Trust centre

Your data and your rights

Family Emotional Health Ltd is the data controller for Assembly under UK GDPR. Here's what that means for you. What we hold, and what you can make us do with it.

What we hold

We only keep what's needed to run your account and the service. Your child's profile, answers and reports are stored in the UK, in Microsoft Azure. To write a report or a reply in chat, Microsoft's AI service may process the request in another Azure region; what is kept is kept in the UK, and nothing you give us is used to train AI models. Usage analytics (PostHog) is processed in the EU: it's linked to a session, not your name, and it never receives your child's profile, answers or reports. Sign-in is passwordless and runs inside our own application.

Your account , Your email address and sign-in records, held in our own UK database, and your first name if you choose to give it. We use the name to greet you and to show who is signed in. Sign-in is passwordless (an emailed link, or an emailed one-time code); no third-party identity provider is involved.
Your children , The name you give us (we ask for a first name), an approximate age, and gender or pronouns for the children you add. A child added by a school may also carry a surname initial. We never record a full date of birth.
Answers and observations , Profiler answers and any free-text observations you share, per child.
Chats and messages , Conversation history with Assembly, per child.
Reports , The written report for each child, held in our UK database. A PDF is built when you ask for one and is not kept afterwards; every download is authenticated and logged.
Programme progress , Which programmes and episodes you've started or completed, per child.
Waitlist and enquiries , If you join the waitlist or register interest from the public site, we hold the email address you give us, and for an organisation enquiry your name, organisation, role and message. It is saved in UK cloud storage, kept apart from the product database, as soon as you submit the form, and marked unconfirmed until you follow the link in the email we send you. Once you confirm an organisation enquiry, a copy is also emailed to our inbox. Ask us to delete it at any time and we will.
Usage analytics , Which features are used (PostHog, EU), so we can improve the product. Tied to a session, but never your child's profile or answers. We don't sell your data.

The full detail, including lawful bases, is in the privacy policy. Who processes it on our behalf is listed openly at who processes your data.

Your rights, and how to actually use them

Every right below is free to use. None of them needs a form or a phone call. You can use some of them yourself in the app, without asking us at all. You can download a child's data, delete it, and take back a school's access. For the rest, we reply within one calendar month, and often much sooner.

See what we hold

Right of access

For a child, download it yourself. Their page in the app gives you all we hold about them, in a form you can read, straight away. For your own data, or for all of it at once, ask us. We'll send it within one calendar month, free of charge.

Request a copy of your data

Fix what's wrong

Right to rectification

If we hold something that is wrong, like a name, an age or an answer you gave, you can fix most of it in the app. Or ask us to fix it for you.

Ask us to correct something

Delete it

Right to erasure

Delete a child's record yourself, from that child's page in the app. It's removed from the live service straight away. Copies can stay in our backups for a while. To close your whole account, you still ask us. This has its own page, because it should be easy to find.

How deletion works

Take your data with you

Right to portability

The download on a child's page is a file that other systems can read, so you can take it with you. You don't need to ask, and you don't wait. Ask us for anything it doesn't cover.

Request an export

Take back a school's access

Right to withdraw consent

When you share a child's profile with a school or clinic, you give consent. You can take it back from that child's page in the app, at any time, without asking us. That stops their access from then on. It can't undo what someone has already downloaded.

Ask us to withdraw it for you

Pause or limit processing

Right to restriction and objection

Ask us to stop or limit what we do with your data, including analytics, while keeping your account.

Object to processing

Complain to the regulator

Right to lodge a complaint

You can raise a concern with the Information Commissioner's Office at any time, free, without asking us first.

ICO complaints

Who answers

Requests go to the named person who leads on data protection, at info@helloassembly.com . A real person owns the answer. It is not a shared inbox that goes nowhere.