1. Introduction
Psychology Me Ltd ("Psychology.me", "we", "us", or "our") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share your information when you use our website at psychology.me and related services (the "Service").
Psychology Me Ltd is registered in the United Kingdom (London). For data protection purposes, we are the data controller. Our legal basis for processing personal data is your explicit consent, the performance of a contract, and our legitimate business interests.
2. Data We Collect
2.1 Information You Provide
- Email address - used for account creation (magic link authentication), report delivery, and transactional communications.
- Assessment responses - your answers to assessment questions, which constitute special-category data under GDPR (data concerning health or psychological characteristics).
- Payment information - processed securely by Stripe. We do not store credit card numbers on our servers.
- Report feedback - if you choose to use the optional "Was this report helpful?" widget on a report, we store your rating and any free-text comment you submit, linked to that report, so we can improve the quality of our reports. Providing feedback is entirely voluntary.
2.2 Information Collected Automatically
- Usage data - pages visited, assessment completion events, referral sources, and general interaction patterns. We record some of this on our own first-party servers; additional product-analytics events are collected only after you accept non-essential cookies (see Sections 5 and 8).
- Technical data - IP address, browser type, device type, and operating system for performance and security purposes.
- Cookies and similar technologies - essential cookies for authentication session management, plus consent-gated product-analytics storage. We do not use advertising or social-media tracking cookies. See Section 8 for details.
3. Special-Category Data (Psychological Assessment Responses)
Your assessment responses may reveal information about your psychological characteristics. Under GDPR, this is classified as special-category data. We process this data solely on the basis of your explicit consent, which you provide when you begin an assessment.
You may withdraw your consent at any time by requesting deletion of your data (see Section 6). Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.
Some tests, such as the PHQ-9, include questions about very low mood or self-harm. If your answers suggest you may need support now, your results page shows ways to get help straight away. This is automatic: nobody at psychology.me is alerted, and we do not contact you.
4. How We Use Your Data
- Delivering your assessment results, scores, and reports.
- Processing payments and fulfilling your purchase of detailed reports or credits.
- Sending transactional emails (report delivery, magic link authentication, purchase confirmations).
- Improving the accuracy and quality of our assessments and service.
- Aggregated, anonymised statistical research to maintain the quality of our assessments (no individual identification).
- Complying with legal obligations, including responding to lawful data subject requests.
- Scoring the written answer in the Generative AI Competence Assessment for the organisation or practitioner that invited you (see Section 9).
We do not sell, rent, or share your personal data with third parties for marketing purposes.
4a. Research and Norm Development
Controller. Psychology Me Ltd (trading as psychology.me), company number 16691896, registered in England and Wales, 2 Frederick Street, Kings Cross, London WC1X 0ND. Contact: privacy@psychology.me.
What we use. Your answers, your scores, your age band, sex and country of residence, and, if you give them, your education and occupation. Age band, sex and country are required because norms are built and compared by these groups. Answers can reveal psychological characteristics, which data protection law treats as special category data.
Why. To give you your results and report, and for research: building and updating norms (the comparison tables that show how a score compares with other people's) and developing and validating tests. Psychology Me Ltd may license or sell the resulting norms, tests and findings. They contain only aggregate statistics, never your individual answers or anything that identifies you.
How. For research we separate your answers from your name, email address and account, and keep the link only to honour your rights.
Legal basis and withdrawal. Your explicit consent, given before the test (UK GDPR Articles 6(1)(a) and 9(2)(a)). You can withdraw it at any time by writing to privacy@psychology.me, and we then delete your answers and stop using them in any norm or study built afterwards. Norms and findings already published from many people's data are not recalculated; they contain nothing that identifies you.
Where. Servers in Amsterdam, the Netherlands, run by our hosting provider under a data processing agreement. Transfers from the UK to the European Economic Area are covered by the UK adequacy regulations.
How long. As long as any norm or test built from your answers is in use; then deleted or fully anonymised.
Age and rights. 16 or over. Your rights in Section 6 apply in full, and you can complain to the UK Information Commissioner's Office at ico.org.uk.
4b. Talk to a psychologist
What we collect. The option you order, your question, the tests you choose to share, the language of the site you order from, your confirmation that you are 18 or over, the order's status and dates, the session's status, the written note the psychologist prepares, and the psychologist's referral if one is written. Payment is handled as described in section 5.
