Privacy notice
The short version: we keep as little as we can, we only share it when you say so, we never sell it, and you can ask for it back.
Draft, to be finalised with our data protection adviser before launch.
Who we are
Ownsay is the data controller for the information we hold about you. Ownsay is being registered as a community interest company limited by guarantee, in England and Wales. You can contact us at hello@ownsay.org.uk.
What we keep
Only what we need to support you. Optional details stay optional. We may keep:
- what you’d like us to call you, how to contact you, your languages and your area;
- your consents: what you agreed to, when, and any you have withdrawn;
- your sessions, your plan and its versions, and any surveys you choose to answer;
- optional details such as pronouns, ethnicity in your own words, faith and access needs, only if you choose to share them.
We never ask about a diagnosis, your medication or your immigration status.
Before we keep anything
Before we store anything beyond your contact details, we explain in plain words what we keep, who sees it, the limits of confidentiality and how to change your mind. We record your agreement as a consent, with the date and the version of this notice.
Who sees it
- Your messages stay between you and your peer or mentor.
- A coordinator or supervisor can see when messages were sent, not what they say. They can open them only for cover, a safeguarding worry or a complaint, and must record why. Every opening is logged and reviewed.
- Nothing leaves Ownsay without your consent. The only exception is a serious risk to someone’s life or safety, decided and recorded by our safeguarding lead.
- Funders and NHS trusts only ever see anonymous totals, with small numbers hidden.
Where it is stored
Our records are stored in the UK. Some suppliers process data abroad, under UK data protection safeguards. Our database and files are in London. If you message us on WhatsApp, Meta stores message content in the UK but may process it in data centres abroad. Our AI, video and email suppliers may also process data outside the UK. We will list every supplier here before launch.
How we use AI
AI helps with translation, turning voice notes into text when you ask, drafting plan wording you approve line by line, and answering questions only from our checked library. We remove names and numbers before any AI call. It never listens to your conversations, scores your risk, makes decisions about you or learns from your data. Our suppliers must not train on our data.
Crisis words
If you message us on WhatsApp using certain words that suggest you may be in crisis, our system replies straight away with crisis contacts and, in working hours, lets our coordinator know. This uses a fixed list of words, not AI and not a score.
How long we keep it
| Information | Kept for |
|---|---|
| Enquiries that don’t go ahead | 6 months after last contact |
| Your profile, consents, sessions and plans | 6 years after support ends, then deleted or anonymised |
| Messages | 2 years after support ends |
| Voice notes and photos you send | 90 days, unless saved to your record with a reason |
| Anonymous community voice answers | 2 years, then only totals are kept |
| Records of who opened what (audit log) | 6 years |
Your rights
- Ask for a copy of what we hold about you.
- Ask us to correct anything that is wrong.
- Ask us to delete your information. If we must keep something for safeguarding reasons, we’ll explain why.
- See and withdraw your consents at any time, in your portal or by sending “my consents” on WhatsApp.
We reply within one month. To ask, contact us. If you’re unhappy with how we handle your information, you can complain to the Information Commissioner’s Office at ico.org.uk.
This website
This site uses no analytics, no tracking, no adverts and no third-party cookies. Fonts and images are served from our own site. Your accessibility choices are kept only on your own device. Pressing Shift three times takes you to the BBC weather page.
The legal basis
Health, ethnicity and faith are special category data. The legal bases we rely on will be confirmed in our data protection impact assessment, with advice from a qualified adviser, and set out here before we support anyone.