facebookPixelImg

Privacy & Cookies Policy

This Policy was last updated on 20th of May 2025.

1. Introduction

This is the Privacy & Cookies Policy (the “Policy”) of JAAQ Corporate Limited, a company registered in England and Wales with registration number 13589848, with registered address 27 Old Gloucester Street, Holborn, London, WC1N 3AX (hereafter ‘JAAQ’, ‘we’, ‘us’ or 'our'). This Policy describes the ways in which JAAQ collects and processes personal data relating to you when you use our online services, including our platform at www.jaaq.org,  or via our mobile application (together the “Platform”), or otherwise interact with us in an online or offline setting, including via a survey, research project or similar. Please note that JAAQ is intended for individuals 18 years of age and above. 

JAAQ is registered with the Information Commissioner’s Office (ICO), the UK regulator for data protection issues. For the purposes of any applicable data protection legislation, including the EU General Data Protection Regulation (2016/679) and United Kingdom General Data Protection Regulation (collectively "GDPR") and Data Protection Act 2018 (collectively the "Data Protection Laws"), JAAQ is the 'controller' of your personal data. 

 

In this Policy, we explain how we process your 'personal data' - that is, any information that alone or in combination with other information personally identifies you, such as your name, email address, or other details you provide when using our Platform. At JAAQ we will only collect the personal data that we need, and wherever possible, we use 'anonymous data'. Anonymous data means that we can no longer identify you, so it doesn't come within the scope of this Privacy Policy.

We make updates to this Policy from time to time and whilst we will tell you about what we feel are key changes to the Policy, please check it regularly to keep up-to-date. If you do not wish to accept the new Policy you should stop using the Platform. If you continue to use the Platform after the changes are made, your continued use of the Platform shows us your agreement to be bound by the new Policy.

2. The personal data we collect about you

We collect personal data relating to (i) Platform visitors; (ii) users who sign-up for a Platform account; (iii) staff of our business partners who share personal data for administrative purposes, and (iv) content creators who contribute to the Platform (including experts, lived experience contributors, and celebrities). The types of personal data that we process and how we use it will differ depending on your identity. 

 

The following list of personal data that we process in the course of operating the Platform may change over time. We will inform you of any changes via our updates to this Policy.




Category of Personal Data

What does this mean?

Identity Data

First and last name, date of birth, email address, location, employee ID and/or identity of the employer (if Employer is a JAAQ partner), and other identifiers as required.

If you are a staff member of a JAAQ partner, we will collect any identity data that you choose to provide in the course of contacting JAAQ for business administration purposes. 

Profile Data

Your username and password, your interests (including any content added to your personal collection), preferences, feedback, and survey responses (including responses to any psychometric assessments, where applicable). This may also include a profile image, demographic data, short biography, and social media links, if you choose to apply and are accepted to become a content creator. 

Behavioural Data

This refers to inferred or assumed information about your behaviour and interests, based on how you interact with the JAAQ platform. It helps us to gauge the popularity of our features and personalise your experience.

User-Generated Data 

Information and content that you share with our Platform such as when you search for specific topics or resources, or share personal information to get more tailored support. Where Platform users engage with our AI-enabled services, this will also include any conversation data that you share (including either voice or text data, depending on how you interact with our AI-enabled services). 

Video content and transcripts

This applies to individuals who participate in creating content with JAAQ ‘content creators’. Due to the nature of the filming, participants may share personal information that will then be processed by JAAQ to provide end-users with the JAAQ experience. These uses are outlined in the contracts signed by the participants prior to filming.

Technical Data

Internet protocol (IP) address, your login data, browser type and version, time zone setting and location, device ID, usage data, operating system and platform and other technology on the devices you use to access the Platform.

Aggregated and Anonymised Data

Aggregated data refers to information gathered from several individuals and combined in a way that ensures anonymity. Because it doesn’t directly or indirectly identify anyone, it isn’t classified as personal data. To protect your privacy, we only create aggregated data when it includes information from at least 10 people, reducing the chance of anyone being identified.

Special Category Data

Special categories of personal data include information about your health, such as mental health-related details. When using our Platform, you may choose to share information about your mood or mental state, which means the data you provide could include health data or other types of special category personal data. These features are entirely optional, and JAAQ will never require you to share this type of information to access or use our services.

The information collected via those cookies/technologies which are not necessary cookies, as set out in the cookies section, below

If you choose to allow these cookies (other than necessary cookies, which do not require your prior consent before being deployed) to be placed, then JAAQ will place those cookies and therefore collect any information provided via them accordingly.

