Data Protection & Privacy Policy

The short version

Youmi is for the people who look after someone else’s mental health. When you talk to us, you tell us sensitive things about yourself and about the person you are supporting. Here is what happens to that:

• We ask your permission first. Conversations about mental health are what the law calls special category data. We ask for your clear, explicit consent before we handle information about your own mental health, and you can take that consent back at any time
• What you tell us about someone else. Information about the person you support is handled under a separate legal condition. Sections 6 and 7 explain it
• Your conversations are yours. We do not sell them. We do not show them to your school. We do not show them to the person you are supporting
• Your school never finds out you signed up. If you found us through your school, we still do not tell them whether you took part, unless you ask us to
• One exception. If we believe a child is at risk of serious harm, we may share the relevant information that is necessary to help protect them. A named clinician or a named deputy makes that decision, never a computer
• You can see it, correct it, or have it deleted. And you can complain to us directly.

1. Who we are

Youmi Support Ltd is the organisation responsible for the information described in this policy. In data protection language, we are the controller.

‍

Company number 16162841, registered in England and Wales

Registered office: 22 Mount Pleasant Road, London, W5 1SG

General contact: hello@youmisupport.com

Data protection contact: privacy@youmisupport.com

Data Protection Lead: Louis Allen

‍

2. What Youmi is, and what it is not

• Youmi provides support to people caring for or supporting someone with their mental health. Two services are covered by this policy
• Youmi Coach is an AI coach delivered in WhatsApp. It is live now
• Youmi Experts connects you to qualified professionals for therapy, coaching, mentoring and psycho-educational advice and support. You can ask for a referral through the form on our website. We are not making referrals yet
• Youmi does not deliver those sessions, book them, take payment for them or engage the professionals who provide them. Youmi refers you to a partner organisation, and that partner does all of it. If you accept a referral, you become that partner’s customer as well as ours, and they will have their own privacy policy governing what they do with your information. We will tell you who they are before anything is shared. The parts of this policy about referrals to a partner take effect when we start making referrals
• Youmi is not therapy, not a diagnosis service, and not a crisis service. If you or someone else is in immediate danger, call 999. The Samaritans are on 116 123, free, at any hour
  ‍

‍

3. Who this policy is for

• ‍Parents, carers and family members who use the Coach
• School staff who use the Coach through a school partnership
• People who come to us directly, and people who found us through their school
• People who ask for a referral through Youmi Experts, and people we refer to a partner organisation
• School staff and people at partner organisations who talk to us about working with us
• Anyone who sends us a question through our website
• People who sign up for updates through our website

‍

4. Where your information comes from

Most of it comes from you.

‍

If you found us through your school, you signed yourself up. You might have scanned a QR code, followed a link, seen us in a school communication, or met us at a school event. Your school does not decide who signs up, and does not tell us who did.

‍

If your school ever shares your details with us, it must ask your permission first, and it may share only your name, mobile number and email address. Nothing about your child. If you would rather we deleted your details without going any further, email privacy@youmisupport.com and we will. If you do not respond to us, we delete your details 28 days after we receive them.

‍

5. What we collect

‍Sign-up details

• First name, last name, email address, and the mobile number you contact us from
• If you sign up for updates through our website: your email address, whether you asked for updates, and the wording you agreed to and when.

‍

Conversations

• Everything you send to the Coach, and everything it sends back
• Information about other people, whatever you tell us about the person you are supporting. See section 7

‍

How you use the service

• Message times, session length, features used, technical and error logs

‍

Safety flags

• Where our system identifies possible risk of harm, and the record of what our Clinical Lead, or their deputy, decided

‍

Experts

• Your request for a referral, the reason for it, and the information we pass to the partner so you do not have to repeat yourself. We do not hold booking or payment information, because the partner takes the booking and the payment

‍

Questions and enquiries

• If you send us a question through our website: your name, your email address and what you write. If you write on behalf of a school or organisation: also your role, your organisation and anything else you choose to tell us. Please do not include any sensitive health data. If you do include information about your own health, the form asks your permission first. See section 6.

‍

6. Sensitive information, and your consent

Conversations about mental health are special category data under Article 9 of the UK GDPR. That includes information about your mental health and about the mental health of the person you are supporting.

