Privacy Notice

This privacy notice explains how BeBright Ltd (“BeBright”, “we”, “us” and “our”) collects and uses personal data when you use our website, app and services, contact us, or engage with us on behalf of an organisation.

Please read this notice alongside our Terms of Service and Cookie Policy.

1. Who we are and how to contact us

BeBright Ltd is registered in England and Wales with company number 16522376. Our registered office is The Old Rectory, Yattendon, Thatcham, Berkshire, RG18 0UR.

We are registered with the Information Commissioner’s Office (“ICO”) under registration reference ZC005521.

BeBright is the controller of the personal data covered by this notice. This includes data relating to:

• individual users and customers;

• parents or guardians creating and managing a child profile;

• representatives of business customers, schools and other organisations; and

• visitors to our website.

For privacy questions or to exercise your rights, contact our Data Protection Lead, Sarah Warley at privacy@bebright.ai.

2. Services and other controllers

BeBright provides a digital platform offering educational content and resources, discovery questionnaires, progress-tracking tools, and access to independent practitioners.

Some services accessed through BeBright are provided by third parties which are responsible for their own handling of personal data:

• The Key Clinic Ltd (‘The Key Clinic’): If you request or book a free discovery call with The Key Clinic, we share your name, email address and appointment details so it can arrange the call. The Key Clinic is a separate controller for its clinical services, including BioTransform. It cannot access your BeBright account, discovery questionnaire or programme-progress information unless you choose to share this. If you proceed with its services, your account, information and payments will be handled directly by The Key Clinic under its own terms and privacy notice.

• Practitioners: Practitioners booked through BeBright are independent controllers. We provide them with the identity and booking details needed to manage the appointment. They are responsible for personal data they collect or create while providing their services.

We do not share your discovery questionnaire results or progress information with practitioners or clinics and we do not sell personal data or use health or questionnaire information for advertising.

3. The personal data we collect

We collect the following categories of personal data.

Individual customers and users

• Identity and account data: name, email address, password credentials and date of birth.

• Profile and child-profile data: whether a profile is for you or a child; the child’s name and date of birth; and, where relevant, the parent or guardian’s name, relationship to the child and contact details.

• Consent data: records of consent or acknowledgement, including the date and time, verification status and version of the wording presented.

• Questionnaire and progress data: answers to our optional discovery questionnaire and information you provide when using NeuroMature or BrightBeatz, so that you can view your progress over time. This may include health-related information, such as diagnoses, relevant background and self-reported difficulties.

• Booking and transaction data: appointment date and time, payment confirmation and limited transaction details. Card details are processed by Stripe and are not stored by BeBright.

• Marketing data: your marketing preferences.

• Feedback data: practitioner ratings and reviews.

• Communications data: information included in support requests, enquiries and correspondence.

• Technical and usage data: device type, app version, IP address, browser and device information, and information about how you use our website or app.

Representatives of business customers, schools and organisations

Where you contact us or engage with us on behalf of an organisation, we may collect:

• your name, job title and organisation;

• business email address, telephone number and business address;

• details of your enquiry, meeting, service requirements or communications;

• marketing and communications preferences; and

• website usage and technical data.

Website visitors and people registering interest

We may collect your name, email address, enquiry details, marketing preferences, and website usage and technical data when you browse our website, contact us, request information or register to hear about our launch.

Aggregated and anonymised data

We also use combined, anonymised figures, which can never identify anyone, to improve our programmes and to show schools, employers and health organisations we work with how their communities use BeBright overall. These are always group numbers, never individuals, and we never report on a group small enough to identify anyone within it.

4. How we collect personal data

We collect data:

• directly from you, when you create an account, complete a questionnaire, add a child profile, make a booking, contact us, leave a review or submit a website form;

• automatically, through cookies, app-store analytics, Sentry error logging, server logs and similar technologies; and

• from service providers, where necessary to provide payment, technical, email or website services.

Please see our Cookie Policy for more information about cookies and similar technologies.

Please note completing the discovery questionnaire is optional. You may instead explore therapies and resources by selecting a condition or suspected condition.

5. How we use personal data

We use personal data only where UK data protection law allows us to do so. The purposes and lawful bases below explain how we use it.

Where we need personal data to provide the app, process a booking or meet a legal requirement, and you do not provide it, we may be unable to provide the relevant feature or service. We will tell you if this is the case.

Where we process health-related information, we rely on explicit consent under Article 9(2)(a) UK GDPR. We also rely on an Article 6 lawful basis as set out below.

