Data Protection & Privacy Policy

The short version

Youmi is for the people who look after someone else's mental health. When you talk to us, you tell us sensitive things about yourself and about the person you are supporting. Here is what happens to that:

• We ask your permission first. Conversations about mental health are what the law calls special category data. We ask for your clear, explicit consent before we handle it, and you can take that consent back at any time
• Your conversations are yours. We do not sell them. We do not show them to your school. We do not show them to the person you are supporting
• Your school never finds out you signed up. If your school introduced you to us, we still do not tell them whether you took part
• One exception. If we believe a child is at risk of serious harm, we may share the minimum needed to protect them. A named clinician makes that decision, never a computer

-

-You can see it, correct it, or have it deleted. And you can complain to us directly.

‍

The rest of this policy is the detail.

‍

1. Who we are

Youmi Support Ltd is the organisation responsible for the information described in this policy. In data protection language, we are the controller.

‍

Company number 16162841, registered in England and Wales

Registered office: 22 Mount Pleasant Road, London, W5 1SG

General contact: hello@youmisupport.com

Data protection contact: privacy@youmisupport.com

Data Protection Lead: Louis Allen

‍

• Youmi does not deliver those sessions, book them, take payment for them or engage the professionals who provide them. Youmi refers you to a partner organisation, and that partner does all of it. If you accept a referral, you become that partner's customer as well as ours, and they will have their own privacy policy governing what they do with your information. We will tell you who they are before anything is shared. The parts of this policy that mention Experts take effect when it launches
• Youmi is not therapy, not a diagnosis service, and not a crisis service. If you or someone else is in immediate danger, call 999. The Samaritans are on 116 123, free, at any hour
  ‍

• Youmi provides support to people caring for or supporting someone with their mental health. Two services are covered by this policy
• Youmi Coach is an AI coach delivered in WhatsApp. It is live now
• Youmi Experts connects you to qualified professionals for therapy, coaching, mentoring and psycho-educational advice and support. It is not live yet

‍

2. What Youmi is, and what it is not

3. Who this policy is for

• ‍Parents, carers and family members who use the Coach
• School staff who use the Coach through a school partnership
• People who come to us directly, and people whose school introduced them
• People we refer to a partner organisation through Youmi Experts, and people a partner refers to us

‍

4. Where your information comes from

Most of it comes from you.

‍

If a partner organisation referred you to us, for example a therapy service you were already using, they gave us your contact details after asking your permission. We will tell you who referred you in our first message, and you can ask us to delete your details at any point.

‍

If your school introduced you, your school gave us your name and mobile number, and told us you were invited through its wellbeing support. It should have asked your permission before doing that. Nothing about your child was shared with us. If you would rather we deleted your details without going any further, email privacy@youmisupport.com and we will. If you do not respond to us, we delete your details 30 days after we receive them.

‍

5. What we collect

‍Sign-up details

• First name, last name, email address, and the mobile number you contact us from

‍

Conversations

• Everything you send to the Coach, and everything it sends back
• Information about other people, whatever you tell us about the person you are supporting. See section 7

‍

How you use the service

• Message times, session length, features used, technical and error logs

‍

Safety flags

• Where our system identifies possible risk of harm, and the record of what a clinician decided

‍

Experts, when it launches

• Your request for a referral, the reason for it, and the information we pass to the partner so you do not have to repeat yourself. We do not hold booking or payment information, because the partner takes the booking and the payment

‍

6. Sensitive information, and your consent

Conversations about mental health are special category data under Article 9 of the UK GDPR. That includes information about your mental health and about the mental health of the person you are supporting.

‍

Our condition for handling it is your explicit consent, under Article 9(2)(a)..

That means we ask you, in plain words, before the Coach begins. The request names mental health specifically, sits separately from our Terms of Service, and is never pre-ticked.

You can withdraw at any time by emailing privacy@youmisupport.com.

‍

Withdrawing means we can no longer provide the Coach, and we will delete your conversations. Taking your consent back is as easy as giving it, and it does not affect anything we did lawfully before you withdrew.

‍

7. Information about other people

This section matters and most privacy policies skip it.

‍

When you talk to the Coach you will mention the person you are supporting, usually your child. So we end up holding information about them, including information about their mental health, even though they never signed up and may not know we exist.