The information collected via your participation in any research seminar or submitted via any survey or questionnaire from us.

If you choose to take part in a research seminar or respond to a survey or questionnaire, JAAQ will collect the information you provide through those activities. This data is only collected if you voluntarily participate. In some cases, this may involve collecting and processing Special Category Data, but we will always obtain your explicit consent before doing so.

Marketing and Communications Data

Your preferences in receiving marketing and other communications from us.

 

3. How and why we use your personal data

We may process your personal data in accordance with the following legal grounds (i.e. lawful bases) as set out under Article 6 of the GDPR:

 

  • With your consent. We may ask for you to consent to certain activities when you sign up with us; we will only use your personal data for the explicit purposes for which you have consented. You can withdraw your consent at any time by emailing us at info@jaaq.org.

  • As necessary for the performance of our contract with you, as per our terms and conditions.

  • As necessary to comply with our legal obligations.

  • As necessary for our (or others') legitimate interests, namely our legitimate interest in operating our company, and our legitimate interest in providing a helpful, personalised, safe, and secure service to you.

 

With respect to your Special Category Data (including your health data), we will only process this with your explicit consent, in accordance with Article 9 of the GDPR.  

 

The purposes for which we process your personal data are set out below, alongside the corresponding GDPR lawful bases we rely upon in each instance:

Purpose of the processing

UK GDPR lawful basis

Account Registration: For certain of our services, you need to register for a Platform account. We may send you a registration email and register you as a new user, once you have provided the required details. We collect your Identity Data (including certain contact data) and User Generated Data. We may also collect your Special Category Data, should you choose to provide it. 


Alternatively, you may register for an account via alternative methods such as single sign-on (SSO) which do not involve storing any user data. 

To the extent that your method of account registration involves JAAQ's processing of your personal data, the lawful bases we rely on are the performance of our contract with you, as per our terms and conditions, and JAAQ's legitimate interests in providing a helpful service.


The lawful basis we rely on for the processing of any Special Category Data is that you have provided your explicit consent.

Providing you with a personalised service: We may personalise the service we offer to you. This may include, for example, processing through JAAQ AI which can build a profile of a registered user's conversations in order to personalise future conversations and recommendations (this allows JAAQ AI to continue to provide a bespoke user journey, even after the underlying conversation transcripts have been deleted in accordance with our data retention policies). 

The lawful basis we rely on for the processing of your (non-health related) personal data is that the processing is necessary for the pursuit of JAAQ's legitimate interest in providing you with a personalised service.


The lawful bases we rely on for the processing of any Special Category Data are that you have provided your consent and explicit consent. 

Content creators: If you choose to apply as a content creator, we will process any personal data (including Special Category Data) that you include within your application. If your application is accepted, we will process your personal data and Special Category Data in the course of making your content available to users through our Platform. 

The lawful basis we rely on for processing your personal data in connection with reviewing your application is our legitimate interest in operating our company. 


The lawful basis we rely on for the processing of your personal data once your application has been accepted is that the processing is necessary for the performance of our contract with you. 


The lawful basis we rely on for the processing of any Special Category Data is that you have provided your explicit consent.

Mental Health Features: Where you have an account with JAAQ, to enable you to use the mental health features on our platform, you will be invited (but not required) to share a variety of personal data, including Identity Data, User-Generated Data, and Contact Data. Most importantly, to gain full benefit of these features, you may need to share specific information about your mental health. This is considered Special Category Data, and we treat this with the utmost sensitivity. 

The Article 6 UK GDPR lawful bases we rely on when processing your personal data in connection with offering mental health features is our performance of a contract with you (if you have an account for a particular JAAQ service).


The lawful basis we rely on to process your Special Category Data is that you have provided your explicit consent. 

 

Service and Support: We provide you with the services offered on our Platform (including technical support services). These services will differ, depending on whether you are browsing JAAQ.org or you have an account for a particular JAAQ service (such as Chat with JAAQ, which utilises artificial intelligence to help you navigate JAAQ content). In providing our services, we process personal data including Identity Data, Contact, Profile Data, User-Generated Data and Marketing and Communications Data, alongside any Special Category Data that you provide. 

Where you have an account with JAAQ, the lawful basis we rely upon is the performance of our contract with you. Where you do not have an account (for example, you are browsing our content on JAAQ.org), we rely on our legitimate interests in providing you with a helpful and safe service.  