‍

For what you tell us about the person you are supporting, our main condition is the substantial public interest condition at paragraph 17 of Schedule 1 to the Data Protection Act 2018, and we also rely on health or social care purposes, Article 9(2)(h) UK GDPR, with paragraph 2 of that Schedule; see section 9. Our condition for handling information about your own mental health is your explicit consent, under Article 9(2)(a).

That means we ask you, in plain words, before the Coach begins. The request names mental health specifically, sits separately from our Terms of Service, and is never pre-ticked.

If you send us a question through our website and it includes information about your own health, our condition is your explicit consent, given by the box on the form, which is never pre-ticked. For anything a parent tells us about the person they support, it is paragraph 17, as for the Coach. If you write to us from a school, please leave out anything about a pupil’s health: if it reaches us, we use it only to reply, then delete it.

‍

You can withdraw at any time by emailing privacy@youmisupport.com.

‍

Withdrawing means we can no longer provide the Coach, and we will delete your conversations on our retention schedule. Taking your consent back is as easy as giving it, and it does not affect anything we did lawfully before you withdrew.

‍

7. Information about other people

This section matters and most privacy policies skip it.

‍

When you talk to the Coach you will mention the person you are supporting, usually your child, and you may mention other people too. So we end up holding information about them, including information about their mental health, even though they never signed up and may not know we exist. This section covers anyone you tell us about, in the Coach or in a question you send us through our website.

‍

If you found us through your school, the person you are supporting may be a pupil at that school. That does not change how we handle what you tell us about them. It is covered by this policy in exactly the same way, and the only exception remains the safeguarding situation in section 8.

‍

What we do about that:

• ‍We ask you not to give more identifying detail than you need to. “My daughter” or a first name is enough for the Coach to help you.
• ‍We protect their information exactly as we protect yours.
• ‍We do not build a profile of them, and we do not use what you tell us to target them in any way.
• ‍We never tell your school what you have said about them, except in the safeguarding situation in section 8.

‍

If the person you are supporting is 13 or over, they have their own rights over information we hold about them, including the right to ask for a copy of it.

‍

What we hold about them comes from you, not from them. It is whatever you choose to tell the Coach while you are looking for support: usually what they are going through, how they are feeling, and what you have already tried. It can include information about their mental health, or about something you say they have done. If you found us through your school, your school gives us nothing about your child. See section 4.

‍

We use it only so the Coach can understand your situation and reply to you. It sits inside your conversations, so we keep it for as long as we keep them. See section 12.

If you tell us about them in a question through our website, we use it only to answer you, and keep it as section 12 sets out.

‍

We do not write to the person you are supporting, or to anyone else you tell us about, to tell them we hold this. We do not have their contact details, and getting them would mean asking you for them and then telling them what you have told us in confidence. So we set it out here instead, publicly, where they or anyone acting for them can find it.

‍

Anyone we hold information about can ask us for a copy of it, ask us to correct it, ask us to delete it, or ask us to stop using it. Email privacy@youmisupport.com with enough detail for us to find it, and we will reply within one month.

‍

8. Keeping someone safe

Almost all of the time, what you tell the Coach stays between you and us. There is one exception.

If we believe someone is at risk of serious harm, we may share the relevant information that is necessary to help protect them. This is the only circumstance in which information from your conversations could reach your school, a health service or the emergency services without you asking us to. If you ask us to share your own information with your school, we will do so with your explicit consent, and we share only what you ask us to.

‍

A named clinician or a named deputy makes every one of these decisions. It is never automatic and never made by the AI. Our Clinical Lead is Dr Indiana Montaque.

‍

The legal conditions we rely on:

• Where someone cannot consent and life is at risk, we rely on vital interests, Article 9(2)(c) UK GDPR
• Where a child is at risk more broadly, we rely on the safeguarding condition in the substantial public interest, at paragraph 18 of Schedule 1 to the Data Protection Act 2018, together with Article 6(1)(ea). That condition requires us to keep an Appropriate Policy Document explaining how we handle information under it, and to have it in place before we process on that basis
• When our Clinical Lead, who is a registered health professional, reviews a concern and decides what to do, we also rely on health or social care purposes, Article 9(2)(h) UK GDPR, with paragraph 2 of Schedule 1 to the Data Protection Act 2018, alongside the conditions above.

