Patient Terms & Conditions and Privacy Notice

VIAPSYCH – PATIENT PLATFORM TERMS AND PRIVACY NOTICE

Document Reference: VP-PATIENT-TERMS-2026-V1-DRAFT

Review Date: 27 July 2026

Status: Operational draft – solicitor and data-protection review required before acceptance or launch

IMPORTANT REVIEW NOTICE

This page is a transparent description of the intended service and known data flows. It is not an approved final contract or privacy notice. ViaPsych must obtain UK legal and data-protection review, verify its company details and provider register, and implement the stated launch controls before relying on this text for patient acceptance.

1. WHAT VIAPSYCH IS

ViaPsych is intended to be a technology platform through which adults can find, communicate with, and book independent clinicians. ViaPsych may provide account, booking, payment, messaging, document, video, and support tools.

ViaPsych does not itself diagnose, prescribe, treat, or provide emergency care. A clinician is responsible for the clinical service they personally provide, including assessment, professional judgement, diagnosis where appropriate, treatment discussion, prescribing where appropriate, clinical records, and follow-up.

Use of the platform does not guarantee an appointment, diagnosis, prescription, treatment, clinical outcome, or acceptance by a particular clinician.

2. ADULTS ONLY AND EMERGENCIES

The platform is designed only for people aged 18 or over. Date of birth and adult confirmation are checked in the remediated assessment and booking flows. Do not use the service for a child.

ViaPsych is not an emergency or crisis service and platform messages are not continuously monitored by a clinician. If there is immediate danger, call 999. For urgent medical help in the United Kingdom, use NHS 111 or the locally applicable urgent or crisis service.

3. ACCOUNTS AND ACCESS

Clerk is the intended identity and session provider. You must provide accurate information, protect your sign-in method and device, and tell ViaPsych promptly if you suspect unauthorised access. Do not use another person's account or attempt to access another person's records.

The application stores an internal role and relationship record. Clinician and administrator access is not granted from user-editable identity metadata. New accounts default to patient access.

ViaPsych may restrict access to protect users, investigate misuse, comply with law, or respond to a security or safety concern. The final terms must describe notice, appeal, continuity, and termination rights.

4. SCREENING, BOOKINGS, AND CLINICAL CARE

Questionnaires and screening results are not a diagnosis. They may help an independent clinician understand information you choose to provide. Clinically worded questionnaires and patient information require clinical review before launch.

You should check a clinician's profile and ask questions relevant to your needs. ViaPsych intends to display only approved and active clinicians, but a directory entry is not a guarantee of a particular outcome or suitability.

A booking request may be pending until the clinician accepts it and any required payment is confirmed. Appointment availability can change. Cancellation, refund, no-show, rescheduling, and clinician-cancellation terms must be approved and shown before payment; this draft does not create a specific cancellation charge or refund entitlement.

5. PAYMENTS

Stripe is the intended payment processor. Payment-card details entered into Stripe are handled by Stripe rather than stored in the ViaPsych application. ViaPsych receives payment and transaction metadata needed to administer the booking.

A browser return from checkout is not proof of payment. The remediated workflow relies on a signed Stripe event, the expected amount and currency, and an explicit internal payment state. Charges, refunds, fees, settlement, and tax treatment must match the final checkout wording and approved commercial policy.

6. INFORMATION THE PLATFORM MAY HANDLE

Depending on the feature you use, the platform may handle:

• Identity and contact information, such as name, email address, telephone number, and date of birth
• Account and security information, such as identity-provider identifiers, session events, role, and access records
• Questionnaire and health information that you submit for a screening, booking, message, document, or consultation
• Appointment, clinician, availability, consent, and communication records
• Payment status, amounts, currency, provider transaction references, refunds, and billing administration records
• Support requests, technical logs, and records needed to investigate security or service problems
• Video-room and participant metadata when video consultation is enabled

ViaPsych should collect only information needed for an identified purpose. Do not include unnecessary clinical detail in ordinary support, contact, or payment messages.

7. WHO MAY ACCESS INFORMATION

Your chosen clinician may access information needed for an authorised appointment or care relationship. Other clinicians must not be able to browse it merely because they have a clinician account.

Authorised ViaPsych personnel and service providers may be technically capable of accessing information where necessary for security, support, incident response, legal compliance, safety, or system administration. Access must be authorised, limited to the minimum necessary, and logged where the deployed system supports logging.