The lawful basis we rely on to process your Special Category Data is that you provide your explicit consent.

Research and Development: We process your personal data in an anonymised format, to develop the JAAQ offering, to create and distribute research, and to share the data with health professionals and academics to improve our services and other services relating to mental wellbeing. If you choose to share it with us, we may also process your Special Category Data for these purposes. 

The lawful basis we rely upon to process your personal data is that it is necessary for the purposes of our legitimate interests in providing a helpful and safe service.  


The lawful basis we rely upon to process your Special Category Data is that you have provided your explicit consent.  

Fraud Prevention: To keep our Platform, our services, your personal data and associated systems operational and secure. We collect Identity, Contact, and Technical Data. 

The lawful bases we rely upon are our legitimate interest in providing a safe and secure service to you, and compliance with our legal obligation to ensure that your personal data remains secure.  

Communication and Marketing: To send you

relevant information and updates about our

services and, where you have specifically opted

in, marketing communications. You can manage

your communication preferences by using the unsubscribe option in our communications.

Our lawful basis for sending relevant information and updates is that the processing is necessary for our legitimate interest in providing a helpful service to you. 


When we send marketing communications that you have specifically requested, our lawful basis is that you have provided your consent.  

Business administration: In the course of interacting with our business partners, we may process certain personal data relating to their staff (for example, during day to day email exchanges relating to our services). We may process Identity Data relating to these staff members. 

Our lawful basis is that the processing is necessary for the purposes of our legitimate interests in operating our company and providing our services to you and your employees/members.  

Cookies: As explained below in Section 4, we use a variety of strictly necessary and non-essential cookies when you access our services. 

When we process personal data obtained through strictly necessary cookies, our lawful basis is that the processing is necessary for the purposes of our legitimate interest in providing you with a helpful, safe and secure service. 


When we process personal data obtained via non-essential cookies, our lawful basis is that you have provided your consent. 

Compliance with our legal obligations: We may process your personal data to comply with any procedures, laws and regulations which apply to us. 

The lawful basis we rely on for processing your personal data is that the processing is necessary for our compliance with legal obligations to which JAAQ is subject. We may also process your personal data in this context where it is in ours (or a third-party's) legitimate interests for JAAQ to comply with any applicable procedure, law, or regulation.  

To establish, exercise, or defend our legal rights: We may process your personal data to establish, exercise or defend our legal rights, including any rights we hold under a contract with you.

Our lawful basis is that the processing is necessary for the purpose of JAAQ's or a third-party's legitimate interests in establishing, exercising, or defending JAAQ's legal rights. 

 

4. Cookies

What are Cookies? 

Cookies are small text files that are placed on your device when you use the Platform. When deploying strictly necessary cookies (i.e. cookies which are essential to the provision of our services), we do not require your consent. In the case of non-essential cookies, we obtain your consent before these are deployed on your device. 

JAAQ’s use of cookies is detailed in the table below. 

  • Session cookies enable you to move from page to page within the Platform and any information you enter will be remembered, but is then deleted when you close the relevant page or after a short time. 

 

  • Persistent cookies allow us to remember your preferences and settings when you use the Platform in the future.

  • Disabling Cookies: The use of the cookies described above improves the functionality of the Platform and your experience of using it. If you do not want non-essential cookies to be served on your device, you are able to disable them by changing the settings on the Platform or on your device. Please note that if you do decide to disable cookies you may not be able to access some parts of the Platform, and some of the features of the Platform may not function properly. You can also withdraw your consent to our use of non-essential cookies at any time. 

  • Third Party Cookies: Third Party advertisers may place or read cookies on your browser or device when you use the Platforms. 

  • More information: To find out more about how cookies work, how to manage and delete them and to see which ones have been set please visit aboutcookies.org or www.allaboutcookies.org.

JAAQ uses cookies and similar technologies in the following ways when you use the Platforms:

 

Cookie Name

Description

Category

AMP_*

Amplitude analytics cookies for session tracking and behaviour analytics.

Analytics

AMP_MKTG_*

Amplitude marketing variant cookies used for attribution and campaign performance.

Marketing

OptanonAlertBoxClosed

Remembers if cookie banner was closed.

Functional

OptanonConsent

Stores user's cookie consent preferences.

Strictly Necessary

BEAMER_FIRST_VISIT*

Tracks first-time visit for feature announcements.

Functional

BEAMER_USER_ID*

Persistent ID for Beamer feature tracking.

