How your data is handled
Your therapist is responsible for your personal data. They use a platform called Aurical to help manage their practice and support your therapy.
Here's what you need to know:
Your data stays in the UK/EU. All your data is stored and processed within the United Kingdom and European Union. Where a technology provider is based outside the UK, your data stays in UK/EU data centres with additional safeguards including encryption.
AI helps your therapist, but your therapist is always in charge. Aurical uses AI to help draft session notes and create therapeutic exercises. Your therapist reviews and approves everything before it becomes part of your record or before you see it. The AI never makes decisions about your care, and it does not store or keep any of your data.
You control audio recording. If your therapist offers to record sessions, you choose whether to consent. You can say no, and it won't affect your therapy. If you say yes, you can change your mind at any time. The audio is never stored — it's converted to text in real time and immediately discarded.
You can access, correct, or delete your data. You have rights under UK data protection law. Ask your therapist, or contact us at info@aurical.co.uk.
Read the full privacy notice below for complete details.
Read the full privacy notice
Privacy Notice for Clients
Last updated: 20 July 2026
1. Who is responsible for your data?
Your therapist is the data controller — they decide how and why your personal data is used. Their details:
- Name: Your therapist
- Practice: Private practice
- Registered with: a professional regulatory body
- Contact: Ask your therapist directly
- ICO registration: registered with the ICO (ask your therapist for their registration number)
Aurical Ltd is the data processor — we provide the technology platform your therapist uses. We process your data on your therapist's instructions.
- Company: Aurical Ltd, Company No. 17257201
- Contact: info@aurical.co.uk
- Website: aurical.co.uk
2. What data do we collect?
| What | Why | Who enters it |
|---|---|---|
| Your name, email, and phone number | So your therapist can contact you and you can log in | Your therapist (or you, via the intake form) |
| Session notes | Your therapist's record of your sessions | Your therapist (sometimes AI-assisted — see section 4) |
| Session summaries | Brief, therapist-approved summaries you can view | AI generates a draft; your therapist reviews and approves |
| Screening questionnaires (e.g., PHQ-9, GAD-7) | To help your therapist understand how you're doing | You complete them; scores calculated automatically |
| Daily mood scores | To track how you're feeling between sessions | You (optional — a 1-10 rating + optional note) |
| Therapeutic exercises (e.g., thought records) | Between-session work your therapist assigns | You complete them; your therapist reviews your responses |
| Session transcripts (if audio is used) | To help your therapist write session notes | Created automatically from recorded audio (with your consent) |
| Appointment details | To manage your sessions | Your therapist (or you, via self-booking) |
| Invoice and payment information | To process payments for your sessions | Your therapist creates invoices; Stripe processes payments |
What you won't see:
- You will never see your therapist's full clinical notes. You see only the brief session summaries your therapist has specifically approved for you. If you would like to see your full clinical records, you have the right to make a Subject Access Request — see section 8 below.
- You will never see the raw AI conversation your therapist has with Aurical. You see only approved content.
3. What is the legal basis for using your data?
Your therapist processes your data under two legal bases:
For clinical data (notes, formulations, screening scores, mood entries, therapeutic exercises, transcripts): Your therapist relies on Article 9(2)(h) UK GDPR — the health professional condition. This means the processing is necessary for providing your healthcare, and your therapist (as a health professional) is responsible for it. Your therapist maintains an Appropriate Policy Document as required by law.
For audio recording (if used): Your therapist relies on your explicit consent under Article 9(2)(a) UK GDPR. You will be asked to consent before any session is recorded. You can decline or withdraw consent at any time — this will not affect your care in any way.
For payments: Processing is necessary to perform the contract for your therapy services (Article 6(1)(b)).
4. How is AI used?
Aurical uses artificial intelligence (AI) to help your therapist with documentation and between-session support. Here's how:
What the AI does:
- Drafts session notes from your therapist's input (or from a session transcript, if audio is used)
- Generates session summaries for you to view
- Creates therapeutic exercises (e.g., thought records, defusion exercises) at your therapist's request
- Helps your therapist with administrative tasks (scheduling, invoicing)
What the AI does NOT do:
- The AI does not make decisions about your care
- The AI does not diagnose, assess, or treat you
- The AI does not communicate directly with you — everything you see has been reviewed and approved by your therapist
- The AI does not learn from your data — your information is never used to train or improve AI models
- The AI does not store or keep any of the content it processes — your data passes through and is immediately discarded
Automated safety checks: The AI provider's systems run automated safety checks on content as it is processed. These checks are fully automated — no person sees your data — and no information is stored from these checks.
