Privacy Policy
Shemesh Therapy LLC | A Delaware Corporation | Emotional Wellness Platform
Effective Date: 1 March 2025 | Version: 1.1
This policy applies to all users of the Shemesh platform, including UK-based consumers and B2B employer clients.
Quick Reference — Your Key Rights at a Glance
- Data Controller: Shemesh Therapy LLC, a Delaware corporation
- UK GDPR Representative: Rickert Services Ltd UK, PO Box 1487, Peterborough, PE1 9XX — appointed under UK GDPR Article 27
- Contact for data requests: privacy@shemesh.com
- ICO registration: ZC015627
- ICO security number: CSN7377268
- Right to complain to the ICO: ico.org.uk | 0303 123 1113
- Special category data processed: Yes — mental wellness data (UK GDPR Article 9)
- International transfers: Yes — to USA (cloud hosting) and South Africa (coaches)
IMPORTANT:
Shemesh is a mental emotional wellness platform, not a clinical or healthcare service. Some data we collect relates to mental wellness and is classified as special category health data under UK GDPR Article 9. We take this seriously and apply the highest standard of protection to this data.
1. Who We Are and How to Contact Us
Shemesh Therapy LLC is a company incorporated in the State of Delaware, United States of America. We operate an emotional wellness platform that connects clients with independent HPCSA-qualified professionals who hold postgraduate qualifications registered with the Health Professions Council of South Africa (HPCSA).
| Item | Details |
|---|---|
| Data Controller | Shemesh Therapy LLC |
| Registered in | Delaware, USA |
| Platform address | https://shemeshwellness.com |
| Privacy contact | shemeshtherapy@gmail.com |
| UK GDPR Article 27 Representative | Rickert Services Ltd UK, PO Box 1487, Peterborough, PE1 9XX, United Kingdom — This representative can be contacted by UK users and the ICO in relation to this Privacy Policy |
| ICO registration number | ZC015627 |
Because Shemesh Therapy LLC is incorporated in the United States and has no physical establishment in the United Kingdom, we have appointed a UK Representative as required by UK GDPR Article 27. Our UK Representative acts as a point of contact for UK data subjects and the Information Commissioner's Office (ICO) on our behalf. Our UK Representative does not make decisions about how we process your data — those decisions are made by Shemesh Therapy LLC.
2. Who This Privacy Policy Applies To
This Privacy Policy applies to:
- Individual consumers (B2C clients) who create a Shemesh account and access coaching sessions directly.
- Employees of organisations (B2B employer clients) who access Shemesh as a workplace benefit — your employer purchases access but you create your own account and your session data remains private from your employer.
- Visitors to the Shemesh website who have not yet created an account.
Important for B2B users
If you access Shemesh through your employer, your employer is a separate data controller for the fact that you have access to Shemesh (e.g. they know they have provided you with a subscription). However, your employer does NOT have access to your session content, mood data, journals, or any other personal data you create within the platform. Your coaching data is yours and is kept strictly confidential from your employer.
3. What Personal Data We Collect and Why
We collect data in three ways: data you give us directly, data generated by your use of our platform, and data collected automatically by our technology infrastructure. Each category is explained below.
3.1 — Account and Identity Data
Collected when you create an account or update your profile.
| Data | Why we collect it | Lawful basis |
|---|---|---|
| Full name | To identify your account and address you in communications | Contract performance |
| Email address | To send you booking confirmations, receipts, and service communications | Contract performance |
| Password (hashed) | To secure your account — we never store your password in plain text | Contract performance |
| Phone number | To send session reminders via SMS if you opt in to this feature | Consent |
3.2 — Mental Wellness and Session Data
| Data | Why we collect it | Lawful basis |
|---|---|---|
| Mood check-ins and self-assessments | To track your wellness journey and provide personalised coaching support | Explicit consent (Article 9(2)(a)) |
| Journal entries and reflections | To support your coaching experience and help your Professional understand your progress between sessions | Explicit consent (Article 9(2)(a)) |
| Gratitude logs and wellness goals | To support your personal development within the platform | Explicit consent (Article 9(2)(a)) |
| Session notes you choose to share | To allow continuity between sessions if you choose to share notes with your Professional | Explicit consent (Article 9(2)(a)) |
| Session booking history | To manage scheduling, send reminders, and maintain your coaching record | Contract performance |
What your Professional can see: Your Professional can see your first name, session booking time, and any notes or context you choose to share with them through the platform. Your Professional cannot see your journal entries, mood data, or any other content unless you explicitly choose to share it. Session content is not recorded.
