Privacy Policy

Who we are

Awaken Plus Health Ltd ("Awaken+", "we") runs this website and the Awaken+ app. We decide how your personal data is used, so we are its controller. We are registered in England and Wales, company no. 16840331. Our registered office is International House, 6 South Molton Street, London, United Kingdom, W1K 5QF. You can contact us about this policy or your data at contact@awakenplus.com.

What we collect

• Account details: your name, email address and password (stored in scrambled form). If you sign in with a third-party account, that provider gives us your name, email address and account ID. If you are a clinician, we also record your specialty.
• Contact and profile details: phone number, country and time zone, address, date of birth, sex, title, preferred pronoun, marital status, occupation, NHS or hospital number, and how you prefer us to contact you.
• People involved in your care: trusted persons and other contacts, such as your GP, with their name, relationship and contact details.
• Health information: symptoms, medical history, allergies, height and weight, questionnaire answers, sleep diary entries, referrals, consultation notes, investigations and results, diagnoses, treatment plans and outcomes, and documents you or your clinicians upload. If your clinician uploads an audio recording of a consultation, we store that too.
• Health data from your phone (app only): if you give the Awaken+ app permission, it reads sleep sessions, blood oxygen, heart rate, heart rate variability and breathing rate from your phone's health data store and sends them to us.
• Appointments and messages: your bookings and the messages and attachments you exchange with your care team.
• Payments: if you pay online, the amount, invoice and payment reference. Your card details go straight to our payment provider. We never see or store them.
• Signed documents: forms you sign electronically and their signing status.
• Technical data: your IP address, which we use to block too many requests from one source, your sign-in sessions and, in the app, a token that lets us send notifications to your device. We also keep a log of who viewed or changed your record and when.

How we use it and our lawful basis

• To create and run your account, book and manage appointments, and provide your care, including sharing information within your care team. Lawful basis: performing our contract with you.
• To send you emails and app notifications about your account, appointments, questionnaires and payments. Lawful basis: performing our contract with you.
• To take payments and keep financial records. Lawful basis: performing our contract with you, and our legal obligation to keep accounting records.
• To keep medical and other records for as long as the law requires. Lawful basis: legal obligation.
• To keep the website and app secure, prevent misuse and keep a record of who accessed your data. Lawful basis: our legitimate interest in keeping patient data safe.
• To reply when you contact us. Lawful basis: our legitimate interest in answering your enquiry, or our contract with you if it is about your care.

Health information is special category data. We use it because it is needed for medical diagnosis and for providing health care and treatment, by or under the responsibility of health professionals who owe you a duty of confidentiality. This is the condition in Article 9(2)(h) of the UK GDPR, together with Schedule 1, paragraph 2 of the Data Protection Act 2018.

Who we share it with

• The Awaken+ clinicians and staff involved in your care, and other health care providers when your care team refers you to them. We tell your GP only if you agree.
• Service providers who process data for us under contract:
  • website and server hosting
  • document, file and image storage
  • database hosting
  • payment processing
  • electronic signatures
  • email delivery
  • request rate-limiting, which checks IP addresses to block too many requests
  • app notifications and app updates
  • your third-party sign-in provider, if you choose to sign in that way
  • font hosting: our website loads fonts from a third-party font provider, which receives your IP address when you visit
• Regulators, courts or the police, where the law requires us to.

We do not sell your data.

Transfers outside the UK

Some of these providers are based outside the UK, for example in the United States or the European Union. When your data leaves the UK, we rely on UK adequacy regulations or on the other safeguards that UK data protection law requires. Contact us if you would like more detail.

How long we keep it

• Account and contact details: while your account is open, then only as long as we need them for the records below.
• Health records: for the periods that the law and professional guidance on medical records require.
• Payment records: for as long as tax and accounting law requires.
• IP addresses used to block too many requests: a few seconds.
• Sign-in sessions: until you sign out or the session expires.

Your rights

You have the right to ask for a copy of your data, and to ask us to correct it, delete it, restrict how we use it, or give it to you or another organisation in a portable format. You can also object to how we use it. Some rights have limits. For example, we may have to keep health records even if you ask us to delete them.

Where we rely on your consent, you can withdraw it at any time. You can stop the app reading health data from your phone in your phone's settings.

To use any of these rights, email contact@awakenplus.com.

If you are unhappy with how we use your data, please contact us first. You can also complain to the UK regulator, the Information Commission (ICO), at ico.org.uk.

Do you have to give us your data?

To create an account you must give your name, email address and a password, or sign in with a third-party account. To finish setting up your account you must also give a contact number and your location. Your care team needs accurate health information to treat you safely. Without this information we cannot create your account, book your appointments or provide your care. Sharing health data from your phone is optional.

Automated decisions

We do not make decisions about you by automated means alone. Your clinicians make the decisions about your care.

Changes to this policy

If we change how we use your data, we will update this page and the date at the top.