Trust centre

Your data and your rights

Family Emotional Health Ltd is the data controller for Assembly under UK GDPR. Here's what that means in practice: what we hold, and what you can make us do with it.

What we hold

We only keep what's needed to run your account and the service. Your child's profile, answers and reports are processed in the UK, in Microsoft Azure. The only thing processed outside the UK is usage analytics (PostHog, EU): it's linked to a session, not your name, and it never receives your child's profile, answers or reports. Sign-in is passwordless and runs inside our own application: no third-party identity provider ever holds your account.

  • Your account , Your email address and sign-in records, held in our own UK database. Sign-in is passwordless (an emailed link, or an emailed one-time code); no third-party identity provider is involved.
  • Your children , Names, dates of birth and gender for the children you add.
  • Answers and observations , Profiler answers and any free-text observations you share, per child.
  • Chats and messages , Conversation history with Assembly, per child.
  • Reports , Generated reports and PDFs for each child, stored in UK cloud storage with authenticated, logged downloads.
  • Programme progress , Which programmes and episodes you've started or completed, per child.
  • Waitlist and enquiries , If you join the waitlist or register interest from the public site, we hold the email address you give us, and for an organisation enquiry your name, organisation, role and message. Held in UK cloud storage, kept apart from the product database, and only after you confirm the address by email. Ask us to delete it at any time and we will.
  • Usage analytics , Which features are used (PostHog, EU), so we can improve the product. Tied to a session, but never your child's profile or answers. We don't sell your data.

The full detail, including lawful bases, is in the privacy policy. Who processes it on our behalf is listed openly at who processes your data.

Your rights, and how to actually use them

Every right below is free to exercise, and none of them needs a form or a phone call. Several you can exercise yourself in the app, without asking us at all: downloading a child's data, deleting it, and taking back a school's access. For the rest, we respond within one calendar month, usually much faster.

See what we hold

Right of access

For a child, download it yourself: their page in the app exports everything we hold about them, in a readable format, straight away. For your own data, or for everything at once, ask us and we'll send it within one calendar month, free of charge.

Request a copy of your data

Fix what's wrong

Right to rectification

If anything we hold is inaccurate, a name, a date of birth, an answer you gave, you can correct much of it in the app, or ask us to correct it for you.

Ask us to correct something

Delete it

Right to erasure

Delete a child's record yourself, from that child's page in the app: it's immediate and it's permanent. Closing your whole account still comes to us. This has its own page, because it should be easy to find.

How deletion works

Take your data with you

Right to portability

The download on a child's page is a structured, machine-readable export you can take elsewhere, with no request and no wait. Ask us for anything it doesn't cover.

Request an export

Take back a school's access

Right to withdraw consent

Sharing a child's profile with a school or clinic is a consent, and you can take it back from that child's page in the app, at any time, without asking us. Withdrawing stops access from then on; it can't recall what somebody already downloaded.

Ask us to withdraw it for you

Pause or limit processing

Right to restriction and objection

Ask us to stop or limit what we do with your data, including analytics, while keeping your account.

Object to processing

Complain to the regulator

Right to lodge a complaint

You can raise a concern with the Information Commissioner's Office at any time, free, without asking us first.

ICO complaints

Who answers

Requests go to our named data-protection lead at ayse@getassembly.co.uk , a person accountable for the answer, not a shared inbox that routes to nowhere.