Who sees it. Only the psychologist handling your order (at launch, Dr. Milos Kankaras). The psychologist sees your email address, your question, and the results and reports of the tests you chose to share. The psychologist sees nothing from your other tests.
Legal basis. Providing the service you ordered (performance of a contract). Your results can reveal psychological characteristics, so we share them with the psychologist only with your explicit consent, which you give at the order by ticking the box (UK GDPR Article 9(2)(a)).
What we do not do. We do not use your question or the note for research or norm development, we do not send them to any AI service, and we do not share them outside Psychology Me Ltd. We do not record sessions.
Booking. Sessions are booked on a scheduling page that a booking service runs for us. It receives the name, email address and time you enter there, so that the session can be scheduled.
How long. Your question and the note are kept while your account exists, so you can read the note again. If you start a checkout and do not pay, your question is deleted a week later. Deleting your account deletes the order, your question and the note. The payment record is kept as described in section 7, unlinked from your account.
Your rights. Section 6 applies in full. Your data export includes your orders, questions and notes. Until the psychologist opens your order, you can withdraw your consent to share your results by cancelling the order, with a full refund.
Where. On our servers in Amsterdam, the Netherlands, as in section 4a.
5. Who Receives Your Data
We use the service providers below to run psychology.me. They process your data on our instructions, except Stripe, which also acts on its own account for payments. We do not sell, rent or share your personal data for anyone's marketing.
- Stripe - payments. You enter your card details directly with Stripe, which processes payments for us and on its own account; see Stripe's privacy policy. We send Stripe the product you are buying, our own internal reference numbers and, if you are signed in, your email address. We do not tell Stripe which test a report is for. We keep a transaction reference, the amount and the payment status, never your full card number.
- OpenAI - scoring the written answer in the Generative AI Competence Assessment, only when an organisation or practitioner invites you to take it (see Section 9). Only the text of your answer is sent; we do not send your name, email address or other identifying details. OpenAI processes this text as our service provider.
- PostHog (cloud analytics provider) - product analytics. Loaded only after you accept non-essential cookies. Collects usage events and page views (no advertising profiling, no session recording, and assessment answers are excluded from automatic capture). Data is sent to PostHog's EU cloud. See Section 8.
- Plausible (privacy-preserving page-view analytics) is loaded for all visitors. It is cookieless, stores no identifiers on your device, and collects no personal data, so under UK PECR / ePrivacy it does not require consent. It provides aggregate page-view and outbound-link trends only.
- DigitalOcean - hosting. Our servers, database, file storage and backups are in Amsterdam, the Netherlands.
- Resend - sending our emails (sign-in links, report links, order and practitioner emails). Resend receives your email address and the email itself. Our emails do not name the test you took.
- Calendly and Zoom (Talk to a psychologist only) - you book your session on a Calendly scheduling page, which receives the name, email address and time you enter there, and the session takes place on Zoom.
- Cloudflare - network security and delivery. Every request to psychology.me passes through Cloudflare, which protects the site from attacks and delivers it quickly, so it handles that traffic, including what you send us, on its way to our servers.
- Sentry - error monitoring. When something breaks, Sentry receives a technical report: the page address, without its query string and with reference numbers and test names replaced by placeholders, the browser type and the error. No cookies, form contents or test answers are sent.
- Grafana Cloud - storing our server logs for a limited time so we can find faults. Logs record technical events, such as which test was used and your IP address; internal reference numbers, and the codes of clinical and wellbeing tests, are in coded form.
If an organisation or practitioner invited you. When an organisation or practitioner invites you to take a test, they decide why your results are collected and how they are used, and we process your data for them. Their privacy notice applies to that data, and requests about it are best sent to them; we will help them answer.
Our servers are in the European Economic Area. Some providers (Cloudflare, Stripe, Resend, OpenAI, Sentry, Calendly and Zoom) may process data in the United States or elsewhere outside the UK. Where they do, the transfer is covered by the safeguards UK law requires, such as the UK International Data Transfer Agreement or Addendum, or UK adequacy regulations.
6. Your Rights Under GDPR
As a data subject, you have the following rights:
- Right of access - request a copy of your personal data.
