Privacy Notice

This Privacy Notice explains how The Emotional Health Hub (“we”, “us”, “our”) collects and uses personal data when people engage with our digital services, including during home use, school or organisational use, and professional practice.

​

We are committed to protecting personal data and handling it responsibly, transparently, and in line with UK data protection law.

​

Who we are

Organisation: The Emotional Health Hub
ICO registration number: ZB625390

​

Our role depends on context:

• Data controller for home / family use

• Data processor when providing services on behalf of schools or other organisations (who act as data controllers)

 

Contact:
If you have any questions about this Privacy Notice or how personal data is used, please contact:
admin@theemotionalhealthhub.com

​

Who this notice applies to

This notice applies to:

• Children and young people using our digital tools

• Parents or carers who create or manage home accounts

• School staff and administrators

• Other professionals (such as therapists or social workers) who access services as part of their role

 

Children do not provide consent directly. Personal data relating to children is managed by responsible adults or organisations in line with the law.

​

What personal data we collect

Depending on how our services are used, we may collect the following types of personal data:

​

Child data

• Name

• Date of birth, age, year group

• Structured wellbeing check-in responses (using fixed options such as slider scales)

• Usage data (for example, timestamps and frequency of use)

​

School use only

• Gender

• SEND status

• Free School Meal (FSM) eligibility

• Pupil Premium status

​

Adult account data

• Parent/carer, staff, or professional name

• Email address and contact details

​

Technical data

• Device and system information required for the platform to function securely

 

We do not collect:

• Free-text responses from children

• Chat or messaging content

• Diagnostic or clinical information

​

How we collect personal data

Personal data is collected:

• When a parent or carer creates an account for home use

• When a school or organisation uploads pupil and staff information (for example via secure CSV upload)

• When professionals create and manage accounts for children they support

• Through children’s use of structured wellbeing check-ins within the platform

 

Children do not enter personal information freely or communicate with other users.

​

How we use personal data

We use personal data to:

• Create and manage user accounts

• Provide access to age-appropriate digital content

• Record and display structured wellbeing check-ins

• Support parents, schools, and professionals to view engagement and trends over time

• Improve the reliability and performance of our services

 

Our services do not diagnose mental health conditions and do not involve automated decision-making that produces legal or similarly significant effects.

​

Lawful basis for processing

The lawful basis for processing depends on how the service is used:

​

Home / family use

Processing is based on consent provided by the parent or carer on behalf of the child. Parents/carers can withdraw consent at any time; doing so may mean we can no longer provide access to the account or service features that rely on that data.

​

School or organisational use

Processing is carried out under the organisation’s public task or legitimate interests, with the organisation acting as data controller. In these contexts, The Emotional Health Hub acts as a data processor on behalf of the organisation.

​

Who personal data is shared with

Personal data is not shared for marketing or advertising purposes.

Data is shared only:

• With authorised users (for example, parents accessing their child’s data, or school staff accessing data for pupils they are responsible for)

• With our secure third-party database provider, Knack, which stores data on our behalf under appropriate safeguards

 

Personal data is never visible to other children and is not shared with the general public.

​

Where personal data is stored

Personal data is stored using a secure, cloud-based database provider.

Data may be stored or processed on servers located outside the UK, in accordance with UK GDPR requirements and appropriate safeguards.

​

How long we keep personal data

Personal data is retained for up to 12 months from the last active use of the platform, unless:

• deletion is requested earlier, or

• a longer retention period is required by law

 

At the end of the retention period, data is securely deleted.

​

Your data protection rights

Depending on the context, individuals have rights under UK data protection law, including the right to:

• Access personal data

• Correct inaccurate data

• Request deletion of personal data

• Object to or restrict certain processing

 

Where data is processed on behalf of a school or organisation, requests should usually be made via that organisation as the data controller. We support organisations in responding to such requests in line with agreed roles and responsibilities.

​

You also have the right to make a complaint to the Information Commissioner’s Office (ICO). We would appreciate the opportunity to address your concerns first, so please contact us in the first instance.

​

If you do not provide personal data

Where certain personal data is needed to create or manage an account (for example, basic account details or child profile information), we may not be able to provide access to the service if that information is not provided.

​

Cookies and analytics

We may use cookies and similar technologies on our website to help it function properly and to understand how it is used. Where optional cookies (such as analytics) are used, you will be given choices about these through a cookie banner or settings. Any details about cookies used and how to manage preferences will be provided at the point of collection and/or through a Cookie Notice (where applicable).

​

Safeguarding and children’s data

We take children’s privacy seriously. Our services are designed to minimise risk by:

• Limiting data collection to what is necessary

• Preventing child-to-child communication or data visibility

• Using structured responses rather than free-text input

• Ensuring adult oversight in all contexts

 

Further safeguarding and information governance documentation is available to schools, partners, and funders on request.

​

Changes to this notice

We may update this Privacy Notice from time to time. The most recent version will always be available on our website. Historic versions are available on request.