ViaPsych does not claim that its clinical data is zero-knowledge or end-to-end encrypted. It does not promise that staff can never access records. Payment disputes should be handled using payment and appointment metadata wherever possible, without unnecessary access to clinical content.

8. SERVICE PROVIDERS AND TRANSFERS

The current implementation contains or anticipates the following providers:

• AWS-hosted compute and network infrastructure, which can receive application traffic and data processed by the host
• A PostgreSQL database reached through a Prisma Data Platform connection, which stores platform records
• Clerk, which receives identity, authentication, device, and session information
• Stripe, which receives payment, payer, amount, currency, and booking metadata when payments are enabled
• Daily, which receives video-room, participant, network, and media information when video is enabled

Resend and recipient email providers, which receive recipient and message information when transactional email is enabled

Private object storage and malware scanning are required before production medical-document uploads are enabled; the current local-file design is not approved for launch

The presence of code for a provider does not prove that it is currently configured or approved. ViaPsych has not verified evidence for a public UK-only hosting promise. A provider may process data outside the United Kingdom or permit international support access. Before launch, ViaPsych must publish or make available an approved processor register recording purpose, data, location, retention, contracts, transfer safeguards, and deletion arrangements.

9. SECURITY

The current remediated design includes HTTPS at the public edge, identity sessions, database-backed roles, record-level authorisation, signed payment webhooks, short-lived video tokens, file type and signature checks, rate limits, and security response headers. Some sensitive features remain disabled while their production controls are incomplete.

No online service can promise absolute security. ViaPsych does not currently promise immutable logs, mandatory multi-factor authentication for every account, complete intrusion detection, end-to-end encryption, or exclusive UK storage. Security statements must continue to match deployed and tested controls.

10. PURPOSES AND LEGAL BASES REQUIRE FINAL REVIEW

Intended purposes include providing requested platform functions, administering contracts and payments, authenticating users, preventing misuse, supporting users, maintaining security, meeting legal obligations, and enabling an independent clinician to provide requested care.

Health information is special-category personal data. The final privacy notice must identify the actual controller or controllers, Article 6 basis, Article 9 condition, and any processor role for each activity. ViaPsych must not use a generic statement to decide those roles. It must also document any use based on consent, contract, legal obligation, legitimate interests, health care, or vital interests and explain how the basis applies.

11. RETENTION AND DELETION

No single retention period applies to all platform and clinical data. Account, screening, appointment, payment, message, document, clinical, support, application, audit, and backup records may have different legal and operational requirements.

ViaPsych has not yet approved and implemented a complete retention schedule. It must do so before launch and must not promise automatic deletion or a fixed clinical-record period without verified authority. Some information may need to be preserved for patient safety, professional record keeping, tax, disputes, fraud prevention, rights requests, or legal obligations.

12. YOUR DATA-PROTECTION RIGHTS

Depending on the circumstances and applicable law, you may have rights to obtain information and a copy of personal data, correct inaccurate data, request deletion or restriction, object to some processing, obtain portable data, withdraw consent where consent is the basis, and complain to the Information Commissioner's Office.

These rights can have lawful limits, particularly for clinical records, legal claims, public-interest duties, and records another controller must retain. The final privacy notice must explain whether ViaPsych, the clinician, or both should receive each type of request and how identity will be verified.

For a platform privacy request, contact admin@viapsych.co.uk. For a clinical-record request, contact the clinician who provided the care and copy ViaPsych if help routing the request is needed. Do not send identity documents or detailed health information by ordinary email unless an approved secure process requests them.

13. COMPLAINTS AND SAFETY

Send platform administration complaints to admin@viapsych.co.uk. A clinical complaint should ordinarily be sent to the clinician who provided the care, subject to any applicable professional or regulatory route. ViaPsych may help route a complaint but should not represent itself as the clinician's clinical supervisor.

You may complain about personal-data handling to the Information Commissioner's Office. The final notice must provide verified controller identity and contact details and explain any data-protection-officer or representative arrangement that applies.

14. REQUIRED APPROVAL BEFORE USE

Before these terms become operative, ViaPsych must obtain approval for verified company and controller details, governing law, contractual formation, fees, cancellation and refund policy, liability, service availability, intellectual property, complaints, safety, data-protection roles and bases, provider register, international transfers, retention, children's exclusions, accessibility, notice of changes, and acceptance records.

Patient acceptance must identify the exact approved version. This draft must not be presented as a final promise of compliance, security, residency, confidentiality, or legal allocation.