Privacy & Cookies Policy

This Policy was last updated on 20th of May 2025.

1. Introduction

This is the Privacy & Cookies Policy (the “Policy”) of JAAQ Corporate Limited, a company registered in England and Wales with registration number 13589848, with registered address 27 Old Gloucester Street, Holborn, London, WC1N 3AX (hereafter ‘JAAQ’, ‘we’, ‘us’ or 'our'). This Policy describes the ways in which JAAQ collects and processes personal data relating to you when you use our online services, including our platform at www.jaaq.org,  or via our mobile application (together the “Platform”), or otherwise interact with us in an online or offline setting, including via a survey, research project or similar. Please note that JAAQ is intended for individuals 18 years of age and above. 

JAAQ is registered with the Information Commissioner’s Office (ICO), the UK regulator for data protection issues. For the purposes of any applicable data protection legislation, including the EU General Data Protection Regulation (2016/679) and United Kingdom General Data Protection Regulation (collectively "GDPR") and Data Protection Act 2018 (collectively the "Data Protection Laws"), JAAQ is the 'controller' of your personal data. 

 

In this Policy, we explain how we process your 'personal data' - that is, any information that alone or in combination with other information personally identifies you, such as your name, email address, or other details you provide when using our Platform. At JAAQ we will only collect the personal data that we need, and wherever possible, we use 'anonymous data'. Anonymous data means that we can no longer identify you, so it doesn't come within the scope of this Privacy Policy.

We make updates to this Policy from time to time and whilst we will tell you about what we feel are key changes to the Policy, please check it regularly to keep up-to-date. If you do not wish to accept the new Policy you should stop using the Platform. If you continue to use the Platform after the changes are made, your continued use of the Platform shows us your agreement to be bound by the new Policy.

2. The personal data we collect about you

We collect personal data relating to (i) Platform visitors; (ii) users who sign-up for a Platform account; (iii) staff of our business partners who share personal data for administrative purposes, and (iv) content creators who contribute to the Platform (including experts, lived experience contributors, and celebrities). The types of personal data that we process and how we use it will differ depending on your identity. 

 

The following list of personal data that we process in the course of operating the Platform may change over time. We will inform you of any changes via our updates to this Policy.

 

3. How and why we use your personal data

We may process your personal data in accordance with the following legal grounds (i.e. lawful bases) as set out under Article 6 of the GDPR:

 

• With your consent. We may ask for you to consent to certain activities when you sign up with us; we will only use your personal data for the explicit purposes for which you have consented. You can withdraw your consent at any time by emailing us at info@jaaq.org.

• As necessary for the performance of our contract with you, as per our terms and conditions.

• As necessary to comply with our legal obligations.

• As necessary for our (or others') legitimate interests, namely our legitimate interest in operating our company, and our legitimate interest in providing a helpful, personalised, safe, and secure service to you.

 

With respect to your Special Category Data (including your health data), we will only process this with your explicit consent, in accordance with Article 9 of the GDPR.  

 

The purposes for which we process your personal data are set out below, alongside the corresponding GDPR lawful bases we rely upon in each instance:

 

4. Cookies

What are Cookies? 

Cookies are small text files that are placed on your device when you use the Platform. When deploying strictly necessary cookies (i.e. cookies which are essential to the provision of our services), we do not require your consent. In the case of non-essential cookies, we obtain your consent before these are deployed on your device. 

JAAQ’s use of cookies is detailed in the table below. 

• Session cookies enable you to move from page to page within the Platform and any information you enter will be remembered, but is then deleted when you close the relevant page or after a short time. 

 

• Persistent cookies allow us to remember your preferences and settings when you use the Platform in the future.
  
  

• Disabling Cookies: The use of the cookies described above improves the functionality of the Platform and your experience of using it. If you do not want non-essential cookies to be served on your device, you are able to disable them by changing the settings on the Platform or on your device. Please note that if you do decide to disable cookies you may not be able to access some parts of the Platform, and some of the features of the Platform may not function properly. You can also withdraw your consent to our use of non-essential cookies at any time. 

• Third Party Cookies: Third Party advertisers may place or read cookies on your browser or device when you use the Platforms. 

• More information: To find out more about how cookies work, how to manage and delete them and to see which ones have been set please visit aboutcookies.org or www.allaboutcookies.org.

JAAQ uses cookies and similar technologies in the following ways when you use the Platforms:

 

 

5. How we share your personal data

Some of the information JAAQ collects from you is passed to third parties. These third parties are:

• our infrastructure and storage hosting providers – Azure Cloud Services and Amazon Web Services;

• our Large Language Model provider - OpenAI;

• Our Speech to Text / Text to Speech language processing partner – ElevenLabs;

• our streaming and processing provider – Publit.io;

• our transactional email provider – Postmark;

• our behaviour analytics providers – HotJar, Amplitude;

• our user analytics provider – Google Analytics;

• our marketing email service provider – Klaviyo;

• certain other third party analytics and cookies providers as described further in paragraph 4 above;

• our group companies, including our parent JAAQ Limited, our auditors and our professional advisers;

• our data protection regulator (the ICO);

• JAAQ may share your information with:

• any third party, in relation to the sale of some or all of JAAQ’ business, or its assets, or as part of any business restructuring or reorganisation. JAAQ will take steps with the aim of ensuring that your rights continue to be protected if any of your personal data is transferred under these circumstances;

• in anonymised form, to data aggregators and platform providers as part of an analysis of user metrics or sales performance; or

• law enforcement agencies and other competent authorities (including health agencies and bodies) in compliance with legal obligations owed by JAAQ.
  