3.3 — Payment Data
Payments are processed by Stripe, Inc. Shemesh does not store your full card details. Stripe processes and stores payment data in accordance with PCI-DSS compliance standards.
| Data | Why we collect it | Lawful basis |
|---|---|---|
| Billing name and email | To generate receipts and manage your subscription | Contract performance |
| Last 4 digits of card and expiry | Stored by Stripe for subscription management — not stored by Shemesh directly | Contract performance |
| Transaction history and subscription status | To manage your account, process refunds, and maintain financial records | Legal obligation (7-year retention for tax purposes) |
3.4 — Scheduling and Communications Data
| Data | Why we collect it | Lawful basis |
|---|---|---|
| Session booking dates and times | To schedule your sessions and send reminders via our scheduling tool | Contract performance |
| Emails sent and received | To send booking confirmations, receipts, and platform updates via our email service provider | Contract performance / Legitimate interests |
| Marketing email engagement (opens, clicks) | To improve our communications and understand what is relevant to you — only if you have consented to marketing emails | Consent |
3.5 — Technical and Device Data
Collected automatically when you use our website or app.
| Data | Why we collect it | Lawful basis |
|---|---|---|
| IP address | For security, fraud prevention, and approximate location (country level) | Legitimate interests |
| Browser type and version | To ensure the platform works correctly on your device | Legitimate interests |
| Device type and operating system | To optimise the platform experience | Legitimate interests |
| Pages visited and session duration | Analytics to understand how the platform is used and to improve it | Consent (via cookie consent) |
| Referral source (how you found us) | Marketing effectiveness measurement — only with your consent | Consent (via cookie consent) |
3.6 — B2B Employer Data
If your employer has purchased a Shemesh subscription for their workforce, we collect the following data from employers:
- Company name and registered address
- Name and email of the employer account administrator
- Billing and payment information for the employer subscription
- Number of licences purchased and redemption rate (aggregate, not linked to individual employees)
We do not share any individual employee's data with their employer. Usage reports provided to employers are aggregated and anonymised — your employer cannot identify your individual usage or access your coaching data under any circumstances.
4. Our Lawful Basis for Processing — Summary
UK GDPR requires us to have a documented lawful basis for each type of processing activity. The table below sets out our lawful basis for each category of processing.
| Processing Activity | Lawful Basis and Explanation |
|---|---|
| Delivering coaching sessions and managing your account | Contract performance — Article 6(1)(b). Processing is necessary to provide the service you have signed up for. |
| Processing payments via Stripe | Contract performance — Article 6(1)(b). Necessary to fulfil your subscription. |
| Retaining financial records | Legal obligation — Article 6(1)(c). UK tax law requires us to retain financial records for 7 years. |
| Processing mental wellness data (journals, mood, assessments) | Explicit consent — Article 9(2)(a). You give specific consent for each data feature when you first use it. You can withdraw consent at any time. |
| Sending transactional emails | Contract performance — Article 6(1)(b). Necessary to manage your account. |
| Sending marketing emails | Consent — Article 6(1)(a). You opt in at sign-up or in account settings. You can unsubscribe at any time. |
| Platform analytics and improvement | Consent — Article 6(1)(a). Collected via cookies you consent to through our cookie banner. |
| Security, fraud prevention, abuse detection | Legitimate interests — Article 6(1)(f). We have a legitimate interest in keeping the platform secure for all users. |
| Maintaining session booking and scheduling records | Contract performance — Article 6(1)(b). Necessary to manage the service. |
5. Special Category Data — Mental Wellness Information
Mental health and wellness data is classified as special category data under UK GDPR Article 9. This is the highest protection tier under UK data protection law. We treat it accordingly.