The approval rule: Every piece of AI-generated content is a draft until your therapist reviews, edits if needed, and approves it. Nothing enters your record or reaches you without your therapist's explicit approval.
5. Audio recording
If your therapist uses audio recording:
- It's always your choice. You will be asked to give explicit consent before any recording. Declining has no effect on your care.
- Audio is never stored. The audio is streamed in real time to a UK-based speech recognition company (Speechmatics, Cambridge) and converted to text immediately. The audio itself is discarded — it is never saved anywhere, and is not accessible to Speechmatics or any other party after processing.
- Only the transcript is kept. The text transcript becomes part of your clinical record (with the same protections as your session notes).
- You can withdraw consent at any time. Future sessions simply won't be recorded. Existing transcripts remain part of your clinical record unless you and your therapist agree to delete them.
6. Who else sees your data?
Your therapist uses the following service providers to run Aurical. These companies process your data on your therapist's behalf, under strict contracts:
| Provider | What they do | Where your data is processed |
|---|---|---|
| Aurical Ltd | The platform itself | UK and EU |
| HostStack (Denmark) | Hosts the application | EU (Germany / Finland) |
| Supabase | Stores your data securely | London, UK |
| Speechmatics (Cambridge, UK) | Converts audio to text (if used) | UK / EU |
| AWS (Amazon Web Services) | Runs the AI that helps your therapist | London, UK |
| Stripe | Processes your payments | Dublin, Ireland |
| PostHog | Website analytics (no clinical data) | EU |
| Calendar integration (appointment times only) | EU |
Your data stays in the UK and EU. All providers are contractually required to process your data within the UK or European Union. Where a provider is headquartered outside the UK (e.g., in the US), additional safeguards are in place:
- Encryption: Sensitive clinical data (notes, formulations, summaries, transcripts, therapeutic exercises, and mood notes) is encrypted by Aurical before it reaches our database provider. In the unlikely event that the database provider were compelled to hand over raw data, the clinical content would be unreadable without keys held separately in the EU.
- No data retention by AI: The AI provider does not store or retain any of the content it processes. Data passes through for processing and is immediately discarded.
- Strict contracts: All providers have signed data processing agreements with standard contractual clauses, legally binding them to protect your data under UK and EU law.
Nobody uses your data for their own purposes. All providers are prohibited from using your data for advertising, model training, analytics, or any purpose other than providing the service to your therapist.
7. How long is your data kept?
| Data | How long |
|---|---|
| Clinical records (notes, summaries, formulations, transcripts, mood entries, exercise responses, screening scores) | 7 years from your last contact with your therapist |
| Audio recordings | Not kept — discarded immediately after transcription |
| Payment records | 7 years (tax requirements) |
| Your account | Until your therapist closes it, plus 30 days |
Your therapist may have their own retention policy based on their professional body's guidance. Ask them if you'd like to know more.
8. Your rights
Under UK data protection law, you have the right to:
| Right | What it means |
|---|---|
| Access | Ask for a copy of all the data held about you |
| Rectification | Ask for incorrect data to be corrected |
| Erasure | Ask for your data to be deleted (subject to your therapist's professional record-keeping obligations) |
| Restriction | Ask for processing to be limited in certain circumstances |
| Portability | Receive your data in a portable format |
| Objection | Object to processing in certain circumstances |
| Withdraw consent | Withdraw consent for audio recording at any time (does not affect other processing) |
| Complain | Lodge a complaint with the Information Commissioner's Office (ICO) |
To exercise your rights: Contact your therapist directly (they are the data controller). For a written subject access request, contact your therapist by email in the first instance. You can also contact Aurical at info@aurical.co.uk and we will pass your request to your therapist.
ICO contact: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. ico.org.uk. Helpline: 0303 123 1113.
9. Automated decision-making
Aurical does not make automated decisions that have legal or similarly significant effects on you. All AI outputs are reviewed and approved by your therapist before they affect your record or care. Your therapist makes all clinical decisions.
10. Changes to this notice
If we make significant changes to how your data is processed, your therapist will notify you. This notice will be updated and the date at the top will change.
11. Contact
Your therapist (data controller):
Your therapist
Private practice
Ask your therapist directly
Aurical (data processor):
Aurical Ltd, Company No. 17257201
Email: info@aurical.co.uk
Website: aurical.co.uk