Privacy Policy
Last updated: September 2026
1. About this Privacy Policy
Your privacy and the security of your personal information are important to us. This Privacy Policy explains how ReThink Therapy / Uptrained Brain (“we”, “us” or “our”) collects, uses, stores and protects your personal information when you: visit our websites; contact us; join our mailing list; create an account; buy or access a course, programme or resource; or use our therapy, coaching, training or other services.
It also explains how we handle information that is particularly private or sensitive, including information about your psychological or physical health. We are responsible for deciding how and why your personal information is used. Under data protection law, this means we are the data controller.
Our online courses, memberships and digital resources may be delivered through Zenler, which provides the technology for our online learning platform and processes certain personal information on our behalf.
2. Information we may collect
The information we collect depends on how you interact with us and which services you use.
Contact and identity information: This may include your: name; email address; telephone number; postal or billing address; account details; and information you provide when contacting us.
Account and course information: If you create an account or access an online course, programme, membership or resource, we may collect information such as: your account and login information; courses or resources you have bought or enrolled in; your course progress and completion information; responses to quizzes, surveys, exercises or questionnaires; comments, messages or other content you submit through the platform; and communications about your account or participation.
Payment and transaction information: When you buy a product or service, we may process information about your purchase, payment status, billing and transaction history. Payments may be handled by third-party payment providers. We do not normally receive or store your full payment-card details ourselves.
Website and technical information: When you use our websites or online learning platform, some technical information may be collected automatically. This can include: your IP address; browser and device information; login information; pages you visit and how you move around the site; the date and time of visits; course and platform usage; and information collected through cookies or similar technologies. Please see our Cookie Policy for more information.
Communications and marketing information: We may collect information you provide when you: join our mailing list; request information or download a resource; contact us by email, telephone, website form or social media; respond to a survey or questionnaire; or tell us about your communication or marketing preferences.
3. Sensitive and special category information
Some of our work relates to psychological wellbeing, therapy, coaching and personal development. This means you may sometimes share information with us that is particularly private or sensitive.
Data protection law calls certain types of sensitive information special category data. This can include information about: your mental or physical health; disability or neurodivergence where this reveals information about your health; racial or ethnic background; religious or philosophical beliefs; political opinions; trade union membership; genetic or biometric information used to identify you; your sex life; and your sexual orientation.
Depending on the service you use, you may choose to tell us about your psychological wellbeing, symptoms, diagnoses, medication, treatment, relationships, personal or family history, experiences of trauma, risk or safeguarding concerns, or other sensitive aspects of your life. We recognise that this information requires particular care.
Therapy and psychological services: If you receive therapy, psychological services or another service where sensitive information is relevant, we may keep appropriate records about our work with you. These may include: assessment information; correspondence; session records; clinical notes; and other information reasonably needed to provide the service safely and professionally.
We will only use sensitive information when we have a lawful reason to do so under UK data protection law. For example, we may need to use this information to provide an appropriate health-related service, because you have specifically agreed to a particular use, to protect someone's vital interests or in connection with a legal claim. The reason will depend on the circumstances and the service being provided. We aim to collect only the sensitive information that is relevant and necessary.
Clinical records and Zanda: We use Zanda, a practice-management system for health professionals, to manage and securely store client records, including clinical notes. These records may contain sensitive information about your psychological or physical health and personal circumstances. Zanda provides the technology we use to store and manage these records and processes this information on our behalf. We do not use Zanda's AI note-taking or transcription features. Access to clinical information is restricted to people who have an appropriate professional or operational reason to access it.
Sensitive information submitted through online courses: Some courses, questionnaires, exercises or learning activities may ask you to reflect on personal experiences or psychological wellbeing. You may therefore choose to provide information that is sensitive or personal. We will handle sensitive information you provide through our online services with appropriate care and in accordance with this Privacy Policy and data protection law.
However, our online learning platform is not intended as a substitute for confidential clinical communication. Please do not provide detailed clinical information through a course, discussion area or other online learning feature unless we specifically ask you to do so.
4. Why we use your information
We may use your personal information to: provide therapy, coaching, training, courses and other services; create and manage your account; process purchases and enrolments; give you access to courses, memberships and digital resources; communicate with you about a service or purchase; respond to questions and enquiries; maintain appropriate professional and business records; provide customer or technical support; operate and protect our websites and online services; understand how our websites and courses are being used; improve our services and resources; meet our legal, regulatory and professional responsibilities; establish, exercise or defend legal claims; protect your safety or the safety and rights of another person; and send marketing communications where the law allows us to do so.
We will not use information collected through therapy or another confidential professional service for unrelated advertising or marketing.
5. Our lawful reasons for using your information
UK data protection law requires us to have a valid reason for using your personal information. Depending on what information we are using and why, this may be because: We need it to provide a service to you – for example, to provide a course or service you have requested or bought. We have a legitimate business or professional reason – for example, to respond to an enquiry, maintain appropriate records, protect our systems or manage our services. We will consider your rights and interests when relying on this reason.
We have a legal obligation – where the law requires us to use, disclose or keep certain information. You have given us consent – where we have specifically asked for your permission to use information for a particular purpose. Where we rely on your consent, you can withdraw it. Additional legal protections apply to sensitive information, such as information about your mental or physical health. We will only use this information where data protection law allows us to do so.
6. Confidentiality, safeguarding and disclosure
Information you share during therapy or another confidential professional service is treated as confidential. There are, however, limited circumstances where we may need to share information without your consent.
These can include situations where: there is a serious concern about your safety or someone else's safety; there is a safeguarding concern involving a child or vulnerable person; we are required to disclose information by law or by a court; information is needed in connection with a legal claim; or another legal or professional duty requires us to disclose it. Where appropriate and possible, we would normally discuss this with you first, unless doing so would be unsafe, inappropriate or prohibited by law.
