Privacy Policy
Last updated 3 October 2026 · Last reviewed: July 2026
Who we are
Formulate is operated by Formulate Tools Ltd, a company registered in England & Wales (Company No. 17065550), registered address 11 Chantry Close, Sunbury-on-Thames, TW16 7TH.
Formulate is a platform of interactive clinical psychology tools and worksheets for use by qualified and trainee mental health professionals. For data protection queries, contact formulatetools@outlook.com.
What data we collect
Therapist account data
Email address, full name, organisation name (optional), subscription status, and usage data (which worksheets accessed, when, and frequency).
Client label data
Pseudonymised client labels (initials or case codes) assigned by the therapist. The platform validates client labels to reject obvious identifiers (such as emails, phone numbers, NHS/NI numbers, dates of birth and postcodes) and warns therapists against using names. Therapists remain responsible for not entering identifiable information.
Worksheet response data
Clinical content entered by clients via homework links. This data is pseudonymous. Only the assigning therapist can view response data. Formulate does not access, review, analyse, or use response data for any purpose other than storage and display to the therapist.
Technical data
IP addresses (for security), device and browser information (for compatibility), and cookies. We set strictly necessary cookies (authentication and session) without consent. Optional analytics and advertising cookies — the Meta Pixel, Vercel Web Analytics and Speed Insights, and PostHog — are set only if you accept them. See “Cookies” below.
Legal basis for processing
Formulate plays two different roles under UK GDPR, and the legal basis depends on the role. In plain terms: for data about you (the practitioner) and your account, we are the data controller and rely on our own legal bases. For the clinical data your clients enter, you are the data controller and we act only as your processor, on your instructions.
Where we are the controller
For the following data, Formulate Tools Ltd decides how and why processing happens, so we are the controller and rely on these UK GDPR Article 6 bases:
| Data type | Legal basis | In plain terms |
|---|---|---|
| Therapist account data | Contract (Art. 6(1)(b)) | We need it to provide your account |
| Subscription and billing data | Contract (Art. 6(1)(b)) | We need it to take payment and manage your plan |
| First-party usage analytics | Legitimate interests (Art. 6(1)(f)) | Understanding how the platform is used so we can improve it |
| Optional analytics and advertising cookies | Consent (Art. 6(1)(a)) | The Meta Pixel, Vercel Web Analytics and Speed Insights, and PostHog load only if you accept them via the cookie banner |
| Audit and security logs | Legal obligation (Art. 6(1)(c)) + legitimate interests (Art. 6(1)(f)) | Keeping the platform secure and able to evidence what happened |
| Marketing emails to account holders (tips, trial and plan offers, the blog digest) | Legitimate interests (Art. 6(1)(f)), sent under PECR's “soft opt-in” for existing customers | You can turn these off at any time in Settings or with the unsubscribe link in every marketing email. Emails about your account, billing and security, and homework completions, changes, risk and outcome alerts, are not marketing and are always sent. The weekly homework summary is not marketing. Where available, you can turn it off in Settings or through its unsubscribe link. |
| Support tickets and contact messages | Legitimate interests (Art. 6(1)(f)) | Responding to your enquiry |
Where we process on your behalf (you are the controller)
For clinical data about your clients, the treating clinician — not Formulate — is the data controller. We process this data only as a processor, on your documented instructions, under our Article 28 Data Processing Agreement. A processor does not hold its own Article 6 or Article 9 basis for this data; the controller's bases apply:
| Data type | Our role | The controller's legal basis |
|---|---|---|
| Client labels and case details | Processor, under the Art. 28 DPA, on the therapist's documented instructions | Contract (Art. 6(1)(b)) — the therapy agreement between clinician and client |
| Client worksheet responses and outcome scores | Processor, under the Art. 28 DPA, on the therapist's documented instructions | Contract (Art. 6(1)(b)); for health data, Art. 9(2)(h) — see “Special category data” below |
In plain terms: your clients' worksheet responses are yours, not ours. We store and display them for you, on your instructions, and never use them for any purpose of our own.
Special category data
Worksheet response data may constitute health data under Article 9. Where it does, the relevant condition is Article 9(2)(h) — processing necessary for the provision of health care, under the responsibility of a health professional. That condition belongs to the treating clinician as data controller: the processing sits under their professional responsibility, and Formulate processes the data only as their processor under our DPA. We do not process client health data for any purpose of our own.
Data sharing
We use the sub-processors listed in our Data Processing Agreement — including Supabase (database, UK), Stripe (payments), Resend (transactional email), Anthropic (AI worksheet generation, on PII-stripped input only), Vercel (hosting) and Sentry (error monitoring). With your consent, we also load analytics and advertising tools (the Meta Pixel, Vercel Web Analytics and Speed Insights, and PostHog). We do NOT sell your data, share clinical response data with third parties for their own purposes, use clinical data for advertising, or train AI models on worksheet responses.