To register you, or the organisation you represent, as a customer or user

• Type of data: Identity, account, contact and organisation data

• Lawful basis: Contract: necessary to enter into or perform a contract with you. Legitimate interests: where you act for an organisation, to manage our relationship with that organisation.

To create and administer user accounts and child profiles

• Type of data: Identity, account, profile, parent/guardian and contact data

• Lawful basis: Contract: necessary to provide the app and associated services.

To confirm that an account holder is aged 18 or over and apply the appropriate child-consent process

• Type of data: Date of birth, parent/guardian and child-profile data

• Lawful basis: Legitimate interests: to operate an age-appropriate service, protect children and ensure that consent is obtained through the correct process.

To verify parental responsibility and maintain an auditable record of consent

• Type of data: Parent/guardian details, child-profile data and consent records

• Lawful basis: Legitimate interests: to safeguard children, confirm authority to act for a child and demonstrate compliance with our legal obligations.

To provide the discovery questionnaire, create the user profile and present relevant content or signposting

• Type of data: Questionnaire, profile and health-related data

• Lawful basis: Explicit consent for health-related information. Contract: necessary to provide the requested app service.

To record and display progress in NeuroMature and BrightBeatz

• Type of data: Progress, questionnaire and health-related data

• Lawful basis: Explicit consent for health-related information. Contract: necessary to provide the relevant programme features.

To arrange appointments, send booking reminders and manage cancellations

• Type of data: Identity, contact, booking and transaction data

• Lawful basis: Contract: necessary to arrange and administer the appointment.

To take payments and maintain financial records

• Type of data: Identity, contact and transaction data

• Lawful basis: Contract: necessary to process payment. Legal obligation: to meet tax, accounting and record-keeping requirements.

To manage practitioner ratings and reviews

• Type of data: Identity, profile and feedback data

• Lawful basis: Legitimate interests: to maintain the quality, safety and usefulness of our practitioner marketplace and help users make informed choices.

To respond to enquiries, provide support and manage complaints

• Type of data: Identity, contact, communications and, where relevant, account data

• Lawful basis: Legitimate interests: to respond to requests, support users, resolve issues and protect our business.

To send service communications, including account, booking, security and policy-update messages

• Type of data: Identity, account, contact and booking data

• Lawful basis: Contract: necessary to provide the service. Legitimate interests: to keep users informed about important service or security matters.

To send marketing communications, where permitted

• Type of data: Identity, contact, marketing preferences and organisation data

• Lawful basis: Consent, where required. Legitimate interests, for business-to-business communications where permitted by law, to promote and develop our services. You can opt out at any time.

To operate, secure, troubleshoot and improve our website and app

• Type of data: Technical, device and usage data

• Lawful basis: Legitimate interests: to run, protect, maintain and improve our systems, prevent misuse and understand how our services are used. Where non-essential cookies are used, we rely on consent.

To create genuinely anonymised and aggregated statistics to understand programme use and outcomes, improve our services and report overall usage

• Type of data: Questionnaire and programme information before anonymisation

• Lawful basis: Legitimate interests: to understand and improve our programmes and demonstrate their overall use and outcomes.

To comply with legal obligations or establish, exercise or defend legal claims

• Type of data: Relevant personal data, depending on the circumstances

• Lawful basis: Legal obligation and/or legitimate interests: to comply with applicable law and protect our legal rights.

6. Health information and consent

Some information collected through the optional discovery questionnaire and progress-tracking features is special category data in the form of health-related information and receives additional protection under UK GDPR.

Before collecting this information, we ask for your clear, separate and explicit consent. Consent is not pre-ticked and is separate from acceptance of our Terms of Service and from marketing choices.

You may withdraw consent at any time through app settings or by contacting us at privacy@bebright.ai. This will stop future processing based on consent, but will not affect processing already carried out lawfully before withdrawal.

Withdrawing consent may mean that we can no longer provide some of our services.

7. Children, age assurance and parental consent

BeBright accounts are available only to people aged 18 or over. A person under 18 may be represented through a profile created and managed by an adult with parental responsibility; they cannot create an account themselves.

How we use date of birth

We ask for:

• the account holder’s date of birth, to confirm they are 18 or over; and

• the date of birth of the person the profile concerns, to apply the appropriate consent process and tailor the service.

Our age-assurance process is based on self-declared dates of birth.

Consent process for user profiles

• Under 13: the parent or guardian provides explicit consent on the child’s behalf.