The journals, mood check-ins, self-assessments, and wellness goals you create on Shemesh constitute health-related personal data. We process this data only:
- With your explicit, informed, and freely given consent — captured separately for each feature
- For the purpose of delivering your coaching experience on the platform
- In a way that is minimised — your Professional sees only what you choose to share
5.1 — How We Protect Your Mental Wellness Data
- Your wellness data is encrypted at rest and in transit
- Access is restricted — only you and your chosen Professional (for data you share) can access it
- Your employer cannot access your wellness data under any circumstances
- Session content is not recorded — sessions are live only with no transcripts stored
- Professionals are contractually prohibited from storing client data outside the platform
- You can export all your wellness data at any time via your account settings
- You can delete your wellness data at any time — this is processed within 30 days
5.2 — Withdrawing Consent for Special Category Data
Because we rely on your explicit consent to process your mental wellness data, you have the right to withdraw that consent at any time. Withdrawing consent means we will stop processing that data going forward. It does not affect the lawfulness of processing carried out before your withdrawal. To withdraw consent, go to Settings > Privacy > Data Preferences in your account, or email privacy@shemesh.com.
6. Who We Share Your Data With
We do not sell your personal data. We do not share your data with third parties for their own marketing purposes. We share your data only with the service providers listed below who help us operate the Shemesh platform, and only to the extent necessary for that purpose.
| Recipient | Location | What is shared and why | Transfer safeguard |
|---|---|---|---|
| Your assigned Shemesh Professional | South Africa | Your first name and session booking details. Only data you explicitly choose to share beyond this. Professionals are independent contractors bound by confidentiality obligations and UK GDPR-aligned data processing terms. | Contractual safeguards (IDTA) |
| Stripe, Inc. | United States | Your billing name, email, and payment card details for subscription processing and payment management. | UK IDTA / Stripe UK DPA |
| Video platform provider (e.g. Google Meet) | United States | Your name and email to facilitate session video calls. Session content is not recorded or stored by Shemesh. | UK IDTA / Provider DPA |
| Scheduling tool | United States | Your name, email, and session booking preferences to manage appointment scheduling. | UK IDTA / Provider DPA |
| Resend | United States | Your name and email address to send transactional emails and, where you have consented, marketing emails. | UK IDTA / Provider DPA |
| Google Analytics | United States | Anonymised and aggregated platform usage data (IP address anonymised). Only processed where you have consented via our cookie banner. | Consent + UK IDTA |
| Cloud hosting provider (Vercel & Neon) | United States | All platform data is hosted on US-based cloud infrastructure. This is our primary data storage environment. | UK IDTA signed with provider |
| ICO or law enforcement | United Kingdom | Only where required by law, a court order, or to protect the vital interests of a user (e.g. a safeguarding emergency). | Legal obligation / Vital interests (Article 9(2)(c)) |
HubSpot — Internal Use Only
We use HubSpot as an internal CRM tool for our sales and business development team. HubSpot is not integrated with user-facing platform features. We do not upload client session data, wellness data, or account data to HubSpot. Only business contact information relating to B2B employer prospects and clients is stored in HubSpot for internal sales management purposes.
7. International Data Transfers
As a US-incorporated company using US-based cloud infrastructure and South Africa-based coaches, your personal data will be transferred internationally. UK GDPR places strict requirements on these transfers to ensure your data remains protected when it leaves the UK.
7.1 — Transfers to the United States
Your personal data is transferred to and stored on cloud servers located in the United States. The US is not subject to a UK adequacy decision covering all types of data transfer. We protect these transfers through UK International Data Transfer Agreements (IDTAs) — the mechanism approved by the ICO for this purpose — with each of our US-based service providers. This includes our cloud hosting provider, Stripe, our video platform, our scheduling tool, our email provider, and Google Analytics.
7.2 — Transfers to South Africa
When you are assigned a Shemesh Professional, limited session information (your first name and booking time) is shared with your Professional, who is located in South Africa. South Africa is not subject to a UK adequacy decision. We protect these transfers through contractual safeguards in our agreements with each Professional, incorporating UK IDTA provisions as required by UK GDPR Article 46. We also minimise this transfer by limiting what your Professional can see to the minimum necessary for session delivery.
7.3 — Transfer Risk Assessments
We have conducted Transfer Risk Assessments (TRAs) for all international data transfers as required by ICO guidance. These assessments evaluated the legal framework and data protection standards in each destination country and confirmed that, with the contractual safeguards in place, your data is adequately protected. Copies of our TRAs are available to the ICO on request.