  

6. International transfers

Our Platform is hosted in the UK and EEA, so your personal data will be processed by JAAQ in those locations. However, as some of our offices and trusted third parties are located elsewhere, there may be times when your personal data may be transferred to or processed in another country.

 

Whenever we transfer your personal data outside of the UK or the EEA, we ensure that an equivalent degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the UK government or the European Commission, through the issuance of an adequacy ruling. This includes transfers to recipients based in the United States, where those recipients have registered for the EU-US Data Privacy Framework and/ or the UK-US Data Bridge. 

 

• Where we use service providers located in jurisdictions that have not received an adequacy ruling, we will use model contractual clauses that have been approved for use by the UK government and/ or European Commission, which afford personal data an equivalent level of protection to that which it receives in the UK or the EEA.

 

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK or the EEA.

7. Data security

We take the security, integrity, and confidentiality of your personal data very seriously. To protect it from misuse or unauthorised access, we’ve put in place technical, administrative, and physical safeguards. Access to your personal data is restricted to employees, agents, contractors, and third parties who require access to do their specific job. They are required to follow our instructions and are bound by confidentiality obligations.

 

We also have procedures in place to respond to any suspected personal data breaches. If a breach occurs and we are legally required to notify you or the relevant regulator, we will do so without undue delay. We will then take all necessary actions to limit the impact and prevent future breaches.

 

Due to the nature of our mental health platform, you may choose to share information with us that is considered "special category data" under data protection laws - this includes details related to your mental health. We recognise the sensitivity of this information and apply additional safeguards to protect it:

 

1. Explicit Consent: We will always seek your explicit consent before collecting or processing any Special Category Data.

2. Secure Storage: All Special Category Data is stored securely with enhanced encryption and restricted access protocols.

3. Minimal Retention: We only retain Special Category Data for as long as necessary to provide you with our services or as required by law.

4. Limited Sharing: Special Category Data is never shared with third parties unless:

• You have given explicit consent

• We are legally required to do so

• It is necessary to protect your vital interests or those of another person

5. Anonymisation: When your Special Category Data is used for research, product improvement, or analytics, it is fully anonymised or aggregated using robust techniques to ensure you cannot be identified.

8. Data retention

We retain your personal data only for as long as necessary to fulfil the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. If you ask us to delete your account, we will delete your contact and ID information within 30 days of your request. Any records of your interactions with our Platform will be permanently anonymised in a way that ensures you cannot be identified. We do this to allow us to generate and share research with healthcare professionals and academics to help improve mental wellbeing services

 

JAAQ stores historic ‘conversation’ data when you interact with 'Chat with JAAQ' for 30 days, after which the underlying transcripts are deleted. JAAQ stores relevant details about you which are obtained through conversation data to build a personalised profile for the lifetime of the account. You can object to the processing of your (non-health related) personal data for profiling purposes, as this processing takes place pursuant to our legitimate interests. You can also withdraw your consent to the processing of your health data for profiling purposes at any time, following which we will delete any personal data associated with your personalised profile. 

9. Your rights

Under the UK GDPR, you have various important rights when it comes to your personal data. Please note that not all of these rights are absolute and so they may be subject to exceptions. These rights include:

1. Right to object to processing: You can object to certain types of processing (for example, where the processing is based on our legitimate interests, or where the processing is for our provision of direct marketing communications).

2. Right to be informed: You’re entitled to clear, transparent, and easy-to-understand information about how we use your personal data - which is why we encourage you to read this Policy.

3. Right of access: You have the right to access your personal data (including copies thereof) to ensure we are handling it in accordance with Data Protection Laws.

4. Right to rectification: You can update or correct your personal information through your account settings. If you encounter any issues, you can contact us to amend inaccurate data we hold about you.

5. Right to erasure: You can request that we delete your personal data. While this right is not absolute and may be subject to exceptions, we will do our best to accommodate your request.

6. Right to restrict processing: You can ask us to limit or suspend further use of your personal data.

7. Right to data portability: You have the right to ask that we transfer the information you have given us from one organisation to another, or give it to you.

8. Right to lodge a complaint: If you’re unhappy with how we handle your personal data, please contact us at info@jaaq.org. If we’re unable to resolve your concern, you have the right to raise it with the Information Commissioner’s Office (ICO).

9. Right to withdraw consent: If you've previously given us your consent to process your data, you can withdraw it at any time. If you wish to withdraw your consent, please contact info@jaaq.org. However, please note that doing so may affect our ability to offer certain features or services which are reliant on the processing of your special category data. In such instances, it may be necessary for JAAQ to close your account while still allowing you to access basic JAAQ features. 

10. Right not to be subject to automated decision-making: You have the right not to be subject to decisions made solely through automated processing, which produce legal or similarly significant effects.

You will not be required to pay a fee to access your personal data or to exercise any of your rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive.

We aim to respond to all legitimate requests within one month (although if you withdraw your consent or object to our continued processing, we will comply with that request as soon as possible). If your request is particularly complex or if you have submitted multiple requests, our response time may be extended. In such cases, we will inform you of the delay and keep you updated on the progress.

10. Using our Platform

Links to third party websites: JAAQ is not responsible for the privacy policies and practices of other sites even if you access them via the Platform. You should check the policy of each site you visit and contact its owner or operator if you have any concerns or questions.

11. Contacting us

We understand that this Privacy Policy contains a lot of information, and some terms or concepts may be unfamiliar.

If you have any questions or need clarification, please don’t hesitate to contact our Data Protection Officer at info@jaaq.org, we are always happy to assist.

You can also write to us at Data Protection Query, JAAQ Corporate Limited, 34-35 Clarges Street Mayfair, London, England, W1J 7EJ.