Trust Centre

Security

Security is ongoing work, not a setting you switch on once. We use established tools and reputable providers, keep access tight, and review our setup as the platform grows.

• Encryption in transit: traffic between your device and Therapyway is protected with TLS, so the connection is encrypted over HTTPS.
• Encryption at rest: the data we store is encrypted at rest using the protections our hosting and database providers offer.
• Access controls and least privilege: access to systems and personal data is limited to people who need it for their work, and we grant the least access required.
• Reputable hosting: we run on established cloud infrastructure rather than self-managed servers, so we benefit from their physical and network security.
• Ongoing review and testing: we review our configuration, dependencies and access regularly, and we test for and fix issues as we find them. As the product matures we plan to expand independent testing.

Data privacy and GDPR

We handle personal data in line with UK GDPR and the Data Protection Act 2018. We only collect what we need for a clear purpose, and we keep it no longer than necessary. Each time we process your personal data we rely on a lawful basis, such as performing a contract with you, your consent, or a legitimate interest that does not override your rights. For health-related information we also meet the extra conditions UK GDPR requires for special category data. You have rights over your data, including the right to be informed, to get a copy, to ask us to correct or delete it, and to object to or restrict certain processing. If you are unhappy with how we have handled your data, you can also complain to the Information Commissioner's Office (ICO), the UK regulator, though we would like the chance to put things right first. Our Privacy Policy sets out the full detail of what we collect, why, how long we keep it, and how to exercise your rights.

Information security practices

Alongside the technical controls above, we follow everyday practices to keep information safe. These are commitments we hold ourselves to as the team and the product grow.

• Vendor due diligence: before we use a third-party service that touches personal data, we review its security and data protection, and we put data processing terms in place where they are needed.
• Staff confidentiality and training: people working on Therapyway are bound by confidentiality obligations and get guidance on data protection and handling personal data carefully.
• Incident response: we have a process for responding to security incidents, which covers investigating, containing and, where the law requires it, notifying the ICO and affected people within the relevant timeframes.
• Logging and monitoring: we keep logs of key activity and monitor our systems so we can spot and look into unusual behaviour.
• Backups: we keep backups so that data can be restored if something goes wrong, and we protect those backups the same way as the live data.

Therapist verification

Only therapists registered with the Health and Care Professions Council (HCPC) can publish a profile and accept bookings on Therapyway. Before a therapist goes live, we check their HCPC registration. HCPC registration means a therapist meets the regulator's standards for training, conduct and ongoing practice, and that they can be held to account through the HCPC. Therapists are expected to keep their registration current and to work within their professional standards and scope of practice. If a registration lapses or is removed, the therapist should no longer be practising on the platform.

Patient and client information

Information about your health is sensitive, and we treat it carefully. It helps to be clear about who is responsible for what. Therapyway is the platform that helps you find a therapist, book appointments, send messages, and handle documentation and payments. The therapist you book is the clinician. They are responsible for your clinical care, for the clinical records they keep, for confidentiality in the consulting room, and for safeguarding. The clinical relationship is between you and your therapist, not with Therapyway. In practice, Therapyway provides the secure tools a therapist uses to run their practice and to communicate with you, and we protect the information that flows through those tools. Decisions about your treatment, the notes a therapist writes, and how they meet their professional and legal duties as a clinician rest with the therapist. Therapyway does not provide therapy, clinical care or medical advice. The platform is also not for emergencies. If you or someone else is at risk, call 999, or call NHS 111 for urgent medical help that is not an emergency.

AI and your data

We want to be straightforward about artificial intelligence. We do not allow your personal or health data to be used to train third-party AI models unless there is a lawful basis for doing so and the right safeguards are in place. We also do not let meaningful decisions about you be made by automated processing alone. Where any automated tools help with a task, a person stays involved and reviews the outcome before it has a real effect on you. If we ever add features that rely more heavily on AI, we will explain clearly what they do, what data they use, and what choices you have, and we will update our Privacy Policy to match.

Reporting a concern

If you spot a security problem, a vulnerability, or anything that looks wrong with how data is handled, please tell us. Email us with enough detail to reproduce or understand the issue, and please give us a reasonable chance to investigate and fix it before sharing it publicly. We take reports seriously and will respond. For more on how we handle data and the rules that apply to using Therapyway, see our Privacy Policy, our Terms, and our Cookie Policy.

Report a security or data concern to contact@therapyway.co.uk.