Privacy Policy

Welcome to PAConline Ltd. (“we”, “us”, “our”).

We value your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our platform and related services (“the Platform”).

By using our Platform, you agree to the terms of this Privacy Policy.

1. Who We Are

PAConline Ltd. operates a digital platform that connects patients (“Users”) with qualified counsellors and psychotherapists (“Counsellors”).

• Data Controller: PAConline Ltd.
• Registered Address: 3 Barnfield Crescent, Exeter, Devon EX1 1QT, UK
• Contact Email: help@paconline.co.uk
• ICO Registration Number: C1796057

We are registered with the Information Commissioner’s Office (ICO), the UK’s data protection regulator.

2. The Data We Collect

We may collect and process the following categories of personal data:

A. From Users (Patients)

• Identity Data: name, age, gender (if provided).
• Contact Data: email address, phone number.
• Account Data: login details, preferences, communication history.
• Usage Data: interactions with counsellors, session bookings, platform usage statistics.
• Payment Data: payment method (processed via third-party providers — we do not store card details).
• Sensitive Data: limited information voluntarily shared about mental health or counselling goals (only as needed to match you to a counsellor).

B. From Counsellors

• Identity Data: name, date of birth, gender (if provided).
• Professional Data: qualifications, accreditations, registration numbers, professional membership details.
• Contact Data: email, phone, business address.
• Financial Data: bank details for payments, billing information.
• Account Data: login details, subscription history, service fees.

C. Automatically Collected Data

• Technical Data: IP address, browser type, device type, time zone, operating system.
• Cookies and Analytics Data: to improve performance and user experience (see Section 11 below).

We do not use your personal data for automated decision-making or profiling.

3. Lawful Basis for Processing

Under UK GDPR, we process your data using the following lawful bases:

Purpose	Lawful Basis
To create and manage your account	Performance of a contract
To match Users with Counsellors	Legitimate interests
To process payments and subscriptions	Performance of a contract
To send service-related emails	Legitimate interests
To comply with legal obligations (e.g. tax records)	Legal obligation
To improve and secure the Platform	Legitimate interests
To send marketing communications (if opted in)	Consent

You may withdraw consent at any time by contacting us at help@paconline.co.uk.

3a. Special Category Data (Mental Health)

When you use the Platform to find or engage a counsellor, you may share information that reveals your mental or physical health. Under UK GDPR Article 9, this is “special category data” and requires a stricter lawful basis than ordinary personal data.

Our Article 9 condition: we rely on your explicit consent (Article 9(2)(a)). You are asked to give that consent at the point you sign up and at the point you provide any health-related context (e.g. on the intake form or when describing what you are seeking help with).

What this means in practice:

• You can withdraw consent at any time by contacting help@paconline.co.uk. Withdrawal is forward-looking and does not affect processing already carried out lawfully.
• We collect only the special category data needed to match you with a suitable counsellor and to share with the counsellor you choose.
• Special category data is held under stricter access controls than ordinary personal data and is not used for marketing.
• Counsellors receive only the special category data needed to provide their service to you, and they act as independent data controllers for any clinical notes they then hold.

4. How We Use Your Data

We use your personal data to:

• Create and manage your account.
• Match Users to suitable Counsellors.
• Facilitate bookings, messaging, and payments.
• Manage Counsellor subscriptions and commissions.
• Ensure security, fraud prevention, and compliance with professional standards.
• Communicate important updates, policy changes, and service notifications.
• Improve our services and user experience.

5. How We Share Your Data

We only share data when necessary, under strict confidentiality and data protection conditions.

We may share limited information with:

• Counsellors — only the personal information needed to contact you and provide their service.
• Professional advisers (e.g. accountants, legal counsel) where required.
• Regulators or law enforcement when required by law.

We never sell your data to third parties.

5a. Sub-processors

The following third-party processors handle personal data on our instructions to operate the Platform. Each is bound by a written data-processing agreement and must comply with UK GDPR.