• Age 13 to 17: the parent or guardian provides explicit consent. The young person is also provided with clear, age-appropriate privacy information and asked to acknowledge that they understand how BeBright uses their information. This acknowledgement is not a separate consent.

• Age 18 and over: the individual provides consent for themselves.

Each child profile is treated separately. Where an adult adds more than one child, separate consent is obtained and recorded for each child, and consent may be withdrawn separately.

Verifying parental authority

We take proportionate steps to confirm that an adult creating a child profile has parental responsibility. We normally:

• ask the adult to declare that they have parental responsibility;

• collect their name, relationship to the child and contact details;

• require a positive response to a confirmation email before the questionnaire is available; and

• retain an auditable record of the verification step and consent wording.

We do not normally request documentary evidence. We may do so where there are reasonable grounds to question whether the adult has authority to provide consent.

Unverified onboarding information is deleted after 30 days.

If you believe that a child’s information has been provided without proper authority, please contact us at privacy@bebright.ai.

8. Marketing

We may send you information about BeBright where you have requested it, consented to receive it, or where otherwise permitted by law.

• Individual customers and users: we will obtain consent where required for electronic marketing.

• Business contacts: we may send relevant business-to-business communications where permitted by law and where our legitimate interests in promoting our services are not overridden by your rights.

You can opt out at any time by using the unsubscribe link in an email or by contacting us. Opting out of marketing will not stop essential service communications, such as booking confirmations or security notices.

9. Who we share personal data with

We share personal data only where necessary and in the following circumstances:

• service providers that support our operations, these include Amazon Web Services, Stripe, SendGrid, Mailchimp, Google Workspace/Google Calendar, Google Meet, Firebase and Sentry;

• practitioners you choose to book, who receive only the identity and booking details needed to manage the appointment and act as independent controllers;

• professional advisers, including lawyers, accountants, auditors, insurers and bankers;

• HMRC, regulators, law-enforcement bodies and other authorities where required by law; and

• a buyer, investor or other third party involved in a proposed or completed sale, merger, restructuring or transfer of our business.

We require our service providers to protect personal data and use it only as necessary to provide services to us.

10. International transfers

Some of our service providers operate internationally and may transfer personal data outside the UK. Where this occurs, we will ensure appropriate safeguards are in place, such as an adequacy regulation or the UK International Data Transfer Agreement or Addendum.

Please contact privacy@bebright.ai if you would like further information.

11. How long we keep personal data

We retain personal data only for as long as necessary for the purposes described in this notice, including to comply with legal obligations and deal with complaints or legal claims. We may retain limited information for longer where necessary for legal, regulatory, complaint or litigation purposes.

12. Security

We use appropriate technical and organisational measures to protect personal data. These include encryption in transit and at rest, field-level encryption of identifiable data, separate encryption-key management, role-based access controls and limiting access to people who need it for their role.

13. Cookies and analytics

Our app uses Sentry for error logging and app-store analytics. It does not use Google Analytics.

Our website uses Google Analytics 4 and Framer analytics. Where we use non-essential cookies or similar technologies, we will provide appropriate information and obtain consent where required.

For further information, please see our Cookie Policy.

14. Your rights

Subject to certain legal conditions, you have the right to:

• request access to your personal data;

• ask us to correct inaccurate or incomplete data;

• ask us to erase personal data;

• ask us to restrict processing;

• object to processing based on legitimate interests, including direct marketing;

• receive personal data you have provided in a structured, commonly used and machine-readable format, where applicable; and

• withdraw consent at any time where we rely on it.

To exercise any of these rights, contact privacy@bebright.ai.

We may need to verify your identity before responding. We will usually respond within one month. We do not usually charge a fee, although we may charge a reasonable fee or refuse a request where it is manifestly unfounded, repetitive or excessive.

15. Complaints

Please contact us first at privacy@bebright.ai if you have concerns about how we use personal data.

Please provide enough information to help us understand and investigate your complaint. We will acknowledge your complaint within 30 days of receiving it and will respond without undue delay. If we need further information from you in order to investigate your complaint, we may contact you.

We encourage you to contact us first so that we have the opportunity to investigate and try to resolve the issue.

You also have the right to complain to the ICO:

• Website: ico.org.uk

• Telephone: 0303 123 1113

16. Changes to this notice

We may update this notice from time to time. If we make a material change, we will notify you through the app, website or by email where appropriate.

Last updated: August 2026