Skip to main content
Need immediate help?  WovenPath isn't an emergency service. Call 999  ·  Samaritans 116 123 (free, 24/7)  ·  text SHOUT to 85258  ·  Mind urgent help ↗
WovenPath

Privacy Policy

Last updated: 2026-11-12

Who we are

WovenPath ("we") operates this website and the WovenPath platform. WovenPath is a trading name of Healing Space Technologies Ltd, a company registered in England and Wales, company number 17564377, registered office 31 Aquavista Marina, Castle Marina Road, Nottingham NG7 1TN. For this website and for enquiries, WovenPath (Healing Space Technologies Ltd) decides how your information is used: it is the data controller (contact: [email protected]). In the pilot, each therapist is the controller of their own clients’ information in the platform, and WovenPath processes it on their behalf under a written agreement. Healing Space Technologies Ltd is registered with the Information Commissioner’s Office (ICO), registration number ZC295703. [The remaining legal details are added before the pilot starts.]

We are working toward the requirements of UK GDPR and the Data Protection Act 2018. A Data Protection Impact Assessment and independent information-governance review are in preparation and have not yet been completed — see the Trust Centre for our current assurance status.

What we collect, and why

If you only visit this website

  • Your email (your address and what you write) if you email us — to respond to you. Lawful basis: legitimate interests (responding to your enquiry).
  • Technical logs (IP address, request details), kept by Cloudflare, which hosts this website — for security and reliability. Lawful basis: legitimate interests (protecting the service).
  • No analytics, advertising or tracking scripts run on this site.

If you use the platform as a client in the pilot

  • Who decides. Your therapist is the controller of your information in the platform. They decide the lawful basis and how long it is kept, and give you full information before you join. WovenPath processes it for them under a written agreement.
  • Account details you provide when you join.
  • Health and wellbeing information you choose to record (the conversation, mood and sleep you choose to keep, notes and briefings) and information shared with your therapist. This is special-category data, which the law protects more strictly.
  • Structured items you confirm from a conversation. Where a conversation contains something you clearly stated — a mood rating, hours slept, or something you want to raise at your next session — the platform may offer to save it. The suggestion is validated against your own words by the application, nothing is saved until you confirm it, and a private record of that suggestion and your decision is kept on your side of the platform so there is an account of how the entry came to exist.
  • Risk and safety information. WovenPath does not monitor what you enter for risk and does not alert your clinical team or anyone else. If you talk about being in danger, it points you to real-world help such as 999 or Samaritans.
  • Audit records of accountable actions — so there is an answer to "who accessed what, when".

Who processes data on our behalf

  • Cloudflare — hosts this public website and keeps technical request logs for security.
  • Google Cloud — will host the application and its database in the EU (Belgium) when the application returns (it is offline while its hosting moves), and WovenPath’s own voice service for Talk, also in Belgium.
  • Amazon Web Services (Bedrock), in London — for the pilot, generates the reply in the conversation. For that it receives your message; the last few turns of the conversation, with when each of your messages was sent and today’s UK date and time; your first name; short excerpts from the context WovenPath remembers for you that relate to what you are talking about (which you can see and remove); the support priorities you have written and the topics you have asked it not to bring up; a health condition you have listed in About me, only when your message mentions it; and what your clinician wrote for you after your last session (and after earlier ones, when you are talking about your sessions), with your own notes on it. It also looks at your latest message on its own to identify things you might want to save. If what you write suggests you are going through something very hard, the application itself recognises the words, without a separate check by the AI, so that nothing is offered and the reply points you to help outside WovenPath. Phone numbers, email addresses, NHS numbers and postcodes you type are removed before anything is sent. Testing and demonstrations use made-up information only; when they use Groq, in the US, no real person’s information is involved. The application never adds your surname, date of birth, contact details, NHS number, address or account identifiers. Nothing you say is used to train any AI: Amazon Bedrock does not use it for training, and WovenPath does no training of its own.
  • Freeola — sends transactional email from WovenPath's own mailboxes (for example password resets, invitations and appointment reminders).
  • Upstash, in Ireland — protects sign-in and the application from repeated attempts (rate limiting). It receives IP addresses and counters only, never health information.

Your information in the platform stays in the UK and the EU: Google Cloud in Belgium, Amazon Web Services in London, Upstash in Ireland and Freeola in the UK. The application refuses to send client information to an AI service outside Europe.

We do not sell personal data to anyone — not advertisers, not insurers, not data brokers — and no part of our business model depends on doing so.

Voice

Where Talk is switched on, your device sends your voice to a speech service that WovenPath operates itself, hosted on Google Cloud in Belgium (EU). It turns what you said into text and returns only that text; audio is held in memory only, is discarded, and is never stored or logged. No outside speech provider is used, and your browser's own speech recognition is not used. The text is then handled exactly as if you had typed it. Like the rest of the application, Talk is not available to anyone until the pilot starts.

How long we keep data

Enquiries: up to 24 months after the last contact. Pilot accounts and records: for as long as your therapist decides, which they tell you before you join; you can ask us to delete your account and its data using the contact details below. Request logs on our servers: 30 days, never with what you write. The record of sign-ins, account changes and each time a therapist opens a client's records (never what anyone writes): kept with the account, and deleted with it. What you say in Talk is never stored.

Your rights

Under UK data-protection law you have the right to: access the personal data we hold about you; have it rectified or erased; restrict or object to processing; data portability; and to withdraw consent at any time where processing is based on consent. To exercise any of these, email [email protected] with "Privacy" in the subject line. We will respond within one calendar month.

If you are a client in the pilot, much of this is in the application itself: Download my data gives you everything WovenPath holds that you gave or that was shared with you, as one file; About me lets you correct your details; and your account can be closed whenever you ask your therapist or us. Your therapist is the controller of your information in the platform, so we may pass your request to them.

If you're unhappy with how we use your information, tell us first: email [email protected] with "Complaint" in the subject line. We will confirm we have received it within 30 days, look into it, and tell you what we have done. If you are a client in the pilot, your therapist is responsible for your information in the platform: complain to them, or write to us and we will pass it on.

You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint or 0303 123 1113.

Reviews of this notice

We plan to have this notice checked by an independent data protection specialist once that is funded. If that changes anything, we'll update this page and the date at the top.

An important boundary

WovenPath is not an emergency service. In an urgent or life-threatening situation call 999, or Samaritans free on 116 123.