Privacy Policy

1. Who we are

Faresay is a B2B SaaS practice portal for therapists. We provide software that an independent, UK-registered therapist uses to run their own private practice — managing their own client list, scheduling and conducting video sessions, taking payments and keeping light notes. Our customer is the therapist.

The portal is operated by Faresay Ltd, a company registered in England & Wales (company number 17302034), with its registered office at 167–169 Great Portland Street, London W1W 5PF. We are registered with the Information Commissioner's Office (ICO) under registration reference CSN4521595.

Contact: privacy@faresay.com

2. Our two data-protection roles

It matters which role applies to a given piece of data. Faresay holds two distinct roles under UK GDPR:

• Faresay as controller.For the therapist's own account, identity, billing, subscription, usage and support data — and for data about visitors to our website — Faresay is the controller. This policy applies to that data.
• Faresay as processor. For a therapist's clients' data (including special-category mental-health information), Faresay is a processor, acting only on the therapist's documented instructions under a Data Processing Agreement (UK GDPR Article 28). The therapist is the controller of that client data.

Faresay does nothold the clinical record and does not decide why or how a therapist's clients' data is used. Therapists keep clinical documents in their own storage; the portal holds only links to those documents plus light notes.

If you are a client of a therapist who uses Faresay: this is not the right document for you. Please refer to your therapist's own privacy notice, and contact your therapist to exercise your rights. Faresay will assist your therapist as required under the DPA.

3. What we collect (as controller)

We collect the following categories of personal data about therapists and website visitors:

• Account & identity: name, email, phone, login credentials (passwords stored hashed via Clerk)
• Practice details: business name, professional registration body, number and verification information
• Billing & subscription: plan, transaction history, and payout records
• Usage & analytics: features used, timestamps, IP address, device and log data
• Support & communications: messages you send us and our responses
• Marketing data: contact details and preferences, where you have opted in

Not covered here: a therapist's clients' intake, session and clinical data. Faresay processes that only as a processor on the therapist's instructions under the DPA (see Section 2).

4. How we use your data (as controller)

• To create and manage the therapist's account and provide the portal (contract)
• To process the monthly subscription and card payments/payouts (contract / legal obligation)
• To provide customer support and respond to enquiries
• To verify professional registration and eligibility to use the portal
• For security, fraud prevention and protecting the portal
• For product analytics and service improvement (aggregated where possible)

We rely on the lawful bases of contract, legitimate interests, legal obligation and (for some marketing) consent. As controller, Faresay does not rely on these bases to process clients' special-category data — that processing sits with the therapist as controller.

5. Sub-processors

We use the following providers under written Article 28 terms. They process Faresay's controller data, and (under the DPA) act as sub-processors for client data:

• Clerk — authentication / identity (US, SCCs / IDTA in place)
• Neon — application database (UK/EU regions selected where available)
• Stripe — payment processing, subscription billing and payouts (US/EU, SCCs in place)
• Daily — video session delivery (US, SCCs / IDTA in place)
• Resend — transactional and account email (US, SCCs / IDTA in place)
• Plausible — cookieless, privacy-focused website analytics (EU)

We do not sell your personal information.

6. International data transfers

Our preferred residency for personal data is UK or EU regions. Some sub-processors are US-based (notably Clerk, Stripe, Daily and Resend). Where personal data is transferred outside the UK, we put in place an appropriate safeguard — typically the UK International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses (SCCs) with the UK Addendum — supported where required by a transfer risk assessment.

7. Retention

We keep controller personal data only for as long as necessary, and to meet legal, accounting and dispute-resolution requirements (billing records are typically kept for around 6 years for tax purposes). When controller data is no longer required, we securely delete or anonymise it.

You can delete your account from your dashboard at any time. We deactivate the account immediately, confirm the request by email within 72 hours (with a report of the data we hold), and permanently remove your personal data 30 days after the request — retaining only anonymised records UK law requires us to keep.

Retention of a therapist's clients' data is governed by the DPA and the therapist's own clinical-records obligations. Faresay returns or deletes that data on the therapist's instruction or on termination — Faresay does not set or hold the clinical retention period.

8. Your rights

Where Faresay is the controller of your data, under UK GDPR you have the right to access, rectify, erase, restrict and port your data, and to object to processing or withdraw consent. Contact privacy@faresay.com to exercise any right. You also have the right to lodge a complaint with the ICO at ico.org.uk.

If you are a client of a therapist, contact your therapist (the controller) to exercise rights over your data — not Faresay.

9. Cookies & analytics

We use strictly necessary session cookies only (e.g. authentication and security) — no advertising trackers. For website analytics we use Plausible, which is cookieless and does not collect personal data or track you across sites.

10. Not a crisis service

This policy is about data protection, not crisis support. Faresay is not a crisis or emergency service. If you or someone else is in immediate danger, call 999. For urgent mental health support, call Samaritans on 116 123 (free, 24/7), text SHOUT to 85258, or call NHS 111 and select option 2.