Functional

__cf_bm

Cloudflare bot management cookie. Helps detect bots.

Strictly Necessary

__utmzz

Google Analytics variant for traffic source tracking.

Analytics

_fbp

Facebook Pixel for ad tracking and user retargeting.

Marketing

_ga

Google Analytics – unique user tracking.

Analytics

ga*

GA4-specific cookie IDs, each tied to a different property.

Analytics

_gcl_au

Google AdSense conversion tracking.

Marketing

_gid

Google Analytics for per-session user data.

Analytics

_hjDonePolls

Hotjar – remembers if user completed a poll.

Functional

_hjMinimizedPolls

Hotjar – remembers if a poll was minimized.

Functional

hjSessionUser*

Hotjar – anonymous user ID per session.

Analytics

hjSession*

Hotjar – session state info.

Analytics

_hp5_event_props

Heap Analytics – session event tracking.

Analytics

_hp5_let

Heap Analytics – user interaction telemetry.

Analytics

_hp5_meta

Heap Analytics – stores metadata about user activity.

Analytics

_rdt_uuid

Reddit Ads – unique ad tracking user ID.

Marketing

_tt_enable_cookie

TikTok tracking enablement flag.

Marketing

_ttp

TikTok Pixel – user tracking across sessions.

Marketing

access_token_production

Used by Amplitude Analytics to authenticate requests sent from the website.

Analytics

intercom

Intercom – supports chat widget and session persistence.

Functional

mutiny

Personalization and A/B testing for UI/UX optimization.

Functional

org_login_production

Used by Amplitude Analytics to track organization login state and session tracking.

Analytics

tt_chain_token

TikTok token to track conversion/flow chain.

Marketing

ttcsid, ttcsid_*

TikTok session identifier cookie.

Marketing

ttwid

TikTok user identifier or profile ID.

Marketing

 

5. How we share your personal data

Some of the information JAAQ collects from you is passed to third parties. These third parties are:

  • our infrastructure and storage hosting providers – Azure Cloud Services and Amazon Web Services;

  • our Large Language Model provider - OpenAI;

  • Our Speech to Text / Text to Speech language processing partner – ElevenLabs;

  • our streaming and processing provider – Publit.io;

  • our transactional email provider – Postmark;

  • our behaviour analytics providers – HotJar, Amplitude;

  • our user analytics provider – Google Analytics;

  • our marketing email service provider – Klaviyo;

  • certain other third party analytics and cookies providers as described further in paragraph 4 above;

  • our group companies, including our parent JAAQ Limited, our auditors and our professional advisers;

  • our data protection regulator (the ICO);

  • JAAQ may share your information with:

    • any third party, in relation to the sale of some or all of JAAQ’ business, or its assets, or as part of any business restructuring or reorganisation. JAAQ will take steps with the aim of ensuring that your rights continue to be protected if any of your personal data is transferred under these circumstances;

    • in anonymised form, to data aggregators and platform providers as part of an analysis of user metrics or sales performance; or

  • law enforcement agencies and other competent authorities (including health agencies and bodies) in compliance with legal obligations owed by JAAQ.

6. International transfers

Our Platform is hosted in the UK and EEA, so your personal data will be processed by JAAQ in those locations. However, as some of our offices and trusted third parties are located elsewhere, there may be times when your personal data may be transferred to or processed in another country.

 

Whenever we transfer your personal data outside of the UK or the EEA, we ensure that an equivalent degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

  • We will transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the UK government or the European Commission, through the issuance of an adequacy ruling. This includes transfers to recipients based in the United States, where those recipients have registered for the EU-US Data Privacy Framework and/ or the UK-US Data Bridge. 

 

  • Where we use service providers located in jurisdictions that have not received an adequacy ruling, we will use model contractual clauses that have been approved for use by the UK government and/ or European Commission, which afford personal data an equivalent level of protection to that which it receives in the UK or the EEA.

 

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK or the EEA.

7. Data security

We take the security, integrity, and confidentiality of your personal data very seriously. To protect it from misuse or unauthorised access, we’ve put in place technical, administrative, and physical safeguards. Access to your personal data is restricted to employees, agents, contractors, and third parties who require access to do their specific job. They are required to follow our instructions and are bound by confidentiality obligations.

 

We also have procedures in place to respond to any suspected personal data breaches. If a breach occurs and we are legally required to notify you or the relevant regulator, we will do so without undue delay. We will then take all necessary actions to limit the impact and prevent future breaches.

