, please contact our Privacy and Security Team.

If you have any questions about this Privacy Notice, please contact our Privacy and Security Team at gdprspectrumlife@spectrum.life.