Where we store your data
Your account and clinical data are stored in the UK (Supabase, AWS eu-west-2, London). Some sub-processors operate outside the UK (see our DPA for the full list and the safeguards that cover those transfers).
Data retention
All retention rules in one place:
| Data | How long we keep it |
|---|---|
| Therapist account data | While your account is active. The Delete account action permanently removes your account and its linked clinical records; it does not provide a 90-day recovery window. Separately retained audit and billing records follow their applicable retention rules. |
| Client worksheet responses and outcome data | Kept until deleted, including when a paid plan reverts to Free. Permanent erasure and client response deletion remove the selected clinical data without a recovery window. Soft-deleted worksheet responses, outcome-measure administrations, assignments, client relationships and worksheets are purged after 90 days. That automated purge does not currently cover every other record type, such as saved formulation canvases or homework plans. |
| Data after subscription cancellation | When paid access ends, your account reverts to the Free plan and existing data is kept. Reverting to Free does not trigger automatic deletion (see our Terms of Service) |
| Audit logs | 7 years |
| Database backups | Automated backups with point-in-time recovery are being enabled with our database platform; current status is published in our DTAC self-assessment and on the Security page |
You can export your data at any time while your account is active. If worksheet responses form part of your clinical record, export anything you need to retain before deleting it.
Your rights
Under UK GDPR, you have the right to access, rectify, erase, restrict processing of, and port your data, and to object to processing. Contact formulatetools@outlook.com. We will respond within one month. You also have the right to lodge a complaint with the Information Commissioner's Office (ico.org.uk).
Client rights
Clients who complete homework worksheets can exercise their rights by contacting their therapist. The therapist can delete all data associated with a client using the platform's GDPR erasure function.
If you answer a belief survey
This part is for people who answer a short anonymous survey through a link someone sent them. The person who sent it is working with a therapist, and the survey is part of their therapy.
Who is responsible
The therapist who set up the survey is the controller of your answers. Formulate Tools Ltd hosts the survey page and stores the answers for the therapist, as their processor, under our Data Processing Agreement. The answers are stored in the UK (London).
What we keep, and why
- Your answers, and the day they arrived. We keep the day, never the time, and only to manage how long answers are kept; the therapist can't see it.
- We don't ask for your name or email, and we don't store your IP address, your device details or who answered.
- Links and contact details in a written answer (such as email addresses, phone numbers, postcodes and social media handles) are replaced with “[removed]” before it is stored. This is an automatic check, so it may not catch everything.
- The answers are used only to help the person who asked with their therapy. We never use them for anything of our own, including marketing.
The survey is anonymous, but a written answer could still say something about you, such as your health. Please don't include names or anything that could identify you or anyone else.
The legal basis
The therapist relies on legitimate interests (UK GDPR Art. 6(1)(f)): helping their client in therapy with a survey that is voluntary and anonymous. You don't have to answer, and you can skip any question.
Stopping repeated answers
To stop the same survey being sent many times from one connection, we keep a coded value made from your IP address with a secret key. It can't be turned back into the address, is never linked to your answers, and is deleted within about 2 days. A similar coded counter lasts about a minute.
Like any website, our hosting provider (Vercel) handles each visit to deliver the page and may keep routine request logs, which include IP addresses, for a short time for security.
No cookies, no tracking
The survey page sets no cookies and stores nothing on your device, so there is no cookie banner. It has no analytics, advertising or tracking of any kind.
Who sees your answers
Answers are held until the survey closes. The therapist then reads them and decides which to share and which to hide. Nothing reaches the person who asked until the therapist releases the results, and only when at least 3 answers are shared, together as a group.
How long we keep answers
- Shared answers are kept as part of the client's therapy record, for as long as the therapist keeps that record. They are deleted when the therapist deletes the survey or the client's record, or when the client deletes that homework.
- The text of an answer the therapist hid is deleted 30 days after the results are released.
- If the survey is stopped before its results are released, the text of every answer is deleted 30 days later.
Your rights
You have rights over your personal data under UK GDPR, including to access it and to ask for it to be deleted. Because nobody knows who sent which answer, we usually can't find one person's answer to act on a request (UK GDPR Art. 11). If you want an answer removed, the simplest route is to tell the person who sent you the link, who can ask their therapist to hide it. You can also contact us at formulatetools@outlook.com, and we will pass your request to the therapist. You have the right to complain to the Information Commissioner's Office (ico.org.uk).
Cookies
Formulate uses strictly necessary cookies for authentication and session management; no consent is required for these under UK PECR. With your consent, we also use optional analytics and advertising cookies — currently the Meta Pixel (advertising-performance measurement), Vercel Web Analytics and Speed Insights (aggregate usage and page performance), and PostHog (product analytics, hosted in the EU) — which may set additional cookies. We request your consent before any analytics or advertising cookies are set, and you can accept or decline them via the cookie banner displayed on your first visit. You can change or withdraw your consent at any time using the “Cookie settings” link in the footer, and we will ask again if we add a new analytics or advertising tool.