 

Due to the nature of our mental health platform, you may choose to share information with us that is considered "special category data" under data protection laws - this includes details related to your mental health. We recognise the sensitivity of this information and apply additional safeguards to protect it:

 

  1. Explicit Consent: We will always seek your explicit consent before collecting or processing any Special Category Data.

  2. Secure Storage: All Special Category Data is stored securely with enhanced encryption and restricted access protocols.

  3. Minimal Retention: We only retain Special Category Data for as long as necessary to provide you with our services or as required by law.

  4. Limited Sharing: Special Category Data is never shared with third parties unless:

  • You have given explicit consent

  • We are legally required to do so

  • It is necessary to protect your vital interests or those of another person

  1. Anonymisation: When your Special Category Data is used for research, product improvement, or analytics, it is fully anonymised or aggregated using robust techniques to ensure you cannot be identified.

8. Data retention

We retain your personal data only for as long as necessary to fulfil the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. If you ask us to delete your account, we will delete your contact and ID information within 30 days of your request. Any records of your interactions with our Platform will be permanently anonymised in a way that ensures you cannot be identified. We do this to allow us to generate and share research with healthcare professionals and academics to help improve mental wellbeing services

 

JAAQ stores historic ‘conversation’ data when you interact with 'Chat with JAAQ' for 30 days, after which the underlying transcripts are deleted. JAAQ stores relevant details about you which are obtained through conversation data to build a personalised profile for the lifetime of the account. You can object to the processing of your (non-health related) personal data for profiling purposes, as this processing takes place pursuant to our legitimate interests. You can also withdraw your consent to the processing of your health data for profiling purposes at any time, following which we will delete any personal data associated with your personalised profile. 

9. Your rights

Under the UK GDPR, you have various important rights when it comes to your personal data. Please note that not all of these rights are absolute and so they may be subject to exceptions. These rights include:

  1. Right to object to processing: You can object to certain types of processing (for example, where the processing is based on our legitimate interests, or where the processing is for our provision of direct marketing communications).

  2. Right to be informed: You’re entitled to clear, transparent, and easy-to-understand information about how we use your personal data - which is why we encourage you to read this Policy.

  3. Right of access: You have the right to access your personal data (including copies thereof) to ensure we are handling it in accordance with Data Protection Laws.

  4. Right to rectification: You can update or correct your personal information through your account settings. If you encounter any issues, you can contact us to amend inaccurate data we hold about you.

  5. Right to erasure: You can request that we delete your personal data. While this right is not absolute and may be subject to exceptions, we will do our best to accommodate your request.

  6. Right to restrict processing: You can ask us to limit or suspend further use of your personal data.

  7. Right to data portability: You have the right to ask that we transfer the information you have given us from one organisation to another, or give it to you.

  8. Right to lodge a complaint: If you’re unhappy with how we handle your personal data, please contact us at info@jaaq.org. If we’re unable to resolve your concern, you have the right to raise it with the Information Commissioner’s Office (ICO).

  9. Right to withdraw consent: If you've previously given us your consent to process your data, you can withdraw it at any time. If you wish to withdraw your consent, please contact info@jaaq.org. However, please note that doing so may affect our ability to offer certain features or services which are reliant on the processing of your special category data. In such instances, it may be necessary for JAAQ to close your account while still allowing you to access basic JAAQ features. 

  10. Right not to be subject to automated decision-making: You have the right not to be subject to decisions made solely through automated processing, which produce legal or similarly significant effects.

You will not be required to pay a fee to access your personal data or to exercise any of your rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive.

We aim to respond to all legitimate requests within one month (although if you withdraw your consent or object to our continued processing, we will comply with that request as soon as possible). If your request is particularly complex or if you have submitted multiple requests, our response time may be extended. In such cases, we will inform you of the delay and keep you updated on the progress.

10. Using our Platform

Links to third party websites: JAAQ is not responsible for the privacy policies and practices of other sites even if you access them via the Platform. You should check the policy of each site you visit and contact its owner or operator if you have any concerns or questions.

11. Contacting us

We understand that this Privacy Policy contains a lot of information, and some terms or concepts may be unfamiliar.

If you have any questions or need clarification, please don’t hesitate to contact our Data Protection Officer at info@jaaq.org, we are always happy to assist.

You can also write to us at Data Protection Query, JAAQ Corporate Limited, 34-35 Clarges Street Mayfair, London, England, W1J 7EJ.