‍

What we do about that:

• "My daughter" or a first name is enough for the Coach to help youWe ask you not to give more identifying detail than you need to. "My daughter" or a first name is enough for the Coach to help you.
• -We protect their information exactly as we protect yours
• , and we do not use what you tell us to target them in any wayWe do not build a profile of them, and we do not use what you tell us to target them in any way.
• , except in the safeguarding situation in section 8We never tell your school what you have said about them, except in the safeguarding situation in section 8.

‍

If the person you are supporting is 13 or over, they have their own rights over information we hold about them, including the right to ask for a copy of it.

‍

8. Keeping someone safe

Almost all of the time, what you tell the Coach stays between you and us. There is one exception.

If we believe someone is at risk of serious harm, we may share the minimum necessary to protect them. This is the only circumstance in which information from your conversations could reach your school, a health service or the emergency services.

‍

A named clinician makes every one of these decisions. It is never automatic and never made by the AI. Our Clinical Lead is Dr Indiana Montaque.

‍

The legal conditions we rely on:

• Where someone cannot consent and life is at risk, we rely on vital interests, Article 9(2)(c) UK GDPR
• Where a child is at risk more broadly, we rely on the safeguarding condition in the substantial public interest, at paragraph 18 of Schedule 1 to the Data Protection Act 2018, together with Article 6(1)(ea). That condition requires us to keep an Appropriate Policy Document explaining how we handle information under it, and to have it in place before we process on that basis

‍

‍

We share the minimum, to the people who need it, and we record what we shared and why.

‍

9. Why we use your information, and our lawful basis

We always need a lawful basis under Article 6. Where the information is sensitive we also need a condition under Article 9. Both are always required.

‍

What we do: Article 6 basis - Article 9 condition

• Deliver the Coach, and hold your conversations  Consent, 6(1)(a) - Explicit consent, 9(2)(a)
• Hold the account details needed to run the service - Contract, 6(1)(b) - Not applicable
• Receive your name and number from your school - Consent, 6(1)(a) - Explicit consent, 9(2)(a), given to your school
• Keep the service secure and prevent fraud - Legitimate interests, 6(1)(f) - Not applicable
• Improve the Coach - Not applicable. We use only de-identified, aggregated information that cannot identify you, which is not personal data. Not applicable
• Protect someone at risk of harm - Recognised legitimate interests, 6(1)(ea), or vital interests, 6(1)(d) | See section 8
• Meet legal and regulatory obligations - Legal obligation, 6(1)(c) - Varies
• Research with university partners | Consent, 6(1)(a) | Explicit consent, 9(2)(a)
• Refer you to a Youmi Experts partner, and pass them what they need - Consent, 6(1)(a) - Explicit consent, 9(2)(a)

‍

Youmi Experts*: Check in with you after a referral, and share what we learn with the partner | Consent, 6(1)(a) | Explicit consent, 9(2)(a) |

‍

Research is always a separate choice. We never fold it into signing up, and declining changes nothing about the support you get.

‍

*Youmi Experts is a planned feature and is not yet live. We will handle your data as above only once it has launched and only after you give explicit consent to a referral.

‍

10. Who we share information with

‍We do not sell your information. Ever.

• We use other organisations to run the service. Each is bound by a written contract that limits them to our instructions

‍

Who & What they do

• Anthropic: provides the AI model behind the Coach. Your conversation content is processed by Anthropic in the United States, under the transfer safeguards described in section 11
• Meta Platforms - WhatsApp is the channel the Coach runs in
• Supabase - Our database, where your account and conversations are stored
• n8n: Moves messages between the Coach and WhatsApp
• customer.io: Sends you email and messages about the service
• Twilio: Sends the one-time code that verifies your mobile number
• Slack: Our internal alerts, including when a conversation is flagged for review
• Google: Workspace, for our internal email and files
• Notion: Internal records

-

How your conversations are used, and not used:

Your conversations are sent to Anthropic only to generate the Coach's replies. Anthropic does not use them to train its models, and we do not use them to train or build any AI model. To improve how the Coach supports people, we look only at de-identified and aggregated information about how it is used, never the content of individual conversations. We never sell your information, and we never share information that identifies you for advertising.