‍

We share only the relevant information that is necessary to help protect the person, only with the people who need it, and we record what we shared and why.

9. Why we use your information, and our lawful basis

We always need a lawful basis under Article 6. Where the information is sensitive we also need a condition under Article 9. Both are always required.

‍

What we do: Article 6 basis - Article 9 condition

• Deliver the Coach, and hold your conversations - Contract, 6(1)(b), and legitimate interests, 6(1)(f), where contract does not reach - Explicit consent, 9(2)(a)
• Hold what you tell us about the person you are supporting, including their mental health - Legitimate interests, 6(1)(f) - Substantial public interest, 9(2)(g), paragraph 17 of Schedule 1 to the Data Protection Act 2018; and health or social care purposes, 9(2)(h), paragraph 2 of that Schedule
• Hold the account details needed to run the service - Contract, 6(1)(b) - Not applicable
• Receive your name, mobile number and email address from your school, where your school shares them - Consent, 6(1)(a) - Explicit consent, 9(2)(a), given to your school
• Share your own information with your school, if you ask us to - Consent, 6(1)(a) - Explicit consent, 9(2)(a)
• Keep the service secure and prevent fraud - Legitimate interests, 6(1)(f) - Not applicable
• Keep technical and error logs, which hold no conversation content, so we can find and fix problems - Legitimate interests, 6(1)(f) - Not applicable
• Improve the Coach, using only anonymous data: personal and identifying details are removed first - Legitimate interests, 6(1)(f) - Explicit consent, 9(2)(a), and for the person you are supporting, substantial public interest, 9(2)(g), paragraph 17 of Schedule 1 to the Data Protection Act 2018
• Protect someone at risk of harm - Recognised legitimate interests, 6(1)(ea), or vital interests, 6(1)(d) - See section 8
• Meet legal and regulatory obligations - Legal obligation, 6(1)(c) - Substantial public interest, 9(2)(g), paragraph 6 of Schedule 1 to the Data Protection Act 2018, or legal claims, 9(2)(f)
• Research we run ourselves, if you agree to take part in that piece of research - Consent, 6(1)(a) - Explicit consent, 9(2)(a)
• Refer you to a Youmi Experts partner, and pass them what they need - Consent, 6(1)(a) - Explicit consent, 9(2)(a)
• Invoice a Youmi Experts partner for a referral, and reconcile its payment - Legal obligation, 6(1)(c), for our accounting records, and legitimate interests, 6(1)(f) - Not applicable
• Contact you by email about the service, and ask how the service is working for you - Legitimate interests, 6(1)(f) - Not applicable
• Answer a question you send us through our website - Legitimate interests, 6(1)(f) - Explicit consent, 9(2)(a), for your own health information if you include it and tick the box; for the person you are supporting, substantial public interest, 9(2)(g), paragraph 17 of Schedule 1 to the Data Protection Act 2018
• Talk to school staff and partner organisations about working with us, and keep a record of those conversations - Legitimate interests, 6(1)(f) - Explicit consent, 9(2)(a), for your own health information if you include it and tick the box
• Send you occasional updates by WhatsApp and email about the service, such as new features, and invite you to take part in research, if you tick the Updates box - Consent, 6(1)(a), under the Privacy and Electronic Communications Regulations - Not applicable
• Send you occasional updates by email, including invitations to take part in research, if you sign up through our website - Consent, 6(1)(a), under the Privacy and Electronic Communications Regulations - Not applicable

‍

Research is always a separate choice. We never fold it into signing up, and declining changes nothing about the support you get. We do not pass your information to university research projects: the universities run them, ask people directly and take their own consent. You can ask for a Youmi Experts referral through the form on our website. We are not making referrals yet. We will ask for your explicit consent before we pass anything to a partner.

We ask for your email address when you sign up. You need to give it to use the Coach. We use it to contact you about the service and to ask how the service is working for you. If you tick the Updates box, we may also use it, and WhatsApp, to send you updates about the service, such as new features, and to invite you to take part in research. We do not use it for anything else, and you can tell us to stop feedback requests or updates at any time at privacy@youmisupport.com.