8. How Long We Keep Your Data
We keep your personal data only for as long as necessary for the purposes it was collected, or as required by law. The table below sets out our retention periods for each data category.
| Data Category | Retention Period | Reason |
|---|---|---|
| Account data (name, email) | Duration of your account + 2 years after account closure | To manage your account and resolve any disputes arising after closure |
| Mental wellness data (journals, mood, assessments) | Duration of your account. Deleted within 30 days of account closure or deletion request | You retain control — you can delete this data at any time |
| Session booking records | 3 years after last session | For dispute resolution and service records |
| Payment and financial records | 7 years from the date of each transaction | Legal obligation under UK and US tax law |
| Marketing consent records | Until you withdraw consent + 1 year | To demonstrate lawful processing if challenged |
| Analytics data (cookied, aggregated) | Up to 26 months (Google Analytics default) | Retention set in our analytics configuration |
| Security logs (IP addresses, access logs) | 90 days | For fraud prevention and security incident investigation |
| Correspondence with us (emails, support) | 3 years | For quality management and dispute resolution |
When data reaches the end of its retention period, it is permanently deleted or anonymised so it can no longer be linked to you. Deletion of special category wellness data is completed within 30 days of the scheduled deletion date.
9. Your Data Protection Rights
Under UK GDPR, you have the following rights in relation to your personal data. We will respond to all valid rights requests within 30 days. There is no charge for exercising your rights, except in cases of manifestly unfounded or excessive requests.
| Right | What this means for you |
|---|---|
| Right of access (Article 15) | You can request a copy of all personal data we hold about you, including where it came from, who we share it with, and how long we keep it. Submit a Subject Access Request to privacy@shemesh.com. |
| Right to rectification (Article 16) | If any data we hold about you is inaccurate or incomplete, you can ask us to correct it. You can update most account data directly in your account settings. |
| Right to erasure (Article 17) | You can ask us to delete your personal data in certain circumstances — for example, where we no longer need it, or where you withdraw consent. Use the Delete Account feature in your account settings or email privacy@shemesh.com. Some data may be retained for legal obligations (e.g. financial records). |
| Right to data portability (Article 20) | You can request a copy of the personal data you have provided to us in a structured, commonly used, machine-readable format (CSV or JSON). Use the Export Data feature in your account settings or email privacy@shemesh.com. We will fulfil portability requests within 30 days. |
| Right to restrict processing (Article 18) | You can ask us to pause processing of your data in certain circumstances — for example, while you contest its accuracy. |
| Right to object (Article 21) | You can object to processing based on legitimate interests at any time. You can also object to direct marketing at any time — we will stop immediately. |
| Right to withdraw consent | Where processing is based on your consent, you can withdraw it at any time via Settings > Privacy or by emailing privacy@shemesh.com. Withdrawal does not affect the lawfulness of prior processing. |
| Right not to be subject to automated decisions (Article 22) | We do not make legally significant automated decisions about you. If we introduce any such feature, we will update this policy and obtain separate consent. |
9.1 — How to Exercise Your Rights
To exercise any of your rights, you can:
- Use the self-service features in your account settings (for erasure, portability, and consent withdrawal).
- Email us at shemeshtherapy@gmail.com with your request — please include your registered email address and the specific right you wish to exercise.
- Contact our UK GDPR Representative at Rickert Services Ltd UK, PO Box 1487, Peterborough, PE1 9XX | art-27-rep-shemesh@rickert-services.uk
We will verify your identity before processing any request. We will respond within 30 days. If your request is complex or you have submitted multiple requests, we may extend this by a further 60 days — we will notify you if this applies.
9.2 — Right to Complain to the ICO
If you are unhappy with how we have handled your personal data, you have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:
| Contact method | Details |
|---|---|
| ICO website | ico.org.uk |
| ICO helpline | 0303 123 1113 (Monday to Friday, 9am to 5pm) |
| ICO live chat | Available at ico.org.uk |
| ICO postal address | Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF |
We would appreciate the opportunity to address your concerns before you contact the ICO. Please contact us first at privacy@shemesh.com and we will do our best to resolve the issue promptly.