‍

We also share information:

• With our partner schools. ,Any reporting we give a school is aggregated and never identifies an individual. We only report on groups large enough that no one can be picked out, and never on small numbers, for example never a group smaller than ten
• ‍With a Youmi Experts partner, when it launches, if you ask us to refer you. We will name the partner and tell you what we are passing before we pass it. They then act as an independent organisation responsible for your information, not on our instructions

-

11. Where your information is held

Our systems are hosted in the UK and the EU. The content of your conversations is processed by our AI provider, Anthropic, in the United States, so the Coach can reply to you. That transfer is covered by the transfer safeguards we are putting in place with Anthropic. We do not move your information outside these arrangements.

‍

12. How long we keep it

• Your conversations - 12 months after your last activity
• Your details, if your school introduced you and you never signed up - 30 days from when we receive them
• Your account and contact details - 12 months after you close your account
• A safety flag that was reviewed but not acted on - 12 months from the review
• A record that we shared information to protect someone - 25 years, matching how schools keep safeguarding records
• The conversation behind such a record - 12 months, as above. Your school holds the full safeguarding record, not us
• Your consent record - While we process your information, and 6 years after
• Reporting to your school, once it can no longer identify anyone - No fixed limit
• Your referral to an Experts partner, and our check-ins | Kept no longer than needed for the referral and any follow-up. Confirmed before Experts launches
• Bookings and payments for an Experts session | Not held by us. The partner takes the booking and the payment and holds those records under its own policy
• You can ask us to delete your information sooner. See section 15

‍

13. Automated decisions, and where a human decides

The Coach is an AI. It writes its replies automatically. That is the service.

‍

No decision that significantly affects you is made by the AI alone. In particular, our system may flag a conversation as showing possible risk of harm. That flag is a prompt for a person to look, not a decision. A named clinician reviews it, has the information and the authority to disagree with it, and decides what happens.

‍

14. If your school introduced you

Some parents come to us because their school suggested it. If that is you, this section applies.

• For one narrow part of this, your school and Youmi may act together. Deciding which parents to invite, and making the introduction, may be a decision the two of us take jointly. Where it is, we are joint controllers for that stage under Article 26 of the UK GDPR, and a written arrangement with your school sets out who is responsible for what. You can ask us for the substance of it
• Everything after the introduction is us alone. Your school has no say in what the Coach does, no visibility of your conversations, and no way to find out whether you signed up
• You can exercise your rights against either of us. Contact whichever is easier and we will sort it out between us. If you withdraw your consent from your school, that stops the school sharing anything further, but it does not automatically stop us. Tell us as well, by emailing privacy@youmisupport.com.
• What your school gets back: numbers, themes and patterns across the whole group, with small numbers removed so no one can be identified. Never a conversation. Never a name. Never a list of who signed up

‍

15. Your rights

You can ask us to:

• -Give you a copy of what we hold about you
• C*orrect anything wrong
• -Delete it
• -Limit what we do with it
• Send it to you or someone else in a portable format
• Stop processing you object to
• Withdraw your consent, at any time

‍

Email privacy@youmisupport.com. We will reply within one month. There is no charge.

‍

16. How to complain

You have a legal right to complain directly to us, under section 164A of the Data Protection Act 2018.

• Use our complaint form: www.youmisupport.com/get-in-touch
• Or email privacy@youmisupport.com
• Or tell us any way you like, including in the WhatsApp chat. We will treat it as a complaint however it reaches us

‍

We will acknowledge your complaint within 30 days, look into it properly, keep you posted, and tell you the outcome.

‍

You can also complain to the Information Commissioner's Office at any point. You do not have to come to us first.

‍

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Telephone 0303 123 1113. ico.org.uk

‍

17. Children and age

• Youmi is for adults. You must be 18 or over to use it, and we ask you to confirm your age when you sign up
• Youmi is not designed for young people and we are not putting it in front of pupils. If we find out that someone under 18 has signed up, we will delete their information
• If we build something for young people in future, it will have its own protections and its own policy, and we will not launch it until the safeguarding behind it is right

‍

18. Security

• Your data is encrypted in transit and at rest
• Your conversations are stored against a random identifier rather than your name, with the link between the two held separately and under tighter access control

‍

19. Changes to this policy

• Access limited by role, with multi-factor authentication on staff accounts, and access logged
• We will tell you about significant changes by message and by posting a notice. Every version is dated and we keep the previous ones.

‍

20. Contact

Youmi Support Ltd, Mount Pleasant Road, London, W5 1SG

General: hello@youmisupport.com | Data protection: privacy@youmisupport.com

‍

Company number 16162841

All Rights Reserved. Youmi™ © 2026