Processor	Purpose	Where data is processed
Stripe Payments UK Ltd	Card payment processing	UK / EEA / USA
SMTP2GO	Transactional email delivery (booking confirmations, password resets, etc.)	UK / USA
ActiveCampaign LLC	Marketing automation (only when you have opted in)	USA
Cloudflare, Inc.	Content delivery network, DDoS / bot protection, web application firewall	Global edge network
Anthropic, PBC	AI-assisted parsing of intake form documents (e.g. extracting structured data from uploaded certificates) so the admin team can verify them faster; and powering the optional “Nudge” booking helper that visitors can use to find a counsellor. Chat transcripts are retained for 30 days for service-improvement and safety review.	USA
Krystal Hosting Ltd	Web and database hosting	UK

Each sub-processor is bound by contract to act only on our instructions, to apply appropriate technical and organisational measures, and to assist us in meeting our UK GDPR obligations to you.

6. International Data Transfers

Some of our sub-processors are based outside the UK. Where personal data leaves the UK, we ensure appropriate safeguards are in place under UK GDPR Articles 44 to 49.

Sub-processor	Country	Safeguard relied on
Anthropic, PBC	USA	UK extension to the EU–US Data Privacy Framework (the “UK–US Data Bridge”); Standard Contractual Clauses + UK Addendum where the framework does not apply.
ActiveCampaign LLC	USA	UK extension to the EU–US Data Privacy Framework; Standard Contractual Clauses + UK Addendum.
SMTP2GO	USA / NZ	Standard Contractual Clauses + UK Addendum; technical encryption in transit and at rest.
Stripe Payments UK Ltd	UK / EEA / USA	Stripe maintains the relevant adequacy and SCC arrangements as the controller of payment data.
Cloudflare, Inc.	Global	Standard Contractual Clauses + UK Addendum; data is generally served from the nearest edge node.

You can request a copy of the safeguard mechanism in place for any specific transfer by contacting us at help@paconline.co.uk.

7. Data Retention

We keep your personal data only for as long as necessary to fulfil the purposes for which it was collected.

Typically:

• User accounts: retained while active and deleted 12 months after inactivity.
• Counsellor data: retained for the duration of registration plus 6 years for accounting / legal purposes.
• Financial records: kept for 6 years to meet HMRC obligations.

After these periods, your data will be securely deleted or anonymised.

8. Your Rights

Under the UK GDPR, you have the following rights:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure (“Right to be Forgotten”): request deletion of your personal data (subject to legal requirements).
• Restriction: request limits on how we process your data.
• Portability: request your data in a structured, machine-readable format.
• Objection: object to certain types of processing (e.g. marketing).
• Withdraw Consent: withdraw consent where processing is based on consent.

To exercise these rights, contact us at help@paconline.co.uk.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at https://ico.org.uk/.

9. Data Security

We implement robust security measures to protect your data, including:

• Encryption of data in transit and at rest.
• Secure servers located in the UK or EEA.
• Access control and authentication for authorised staff only.
• Regular data protection training and security audits.

However, no system is entirely secure, and we cannot guarantee absolute security.

10. Communications and Marketing

• We may send you service-related emails (e.g. booking confirmations, updates).
• With your consent, we may send marketing communications about our services.
• You can unsubscribe from marketing emails at any time by clicking “unsubscribe” in the email or contacting us directly.

11. Cookies

Our website uses cookies to:

• Enable basic platform functions.
• Improve performance and user experience.
• Analyse traffic through analytics tools (e.g. Google Analytics).

You can manage or disable cookies via your browser settings.

For full details, please see our Cookie Policy.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our operations or legal requirements.

The most recent version will always be available on our website, and we will notify you of any significant updates.

12a. Data Protection Officer

UK GDPR Article 37 requires a Data Protection Officer (DPO) where the controller's core activities consist of large-scale processing of special category data. We are reviewing whether the scale of our current processing crosses that threshold and will appoint a DPO if and when it does.

In the meantime, all data-protection enquiries can be addressed to the Privacy Lead at help@paconline.co.uk, who will route them to the appropriate person within PAConline Ltd.

13. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact:

Email: help@paconline.co.uk
By post: 3 Barnfield Crescent, Exeter, Devon EX1 1QT, UK