Clinical work may also be discussed as part of professional supervision. Where this happens, only information that is relevant to the supervision will be shared, and it will be treated confidentially.
Our professional practice is informed by the ethical and professional standards relevant to our work.
We are registered with the British Association for Counselling and Psychotherapy (BACP) and the British Psychological Society (BPS).
7. Our online learning platform – Zenler
We use Zenler to provide our online learning environment. If you create an account, buy or enrol on a course, access course materials, complete learning activities or otherwise use our online platform, information may be processed through Zenler so that we can provide these services.
This may include your: name and contact details; account information; course enrolments and purchases; course activity and progress; and information you submit through the platform. Zenler provides the technology used to run the platform and processes relevant personal information in connection with that service. Zenler and some of the companies it uses to provide its services may process information in countries outside the UK. Where personal information is transferred internationally, appropriate safeguards must be used in accordance with data protection law.
8. Other organisations and service providers
We use trusted organisations to help us run our business and provide our services. Depending on the service you use, these may include providers of: clinical record and practice-management systems, including Zanda; website and online-course hosting, including Zenler; payment processing; email delivery and mailing lists; cloud storage and IT services; video hosting; online meetings and live sessions; website analytics and security; accounting and other professional services; and other technology needed to provide our services.
These organisations may process personal information on our behalf where this is necessary to provide their services. We aim to share only the information that is reasonably necessary for the purpose concerned. We may also need to share information with professional advisers, regulators, courts, law-enforcement agencies or other public authorities where this is required or permitted by law. We do not sell your personal information.
9. Information processed outside the UK
Some of the organisations that provide technology or other services to us may process personal information outside the United Kingdom. Different countries may have different data protection laws. Where UK data protection law treats this as a restricted international transfer, we will take reasonable steps to make sure an appropriate legal safeguard is in place. This may include using services in countries recognised by the UK as providing adequate protection or using approved contractual safeguards.
10. Marketing
If you ask to receive news, resources, updates or marketing from us, we may use your contact details for this purpose. Where the law requires your consent, we will ask for it. In some circumstances, the law also allows us to contact existing customers about our own similar products or services. Where we do this, we will follow the applicable rules.
You can stop receiving marketing emails at any time by clicking the unsubscribe link in an email or contacting us. If you unsubscribe from marketing, we may still need to contact you about something you have bought or requested, such as an appointment, account, course or service. We will not use information about your mental or physical health, therapy, diagnosis or other sensitive personal circumstances to target marketing to you.
11. Cookies and analytics
Our websites and online learning platform may use cookies and similar technologies. These may be used to: make the website work correctly; keep accounts and sessions secure; remember your preferences; understand how the website is being used; and provide analytics or marketing functions where applicable. Where the law requires consent for non-essential cookies, you will be given the opportunity to make your choices. Please see our Cookie Policy for more information.
12. How long we keep your information
We keep personal information only for as long as we reasonably need it. How long we keep information depends on what it is, why we collected it and any legal, professional, insurance, accounting or regulatory requirements that apply. Clinical and therapeutic records Our current practice is generally to keep clinical and therapeutic records for seven years after our work together ends, unless there is a legal, safeguarding, professional or other appropriate reason to keep them for a different period.
Financial and transaction records may be kept for the period required for tax, accounting and legal purposes.
Account, course and general website information will be kept for as long as reasonably necessary to provide the relevant service and maintain appropriate business records.
Marketing information: Marketing information is normally kept until you unsubscribe, withdraw your consent where applicable, or we decide that we no longer need it. We may keep a limited record showing that you have opted out so that we can make sure we respect your preference in future.
13. Keeping your information secure We take reasonable technical and organisational steps to protect personal information against loss, misuse, unauthorised access, alteration or disclosure. We take particular care with sensitive and clinical information. Access is limited to people who have an appropriate reason to access it. No online or electronic system can be guaranteed to be completely secure, but we consider the sensitivity of the information involved when deciding how it should be collected, stored and communicated.
14. Your data protection rights
Data protection law gives you rights over your personal information. Depending on the circumstances, you may have the right to: ask us for a copy of the personal information we hold about you; ask us to correct information that is wrong or incomplete; ask us to delete your information in certain circumstances; ask us to limit how we use your information; object to certain uses of your information; ask us to provide certain information in a format that can be transferred elsewhere; withdraw your consent where we rely on consent; and complain about how your information has been handled.
Some of these rights have exceptions. For example, we may sometimes need to keep information because of a legal or professional requirement even if you ask us to delete it. You can object at any time to your personal information being used for direct marketing. If you would like to exercise any of your data protection rights, please contact us using the details below. We may need to confirm your identity before responding.
15. Links to other websites
Our websites or courses may contain links to websites and services run by other organisations. We are not responsible for those organisations' privacy practices. If you provide personal information directly to another organisation, we recommend reading its privacy information.
16. Changes to this Privacy Policy
We may update this Privacy Policy from time to time if our services, technology, professional practice or legal requirements change. The date at the top of this page shows when this Privacy Policy was last updated.
17. How to contact us
If you have a question about this Privacy Policy, want to know how we use your information or want to exercise a data protection right, please contact: ReThink Therapy / Uptrained Brain Email: uptrain@rethinktherapyconwy.com Website: www.rethinktherapyconwy.com We are registered with the Information Commissioner's Office (ICO) as a data controller.
18. Complaints
If you have concerns about how we have handled your personal information, please contact us first if you feel comfortable doing so, so that we have an opportunity to address your concerns.
You also have the right to complain directly to the Information Commissioner's Office (ICO), the UK's data protection regulator. Information about your data protection rights and how to contact the ICO is available at ico.org.uk.