- Right to rectification - request correction of inaccurate data.
- Right to erasure ("right to be forgotten") - request deletion of your personal data and assessment records.
- Right to data portability - receive your data in a structured, machine-readable format (JSON export).
- Right to restrict processing - request that we limit how we use your data.
- Right to object - object to processing based on legitimate interests.
- Right to withdraw consent - withdraw consent for processing of special-category data at any time.
To exercise any of these rights, email us at privacy@psychology.me or use the data export and deletion options in your account dashboard. The self-service export returns your data in a structured, machine-readable JSON file and is available up to once per 24 hours; deletion permanently removes your account and associated records. We will respond to requests made by email within one month, which the law allows us to extend by two further months for complex requests.
7. Data Retention & Security
Retention
We keep personal data only as long as we need it, then delete it or remove what links it to you. The periods below are the longest we keep each kind of record.
- Your account, test answers, results and reports - while your account exists.
- Answers used for research and norm development are kept as described in section 4a.
- IP addresses and browser details recorded with a test, a sign-in link or a short assessment - 30 days.
- Our own usage records (first-party analytics events) - 13 months.
- Records of the emails we sent you - 12 months.
- Payment notifications from Stripe - 90 days after we handle them.
- Technical records of how a report was put together - 90 days.
- Records of your data-protection requests - 3 years, so we can show that we answered them. A deletion request that we could not complete is kept until we have completed it.
- Stored copies of report PDFs - 180 days. A PDF is produced again from your results whenever you open it.
- An account whose email address was never confirmed, and which has no purchase or order - deleted after 30 days without activity. Tests taken under it are kept without the email address.
- Your place on the waiting list for Talk to a psychologist - until we tell you the service is open, and at most 12 months.
- Payment records - 6 years after the end of the financial year in which you paid (our financial year ends on 30 September), for tax and accounting. After that, your account and contact details are removed from the record, but it stays connected to the test it paid for while that test is in your account. A paid credit you have not used yet stays linked to your account until you use it.
When you delete your account, your account, test answers, results, reports and other personal records are deleted from our live systems. A small number of operational records, such as first-party usage events, are kept with your account identifier, IP address and browser details removed, so they can no longer be linked to you, until the end of the period above. Payment records are kept as described above, without your account.
Our database backups also contain copies of this data. They are used only to recover from a fault and are deleted after 30 days, except the backup of the version currently running, which is kept until the next update.
Our service providers keep their own records, such as Stripe's payment records and email delivery logs, for the periods in their own terms.
Security Measures
- All traffic to and from psychology.me is encrypted (HTTPS).
- Access to the database is limited by role.
- Report and PDF links are signed and expire.
- Passwords, sign-in tokens and cookies are removed from error reports, and internal reference numbers are coded before logs leave our servers.
- We review our security and our software dependencies regularly.
9. AI Processing
Detailed reports (Standard and Plus) are produced following strict scientific procedures from your assessment results and validated interpretation content, with no AI involvement.
Scoring of the open task in the Generative AI Competence Assessment. When an organisation or practitioner invites you to take the Generative AI Competence Assessment, your written answer to its one open task is sent to OpenAI together with a fixed scoring rubric, and is scored automatically. Only the text of your answer is sent: we add no name, email address or other identifying details. We keep the resulting score and the rubric points it met, not OpenAI's reply. Open-task results are reported to the organisation as group figures and never per person, and human review of a score is available on request: write to privacy@psychology.me. We carry out this scoring on behalf of the organisation or practitioner that invited you.
If an organisation or practitioner invited you to the Generative AI Competence Assessment, the practitioner may record what followed it (for example, training assigned, with its date and a short detail), and that record is shown to the organisation in its report beside your name or reference.
10. Children's Privacy
The Service is not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected such data, please contact us at privacy@psychology.me and we will promptly delete it.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date. Continued use of the Service after changes constitutes acceptance of the revised policy.
12. Contact Us
If you have questions about this Privacy Policy or wish to exercise your data rights, contact us:
Psychology Me Ltd
Company number 16691896, registered in England and Wales. Registered office: 2 Frederick Street, Kings Cross, London WC1X 0ND.
Email: privacy@psychology.me
General: info@psychology.me
You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.