If you send us a question through our website. We use what you send only to answer it. We use your email address only to reply to you, and we do not add it to any mailing list or send you updates unless you ask for them separately. If your message is a complaint or a request about your information, we handle it under sections 15 and 16. If it makes us believe someone is at risk of serious harm, section 8 applies.

‍

10. Who we share information with

‍We do not sell your information. Ever.

• We use other organisations to run the service. Each of them is given only what it needs, and is held to written terms that limit them to our instructions

‍

Who & What they do

• Anthropic - provides the AI model behind the Coach. We contract with Anthropic Ireland Limited, and your conversation content is processed under the transfer safeguards described in section 11
• Meta Platforms - WhatsApp is the channel the Coach runs in
• Supabase - Our databases. Your account and conversations are held there, and what you send through our website forms, with your choices about updates, is held separately in London
• n8n - Moves messages between the Coach and WhatsApp
• customer.io - Sends you email and messages about the service, and our updates if you asked for them
• Twilio - Holds the mobile numbers used for the Coach. Twilio also uses some of this information for its own purposes, such as security and improving its services, as an independent organisation under its own privacy policy.
• Slack - Our internal alerts, including when a conversation is flagged for review
• Google - Workspace, for our internal email and files
• Notion - Internal records
• Typeform - The referral form for Youmi Experts. Our Clinical Lead, or their deputy when the Clinical Lead is away or the post is vacant, reviews what you send before any referral is made
• Xero - Accounting
• ClickUp - Operational Management
• Webflow - Runs our website and receives what you send through its forms. We move each one to our own database straight away and delete Webflow’s copy
• Megaslice - Builds and maintains the Coach. Named people on its team can access what the Coach stores, including conversations, when they do that work

‍

How your conversations are used, and not used:

Your conversations are sent to Anthropic only to generate the Coach’s replies. Anthropic does not use them to train its models, and we do not use them to train or build any AI model. We only use anonymous data when we analyse or evaluate the performance of the Coach to improve it: personal and identifying details are removed first, and no one reads your conversations to improve the Coach. We never sell your information, and we never share information that identifies you for advertising.

‍

We also share information:

• With our partner schools. Any reporting we give a school is aggregated. We never break it down by anything about the people in a group, never cross-reference it against anything else, and never quote anything anyone wrote. We do not report on any group smaller than ten
• ‍With a Youmi Experts partner, once we start making referrals, if you ask us to refer you. We will name the partner and tell you what we are passing before we pass it. They then act as an independent organisation responsible for your information, not on our instructions

‍

11. Where your information is held

Our systems are hosted in the UK and the EU. Some processing happens outside that. Your conversations are processed by our AI provider under our contract with Anthropic Ireland Limited, which is our counterparty for the UK and Europe, under Irish law. That contract carries the UK Addendum to the standard contractual clauses, ICO template B1.0, the transfer safeguard approved by the Information Commissioner. Your conversations are also processed under the global Zero Data Retention terms we have enabled on our Anthropic account. We also use suppliers based outside the UK, including Supabase, which holds your account and your conversations, and Twilio, which holds the mobile number you contact us from. Each of those transfers is covered by a written safeguard with the supplier, and we have assessed the risk of each one. We do not move your information outside those arrangements.

‍

‍

12. How long we keep it

• Your conversations - 12 months after your last activity
• Your details, if your school shares them and you never sign up - 28 days from when we receive them
• Your account and contact details - 12 months after you close your account
• A safety flag that was reviewed but not acted on - 12 months from the review
• A record that we shared information to protect someone - For a child, until their 25th birthday, then reviewed. For an adult, 6 years after the concern is resolved
• The conversation behind such a record - 12 months, as above. Your school holds the full safeguarding record, not us
• Your consent record - While we process your information, and 6 years after
• Your sign-up for updates through our website, and the record of your consent - While you are subscribed, and 12 months after you unsubscribe. After that we keep only your email address, marked so we never send you updates again
• Reporting to your school, once it can no longer identify anyone - No fixed limit
• Your referral to an Experts partner, and our check-ins - 12 months after your last activity
• Bookings and payments for an Experts session - Not held by us. The partner takes the booking and the payment and holds those records under its own policy
• Technical and error logs, which hold no conversation content - 30 days
• A question you send us through our website, and our reply - 12 months after our last reply
• The box you tick on a website form so we can use your own health information - kept with your question, and deleted with it
• Records of our conversations with schools and partner organisations about working with us - 12 months after our last activity with you. Anything about a pupil’s health is deleted within 30 days of us receiving it
• Records of a request or complaint you make about your information, and of any data breach that affects you - 2 years from our reply, or for a data breach from when it is closed
• You can ask us to delete your information sooner. See section 15

