Privacy & Data Protection
Your mental health information is highly personal. We collect only the information we need, restrict who can access it, and aim to give you meaningful control over how long we keep it.
This notice explains how mhai collects, uses, stores and protects your personal information.
Who is responsible for your information?
For data protection purposes, the data controller is:
J D Worsley DM Limited
29 Nottingham Road
Keyworth
Nottingham
J D Worsley DM Limited currently operates the mhai service.
What information might we collect?
Depending on how you use mhai, we may receive information including:
- your contact and registration information;
- AI conversations, summaries or reports that you choose to provide;
- information about your mental health, experiences, symptoms, concerns or previous treatment;
- answers to questions asked as part of an mhai review;
- reports or recommendations produced for you;
- communications between you and mhai; and
- administrative information needed to provide the service.
Mental health information is classed as special category personal data under UK data protection law and we treat it accordingly.
We aim to collect as little identifying information as possible
Where practical, mental health reports and AI-generated material are identified using a reference or client ID rather than your name.
This is called pseudonymisation. It reduces the amount of identifying information contained within working records, although pseudonymised information may still be personal data under UK GDPR.
We may also ask you to remove unnecessary identifying information about yourself or other people before providing material to us.
Why do we use your information?
We use information you provide to deliver the mhai service. This may include:
- organising and reviewing information you have already discussed with AI;
- identifying relevant gaps or questions;
- preparing information for human professional review;
- helping a suitably qualified professional understand your circumstances;
- preparing reports, guidance or recommendations;
- communicating with you about the service;
- maintaining appropriate records; and
- protecting the safety, security and integrity of the service.
mhai is specifically being designed so that useful information you have already gathered does not need to be repeatedly collected from you. This use of existing AI history is central to the service model. :contentReference[oaicite:1]{index=1}
Our legal basis for processing
Where you ask us to provide a service, we may process ordinary personal information because it is necessary to provide that service or to take steps at your request before providing it.
Because information about mental health is special category data, we also require an additional legal condition for processing it. During the initial mhai service we intend to obtain your explicit consent to process the mental health information that you choose to provide.
You can withdraw that consent. Withdrawal does not make previous lawful processing unlawful, but it may mean that we can no longer provide some or all of the service.
How we use AI
AI may be used as an assistive tool to organise, summarise, structure or analyse information that you provide.
AI does not replace human professional judgement within the mhai review process. Where AI is used to assist with analysis, appropriate human review remains an important part of the service.
We will aim to use AI providers and technical services under appropriate contractual and data-protection arrangements. We will also seek to minimise the personal information supplied to an AI system wherever practical.
Where is your information stored?
During the initial mhai service, information may first pass through our secure website and form systems.
Reports containing mental health information are then transferred to restricted-access, encrypted cloud storage within our business Google Workspace environment. Temporary copies held within the website upload system are deleted after they have been securely transferred and checked.
Access is restricted to people who genuinely need the information to provide or administer the service.
Who can see your information?
Your information may be accessed by authorised mhai personnel and, where appropriate, a psychotherapist, clinician or other professional involved in reviewing or delivering your service.
We may also use carefully selected technology providers that process information on our behalf, for example secure hosting, cloud storage or AI services.
We do not sell your personal or mental health information.
How long do we keep your information?
We do not want to retain sensitive information indefinitely simply because it might be useful one day.
Our current policy is that identifiable or pseudonymised client mental health records will normally be deleted if there has been no contact or activity relating to your mhai service for 12 months, unless there is a legitimate reason why we are required to retain them for longer.
You may also ask us to delete information earlier, subject to any legal, regulatory or professional record-keeping obligations that apply.
If you want mhai to retain your information so that you can return to it later, we may provide that option and explain the applicable retention arrangements to you.
Your rights
Depending on the circumstances, UK data protection law gives you rights including the right to:
- ask what personal information we hold about you;
- receive a copy of your personal information;
- ask us to correct inaccurate information;
- ask us to delete information;
- ask us to restrict particular uses of your information;
- object to certain processing;
- withdraw consent where we rely upon consent; and
- request transfer of certain information where the right to data portability applies.
Not every right applies in every situation, but we will explain our response if you make a request.
Sharing information
We will not normally disclose your mental health information to another person or organisation without an appropriate reason for doing so.
There may be exceptional circumstances in which information has to be disclosed because of a legal obligation, safeguarding concern or serious risk. Where appropriate and lawful, we will try to discuss this with you.
Research and pilot participants
If you participate in an mhai research study or pilot through a research platform such as Prolific, additional information about how your study data is handled may be provided as part of that particular study.
The arrangements applying to research participants may therefore differ from those applying to paying mhai clients.
Security
We use a combination of technical and organisational measures designed to protect personal information. These include restricted access, pseudonymisation where practical, secure transmission, encrypted cloud storage, authentication controls and deletion of temporary copies when they are no longer required.
No online service can guarantee absolute security. We therefore keep our security arrangements under review as mhai develops.
Questions or data requests
If you have a question about your information, want a copy of it, want something corrected or would like us to delete it, please contact:
Jonathan Worsley
J D Worsley DM Limited
29 Nottingham Road
Keyworth
Nottingham
Email: info@jwdm.co.uk
Complaints
If you have concerns about how we handle your information, please contact us first so that we can try to resolve them.
You also have the right to raise a concern with the UK Information Commissioner’s Office (ICO).
Last updated: September 2026