Privacy Policy
Privacy Notice and Cookie Policy for iCT-SAD, iCT-PTSD, and OSCA
Summary version
This summary takes a minute to read and helps you to quickly understand the main points of the privacy notice. It does not replace the full notice, which explains your legal rights.
We’re Koa Health
Koa Health provides digital therapy tools to healthcare organisations, including NHS Talking Therapies services. These tools include iCT-SAD for Social Anxiety Disorder, iCT-PTSD for Post Traumatic Stress Disorder, and OSCA for Social Anxiety Cognitive Therapy for Adolescents, and are collectively called “Digital Therapy Tools” in this document. These organisations give us permission to use some of your personal data so that you can get the benefits of digital therapy.
We only collect the data we need
To run the tools so that it helps you better manage your mental health challenges.
We don’t see your medical record
To connect us to your clinical team, we don’t see your Medical Record Number.
We share some data with your clinical team
This is so that they can monitor your care.
We don’t keep your data for longer than we need it
Once your clinical team finishes with the digital therapy tools, we return the data to your clinical team and we erase your data.
Your data’s safe with us
We work to the highest industry standards to protect your data from being lost, stolen or misused.
Privacy Notice of the Digital Therapy Tools
Full notice[total reading time 6 mins]
This Privacy Notice applies to any collection and/or processing of personal data (hereinafter “Personal Data”) performed as a result of your use of the Digital Therapy Tools apps (the “App”). All the data collected by the App will not be shared or processed for any other reason than outlined in the notice.
Note that this App collects and processes sensitive personal information that is health-related (hereinafter “Sensitive Data”). If you do not agree with this notice, please talk with your clinician.
Index
1. Who collects, controls and processes your personal data?
2. Why do we collect personal data about you and what do we do with it?
Providing you with internet Cognitive Therapy
Improving the clinical effectiveness of the treatment
Account management and Technical support
Helping you to deliver the treatment to your patients
3. What personal data do we collect about you and how?
4. Do we share personal data about you with others?
5. How long do we keep your data?
6. What rights do you have related to your data and how can you use them?
7. How do we keep your data safe?
8. Changes to this Privacy Notice
2. Why do we use cookies and other tracking technologies?
4. How can I deactivate cookies?
1.Who collects, controls and processes your personal data?
The Data Controller for all data collected or processed is your NHS Trust. As part of proposing treatment using the Digital Therapy Tools, your clinical team will have provided you with information about the treatment. In cases where there is contradiction between this document and information you receive from the Trust, information from the Trust and your clinician takes precedence.
Koa Health Digital Solutions Ltd. (hereinafter “Koa”), a company registered in the United Kingdom (registered number 13298286) with registered address at 55 Baker Street, London, United Kingdom W1U 7EU is the Data Processor of the Trust and the operator of the Digital Therapy Tools.
For any privacy-related matter, you can contact Koa at privacy@koahealth.com. The Data Protection Officer for Koa may be contacted at dpo@koahealth.com.
2.Why do we collect personal data about you and what do we do with it?
Providing you with internet Cognitive Therapy
The Digital Therapy Tools help your clinical team provide you with treatment for Social Anxiety Disorder or Post Traumatic Stress Disorder, and deliver all of the key components of Cognitive Therapy using the iCT method.
The tools take the form of applications accessed via the web or mobile devices. These tools guide you through resources, modules and exercises which your therapist has identified as relevant for your case. The information gathered in the tool feeds into the therapist view, which allows the therapist to see patient progress, evaluate needs and assign new modules and exercises.
You may receive emails and SMS messages from the applications as part of the login process, and as notifications that you have new messages from your therapist in the application. This communication is part of the core app functionality in that it is part of the coordination of your treatment.
Improving the clinical effectiveness of the treatment
We process personal data to evaluate the clinical effectiveness of the treatment. This involves reviewing if patients are improving or getting worse. In cases where patients or groups of patients do not respond to the treatment, we seek to identify new exercises or content that are useful to those patients. Reports about these outcomes for patients and groups of patients are provided to the clinical team so they can manage clinical effectiveness for their departments. When improvements are identified, this is factored back into the app as new exercises or other content/functionality so that more patients get better outcomes.
To improve clinical effectiveness in this way, clinical psychologists and scientists consider information such as age, gender, ethnicity, outcome metrics, communication with therapists, how often and for how long patients use the Digital Therapy Tools. The clinical analysis is conducted using pseudo-anonymous data. In cases where the improvement may benefit the clinical psychology scientific community, anonymous data will be used for academic research.
Account management and Technical support
In order to access the Digital Therapy Tools you will use your email address as your username, and a mobile phone number which may be used for two-factor authentication codes.
In the event of difficulties to login or otherwise access the application you may, via the web page, contact the technical support desk who will assist you only with technical issues. Clinical queries should only be directed to your clinical teams.
Helping you to deliver the treatment to your patients
The Digital Therapy Tools help you deliver therapy to your patients, collecting their information and therapy progress through the modules. The Digital Therapy Tools also store communications and recording sessions with your patients. All collected data is only visible to you and your clinic.
3.What personal data do we collect about you and how?
The functionalities of the Digital Therapy Tools require the collection and processing of personal data. We collect and process the minimum data necessary for each of the different purposes, and we will only keep it for as long as we provide you with a service. Should the purposes of the data collected change, we will inform you beforehand and ask for your consent again where applicable, before we process any data.
