Privacy Notice for Online Support and Intervention for Child Anxiety (OSI)

The Data Controller is the organization or therapist who has provided you with OSI to assist your child or guards treatment. Koa Health provides the digital therapy tools that facilitate the treatment as a service to the data controller. The therapist will provide information about their privacy notice and the treatment as part of the proposed treatment using digital therapy tools. In cases where there is a contradiction between this document and information you receive from the Therapist, information from your therapist takes precedence.

Your therapist and the clinical team can answer any questions you have about the treatment. The technical support functionality of the Digital Therapy Tools should only be used for technical issues and is not a clinical support line.

You can also contact Koa at privacy@koahealth.com for any privacy-related matter. The Data Protection Officer may be contacted at dpo@koahealth.com.

The Digital Therapy Tools collects personal data from you to create the account and uses your email and telephone number so that you can log in and manage your account.

You may receive emails and SMS messages from the applications as part of the login process and as notifications that you have new messages from your therapist/patient in the application. This communication is part of the core app functionality, coordinating the treatment.

If you have difficulty logging in or otherwise accessing the Digital Therapy Tools, you may contact the technical support desk via the web page. They will assist you only with technical issues. Clinical queries should only be directed to your clinical teams.

The Digital Therapy Tools are designed to help therapists support you with your children experiencing anxiety problems. The different information collected during the modules will help you build skills to help your wards via videos and questionnaires. This information then feeds into the therapist’s view, so the support can be as targeted as possible.

Your treatment team must oversee your care, including tracking its effectiveness. To do this, they analyze outcome measures and demographic data based on the information you provide using Digital Therapy Tools. This data may also be used anonymously to help improve the product in the future.

To improve clinical effectiveness in this way, clinical psychologists and scientists consider information such as age, gender, ethnicity, outcome metrics, communication with therapists, how often and for how long patients use the Digital Therapy Tools. The clinical analysis is conducted using pseudo-anonymous data. In cases where the improvement may benefit the clinical psychology scientific community, anonymous data will be used for academic research

The Digital Therapy Tools help you deliver therapy to your patients, collecting their information and therapy progress through the modules. The Digital Therapy Tools also store communications and recording sessions with your patients. All collected data is only visible to you and your clinic.

The functionalities of the Digital Therapy Tools require the collection of personal data. We collect and process the minimum data necessary for each purpose, and we will only keep it for as long as we provide you with a service.

Guardian’s name and last name, Email Address, Phone number, post code, and relationship with the patient.
Therapist’s email, first and last name
Observer account email address, full name, and relationship to the patient
Patient name and surname, date of birth, gender, and other demographic information
Clinical information about the patient’s condition
Guardian’s answers to questionnaires within the Digital Therapy Tools
Guardian’s notes on key learnings
Messages and recordings with therapists
Information about your device

We infer from your usage of the Digital Therapy Tools the following information.

Telemetry on logins
Completed modules
Number of references to module pages during treatment
How much are you using the Digital Therapy Tools
Which parts of the Digital Therapy Tools you find most interesting

We only share data as needed and always minimally in order to provide the service. For example, we use industry-leading companies to provide data center services on which the services run. This is the type of data sharing that we do: specific activities such as hosting, providing customer support, or notifications via email or SMS. We only share the minimum information and authorize our service providers to process your information following our instructions. We make sure that our service providers erase all your personal information right after their services are finished.

The data collected is stored based on your location: if you are in the UK or EU, your data on using Digital Therapy Tools will be hosted on Amazon Web Services (AWS) servers in the UK. If you are in the US, your data is stored on AWS servers located in the US.

The Data you share with the Technical support desk, for example, a query when you cannot log in, is managed in the EU data centre.

Some of our service providers that provide technical support may transfer some non-clinical, non-personal, non-sensitive data outside your region. We take appropriate measures to ensure that our providers comply with applicable local laws in all data processing activities. This includes requiring suitable safeguards, such as Standard Contractual Clauses, or conducting thorough vendor assessments.

Internal team members shall process your personal data only for the purposes established in this Privacy Notice, following professional responsibilities and contractual obligations. We take appropriate measures to guarantee our employees’ fair and confidential use of all personal data.

Your data is never shared with third parties who might abuse it or exploit it commercially. The only purpose of the Digital Therapy Tools is to support you and your clinical team in the treatment program.

We may retain your data for different periods of time, depending on the type of data involved and the purposes of the processing, but generally, following these criteria:

Depending on your therapist’s data retention policies, we may need to store your information to comply with local data retention laws they are obligated to follow. We will delete your data upon instruction from the Data Controller or if you request your therapist to delete your data.

Data protection laws give you a series of rights regarding the personal information that we manage about you. Specifically, these rights include access, rectification, erasure, limitation, objection, and portability, as well as not being subject to automated decisions and the right to remove your consent at any time.

The best way to exercise these rights is via the therapist, who is the Data Controller, and you will have been provided with information on how to do this. Your therapist is responsible for managing these rights and will typically respond to your requests within a maximum of 30 days, although that period may be extended by two further months if necessary. If you do make this request to Koa Health, we will pass the request to your therapist. The privacy team at Koa Health may be contacted at privacy@koahealth.com.

If possible, please use the same email address that you use within the Digital Therapy Tools and identify the right you want to request. In the event that you decide to exercise one of these rights through a representative, it will be necessary to provide with the request, the documentation that proves this condition

If you feel your data privacy rights have been breached, you also have the right to file a complaint with your Data Protection Control Authority.

We are responsible for ensuring the security, integrity and confidentiality of your personal information. Therefore, as part of our commitment and in compliance with current legislation, we have adopted the most demanding and robust security measures and technical means to prevent their loss, misuse or access without your authorization.

We protect all communications between the Digital Therapy Tools and the servers in line with best practice by using TLS for encryption and server authentication. We use ISO 27001 and SOC2 certified systems in order to protect your registration information including email and password. We store your personal data in an encrypted database.

Also, we promise to act quickly and responsibly in the event that the security of your data may be in danger, and to inform you if necessary.

We may modify this Privacy Notice from time to time and will post any revisions on our Digital Therapy Tools. We will indicate at the bottom of the Privacy Notice the Effective Date of the most recent update. If an update requires additional notice to you or your consent, we will contact you to provide that notice or seek that consent.

Effective From: June 2025