‍

13. Automated decisions, and where a human decides

The Coach is an AI. It writes its replies automatically. That is the service.

‍

No decision that significantly affects you is made by the AI alone. In particular, our system may flag a conversation as showing possible risk of harm. Our Safeguarding Lead, or, when they are away, a member of our clinical team, reviews every flag, has the information and the authority to disagree with it, and where it may lead to us sharing information, our Clinical Lead, or their deputy when the Clinical Lead is away or the post is vacant, makes that decision.

Review is not 24 hours a day. A flag raised overnight, at a weekend or on a bank holiday is looked at by the end of the next working day. Review continues during school holidays. If a flag leads us to contact your school, your school may not see it until its next working day, and in the school holidays not for some time. Youmi is not a crisis service. If someone is in immediate danger, call 999.

‍

14. If you found us through your school

Some parents come to us because their school suggested it. If that is you, this section applies.

• Your school and Youmi are separate, independent organisations, each responsible for our own part. Your school may tell parents about us and invite us to speak at its events. You decide whether to sign up. We decide what the Coach does and are responsible for everything after that. Each of us gives our own privacy information and answers requests about our own part.
• What you tell the Coach about your child stays with us. Your school does not see it, whether or not your child is a pupil there, except in the safeguarding situation in section 8.
• If you ask us to share your own information with your school, we will do so with your explicit consent, and we share only what you ask us to.
• Exercise your rights with whichever of us holds the information. For anything the Coach holds, that is us: email privacy@youmisupport.com. For what your school holds, ask your school.
• What your school gets back: numbers, themes and patterns across the whole group, with small numbers removed so no one can be identified. Never a conversation. Never a name. Never a list of who signed up

‍

15. Your rights

You can ask us to:

• Give you a copy of what we hold about you
• Correct anything wrong
• Delete it
• Limit what we do with it
• Send it to you or someone else in a portable format
• Stop processing you object to
• Withdraw your consent, at any time

‍

Email privacy@youmisupport.com. We will reply within one month. There is no charge.

‍

16. How to complain

You have a legal right to complain directly to us, under section 164A of the Data Protection Act 2018.

• Use our complaint form: www.youmisupport.com/get-in-touch
• Or email privacy@youmisupport.com
• Or tell us any way you like, including in the WhatsApp chat. We will treat it as a complaint however it reaches us

‍

We will acknowledge your complaint within 30 days, look into it properly, keep you posted, and tell you the outcome.

‍

You can also complain to the Information Commissioner’s Office at any point. You do not have to come to us first.

‍

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Telephone 0303 123 1113. ico.org.uk

‍

17. Children and age

• Youmi is for adults. You must be 18 or over to use it, and we ask you to confirm your age when you sign up
• Youmi is not designed for young people and we are not putting it in front of pupils. If we find out that someone under 18 has signed up, we will delete their information
• If we build something for young people in future, it will have its own protections and its own policy, and we will not launch it until the safeguarding behind it is right

‍

18. Security

• Your data is encrypted in transit and at rest
• Your conversations are stored against a random identifier rather than your name, with the link between the two held separately and under tighter access control
• Access limited by role, with multi-factor authentication on staff accounts, and access logged

‍

19. Changes to this policy

• We will tell you about significant changes by message and by posting a notice. Every version is dated.

20. Contact

Youmi Support Ltd, 22 Mount Pleasant Road, London, W5 1SG

General: hello@youmisupport.com | Data protection: privacy@youmisupport.com

‍

Company number 16162841

All Rights Reserved. Youmi™ © 2026