When your clinical team provides you an account in the Digital Therapy Tools, some information is collected about you including your name, your NHS Number, some contact information including your email address and telephone number, and some demographic information including your date of birth, gender, ethnicity, and education level.
We also collect your activity in the Digital Therapy Tools, including your responses to clinical questionnaires, your responses to exercises, your experience with behavioural experiments, and the description of your cognitive model which you update over time. Some of the exercises involve video with simulated backgrounds designed to allow you more easily imagine yourself in the situation related to the exercise. The Digital Therapy Tools summarise information you enter into standard scores which your clinical team uses to identify your treatment needs.
If you are a therapist or supervisor, we collect your email, first name and last name.
4.Do we share personal data about you with others?
We only share data as needed and always minimally in order to provide the service. For example, we use industry-leading companies to provide data center services on which the services run. This is the type of data sharing that we do: specific activities such as hosting, providing customer support, or notifications via email or SMS. We only share the minimum information and authorize our service providers to process your information following our instructions. We make sure that our service providers erase all your personal information right after their services are finished.
The data collected is stored based on your location: if you are in the UK or EU, your data on using Digital Therapy Tools will be hosted on Amazon Web Services (AWS) servers in the UK. If you are in the US, your data is stored on AWS servers located in the US.
The data you share with the Technical support desk, for example, a query when you cannot log in, is managed in the EU data centre.
Some of our service providers that provide technical support may transfer some non-clinical, non-personal, non-sensitive data outside your region. We take appropriate measures to ensure that our providers comply with applicable local laws in all data processing activities. This includes requiring suitable safeguards, such as Standard Contractual Clauses, or conducting thorough vendor assessments.
Internal team members shall process your personal data only for the purposes established in this Privacy Notice, following professional responsibilities and contractual obligations. We take appropriate measures to guarantee our employees’ fair and confidential use of all personal data.
Your data is never shared with third parties who might abuse it or exploit it commercially. The only purpose of the Digital Therapy Tools is to support you and your clinical team in the treatment program.
5.How long do we keep your data?
We may retain your data for different periods of time, depending on the type of data involved and the purposes of the processing, but generally, following these criteria:
Depending on your therapist’s data retention policies, we may need to store your information to comply with local data retention laws they are obligated to follow. We will delete your data upon instruction from the Data Controller or if you request your therapist to delete your data.
6.What rights do you have related to your data and how can you use them?
The data protection laws give you a series of rights regarding the personal information that we manage about you. Specifically, the rights of access, rectification, erasure, limitation, objection, portability, as well as not being subject to automated decisions, and the right to remove your consent at any time.
The best way to exercise these rights is via the Trust, who is the Data Controller, and you will have provided you with information on how to do this. If you do make this request to Koa Health, we will pass the request onto the Trust for treatment. The privacy team at Koa Health may be contacted at privacy@koahealth.com.
If possible, please use the same email address that you use within the Digital Therapy Tools and identify the right you want to request. In the event that you decide to exercise one of these rights through a representative, it will be necessary to provide with the request, the documentation that proves this condition.
7.How do we keep your data safe?
We are responsible for ensuring the security, integrity and confidentiality of your personal information. Therefore, as part of our commitment and in compliance with current legislation, we have adopted the most demanding and robust security measures and technical means to prevent their loss, misuse or access without your authorization. We protect all communications between the Digital Therapy Tools and the servers in line with best practice by using TLS for encryption and server authentication. We use ISO 27001 certified systems in order to protect your registration information including email and password. We store your personal data in an encrypted database. Also, we promise to act quickly and responsibly in the event that the security of your data may be in danger, and to inform you if necessary.
8.Changes to this Privacy Notice
We may modify this Privacy Notice from time to time and will post any revisions on our Digital Therapy Tools. We will indicate at the bottom of the Privacy Notice the Effective Date of the most recent update. If an update requires additional notice to you or your consent, we will contact you to provide that notice or seek that consent.
__
Effective From: June 2025
iCT and OSCA Cookies Policy
1. What are cookies?
Cookies are small data files that are placed on your computer or mobile device when you visit a website or use an App. Cookies are widely used by online service providers in order to (for example) make services work, or to work more efficiently, as well as to provide reporting information. Cookies set by the Data Controller are called “first party cookies”. Cookies set by parties other than the Data Controller are called “third party cookies”. Third party cookies enable third party features or functionality to be provided on through the web you are browsing (such as advertising, interactive content and analytics). The third parties that set these third-party cookies can recognize your computer both when it visits the website or service in question and also when it visits certain other websites or services.
2. Why do we use cookies and other tracking technologies?
We use first and third party cookies for several reasons. These cookies enable us and the third parties we work with to track and target the activity of our users. For example, we use cookies for analytics, configuration, marketing and other purposes. Every cookie we use is described in more detail below.
3. Which cookies do we use?
Essential cookies: This website currently only uses strictly necessary cookies related to your logging to the platform.
| name | Description |
|---|---|
| csrftoken | A CSRF (Cross-Site Request Forgery) token is a security measure that prevents unauthorized or malicious requests. |
| sessionid | ID of your active session |
Analytics cookies: We do not use analytics cookies.
Tracking cookies: We do not use tracking cookies.
4. How can I deactivate cookies?
Since we are only using cookies we need to make the platform work, we do not provide a way to deactivate them, in accordance with privacy regulations.
Effective From: June 2025