10. Cookies and Tracking Technologies
We use cookies and similar tracking technologies on our website and platform. Cookies are small text files stored on your device that allow us to recognise you, remember your preferences, and understand how you use our platform.
| Cookie type | Purpose | Legal basis |
|---|---|---|
| Strictly necessary cookies | Essential for the platform to function — e.g. keeping you logged in, securing your session, processing your payment. Cannot be disabled. | No consent required |
| Analytics cookies (e.g. Google Analytics) | Help us understand how users interact with the platform so we can improve it. We use IP anonymisation and do not use analytics data to identify individual users. | Consent required — opt in via cookie banner |
| Marketing and retargeting cookies | Allow us to show relevant advertising on third-party platforms. Only active if you have consented. | Consent required — opt in via cookie banner |
| Preference cookies | Remember your settings and preferences so you do not have to re-enter them on each visit. | Consent required — opt in via cookie banner |
You can manage your cookie preferences at any time by clicking the 'Manage Cookies' link in the footer of our website. You can also control cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the platform.
For a full list of cookies we use, including their names, purposes, durations, and whether they are first or third-party, please see our Cookie Policy at https://shemeshwellness.com/cookie-policy.
11. Marketing Communications
We send marketing emails to clients who have opted in to receive them. We do not send unsolicited marketing communications.
- You can opt in to marketing emails at sign-up or at any time via Settings > Notifications in your account.
- You can opt out at any time by clicking 'Unsubscribe' at the bottom of any marketing email, or via Settings > Notifications.
- Opting out of marketing emails will not affect transactional emails such as receipts, session reminders, and account security notifications — these are sent on the basis of contract performance and cannot be disabled while your account is active.
- We do not share your contact details with any third party for their own marketing purposes.
- We do not use your mental wellness data, session data, or journal entries for marketing purposes.
12. How We Keep Your Data Secure
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:
- Encryption of personal data in transit (TLS 1.2 or higher) and at rest
- Encrypted password storage — we never store passwords in plain text
- Access controls — only authorised staff and contractors can access personal data, and only to the extent required for their role
- Regular security reviews and vulnerability assessments
- Sub-processor DPAs with all third-party service providers who access personal data
- Contractual confidentiality obligations on all coaches and contractors
12.1 — Data Breach Procedure
In the event of a personal data breach, we will notify the ICO within 72 hours where the breach is likely to result in a risk to individuals' rights and freedoms. Where a breach is likely to result in a high risk to you personally, we will also notify you directly without undue delay. We maintain an internal breach register and will conduct a post-incident review for all material breaches.
13. Children's Data
Shemesh services are strictly for adults aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18.
If we become aware that we have collected personal data from a person under the age of 18, we will delete it immediately. If you believe we have inadvertently collected data from a child, please contact us immediately at shemeshtherapy@gmail.com
14. Records of Processing Activities
As required by UK GDPR Article 30, Shemesh Therapy LLC maintains internal Records of Processing Activities (ROPA) documenting all personal data processing operations, their purposes, lawful bases, retention periods, and international transfer safeguards. Our ROPA is maintained as a living document and updated whenever our processing activities change. It is available to the ICO on request.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make changes:
- We will update the 'Last updated' date at the top of this policy
- For minor changes (e.g. clarifications that do not affect how we use your data), we will publish the updated policy on our website
- For material changes that affect how we use your data — particularly special category wellness data — we will notify you by email and ask for your consent again where required by UK GDPR
- You can always find the current version of this policy at https://shemeshwellness.com/privacy-policy
If you continue to use Shemesh after a material change to this policy, this does not constitute consent to the new processing. Where new processing requires your consent, we will always ask for it explicitly before the new processing begins.
16. Contact Us
For any questions, concerns, or requests relating to this Privacy Policy or your personal data:
| Contact | Details |
|---|---|
| Email (preferred) | shemeshtherapy@gmail.com |
| UK GDPR Representative | Rickert Services Ltd UK, PO Box 1487, Peterborough, PE1 9XX, United Kingdom — art-27-rep-shemesh@rickert-services.uk |
| Response time | We aim to respond to all privacy enquiries within 5 business days and to all formal data rights requests within 30 days. |
| ICO (if unresolved) | ico.org.uk | 0303 123 1113 |
Shemesh Therapy LLC | Privacy Policy | Version 1.1 | Effective 1 March 2025
This policy was prepared as a compliance document for Shemesh Therapy LLC and reflects the company's data processing activities as of the effective date above. Shemesh is a mental emotional wellness platform, not a clinical or regulated healthcare service.