Privacy Policy

1. Who We Are

Continuum is operated by Continuumco Ltd; a company registered in England and Wales (company number 15602004). We are the data controller for personal data processed through the platform.

Registered address: 26 Charlwood Road, London, SW15 1PW

Data protection contact: contact@continuum.ac

2. The Two Types of Users

Continuum is used by two distinct groups of people, each with different data relationships.

Practitioners

Mental health professionals and coaches who use Continuum to support their clients. Practitioners access the platform under a professional agreement with Continuum.

Clients

Individuals introduced to Continuum by their practitioner as part of their care. Clients interact with the platform through a dedicated app.

This policy explains how we handle data for both groups. Where the position differs, we say so clearly.

3. What Data We Collect

3.1 Practitioner Data

When you use Continuum as a practitioner, we collect:

• Account information: name, email address, professional credentials
• Session-related inputs: notes, annotations, tasks, insights and resources
• Usage data: how you interact with the platform, feature usage, login activity
• Communications with Continuum support
• Google Calendar connection, if you choose to connect one: the Google account's email address and identifier, the access granted by Google (stored encrypted) and the times you are busy

3.2 Client Data

When you use Continuum as a client, we collect:

• Account information: name, email address, and basic profile details
• Between-session activity: mood logs, journal entries, task completions, and responses to check-ins
• Assessment responses provided through the app
• Session transcript data, where you have consented to the automated note taker and your practitioner uses it. Your speech is transcribed in real time to produce a transcript, which is used to generate notes for your practitioner. No audio recording of the session is kept
• Your name and the type of session, shown in your practitioner's own Google Calendar if they have connected one (see section 7)
• Behavioural patterns derived from your activity in the app
• Usage data: how you interact with the app

Mental health data is special category data under UK GDPR Article 9. We treat it with the highest level of care and apply additional technical and organisational safeguards accordingly.

4. Why We Use Your Data and Our Lawful Basis

4.1 Practitioners

We process practitioner data to:

• Provide and operate the Continuum platform under our agreement with you (lawful basis: contract performance)
• Maintain platform security and prevent misuse (lawful basis: legitimate interests)
• Comply with legal obligations (lawful basis: legal obligation)

4.2 Clients

We process client data to:

• Deliver the Continuum service, including sharing relevant between-session data with your practitioner to support your care (lawful basis: health care provision under Article 9(2)(h), and contract under Article 6(1)(b))
• Generate pre-session summaries and behavioural insights for your practitioner (lawful basis: health care provision)

We do not currently use client data to train or improve our AI tools. If we decide to do so in future, we will update this policy and, where required, seek your consent before any such use begins.

5. AI Training and Platform Improvement

We are continually working to improve Continuum. At present, we do not use your personal data, whether identifiable or anonymised, to train our AI models. If we introduce this in future, we will update this policy first and, where the law requires it, obtain your consent before any such use begins. We will never sell your data or share it with third parties for their own purposes.

6. Data Sharing

6.1 Your Practitioner

Client data is shared with your practitioner as a core part of the service. Your practitioner can see your between-session activity, check-in responses, and any summaries generated by the platform. This is how Continuum works.

6.2 Sub-processors

We use a small number of third-party services to operate the platform. These sub-processors are contractually bound to handle your data only on our instructions and in accordance with UK GDPR. Our current sub-processors include:

• Mistral AI: artificial intelligence and language model processing
• Loops: email communications and notifications
• Clerk: user authentication and account management
• Daily: video session infrastructure and the real-time transcription used by the automated note taker
• Google: calendar sync, only for practitioners who connect their own Google Calendar (see section 7)

We will update this list as our sub-processors change.

6.3 International Transfers

Some of our sub-processors may process data outside the United Kingdom. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or transfers to countries covered by UK adequacy regulations. We will set out the specific location and safeguards for each sub-processor in this section once confirmed.

Google LLC processes Google Calendar data in the United States. These transfers rely on the UK Extension to the EU–US Data Privacy Framework and on Google's standard contractual clauses.

6.4 What We Never Do

We do not sell your personal data. We do not share your personal data with third parties for their own marketing or commercial purposes. We do not provide practitioner or client data to insurers, employers, or any other party without your explicit consent or a legal obligation to do so.

7. Google Calendar

Practitioners can choose to connect their Google Calendar in Settings. Clients and people who book through a practitioner's booking page never connect a Google account, but if their practitioner has connected one, their name and the session type appear in that practitioner's Google Calendar, as described in 7.2. When a practitioner connects Google Calendar, they grant Continuum two calendar permissions on their Google account, plus permission to see the account's email address, and we use them only for the booking features described here.

7.1 What We Read

• The times when the practitioner is busy in their primary Google Calendar (free/busy information). We never read the titles, descriptions, attendees, locations or any other details of their events.
• The email address and account identifier of the connected Google account, so the practitioner can see which account is connected and we can tell when they connect a different one.

We use the busy times so that clients and visitors to the practitioner's booking page are only offered times when the practitioner is free.

7.2 What We Write

For each session booked in Continuum, we create one event in the practitioner's primary Google Calendar so their sessions appear alongside their other commitments. When the session is moved or cancelled in Continuum, we update or remove that event. The event is titled with the session type's name, as the practitioner wrote it, and the client's name (for a prospect, the name they gave when booking), and otherwise contains only its date and time, the kind of session (video, phone or in person) and a link back to the practitioner's Continuum calendar. Continuum never puts the client's contact details, notes or any clinical information in an event itself. The session type's name is the practitioner's own text, which Continuum does not check. We never change or delete events that Continuum did not create. The event is then held by Google in the practitioner's own Google account, under Google's terms, and anyone the practitioner shares that calendar with can see it. Practitioners should choose session type names that do not reveal clinical information.

7.3 How We Store It

• Busy times are stored as start and end times only, and are replaced each time we refresh them from Google.
• The access granted by Google is stored encrypted, and is used only by Continuum's servers.
• For each session sent to Google Calendar, we store the identifier of the event and a link to it, so that we can update or remove it later.
• We do not share or sell Google user data, we do not use it for advertising, and we do not use it to train AI models. No one at Continuum reads it, except where the practitioner asks us to for support, for security reasons, or where the law requires it.

7.4 Disconnecting

A practitioner can disconnect Google Calendar at any time in Settings, under Booking, then Google Calendar, then Disconnect. Continuum then asks Google to revoke its access and deletes the stored busy times and the stored access. We keep a record that the connection existed, with the Google account's email address and identifier, until the practitioner's Continuum account is deleted. Events Continuum already created stay in the practitioner's calendar, where they can delete them. Events for sessions with a client or prospect whose data is later deleted from Continuum also stay in the practitioner's Google Calendar. If a practitioner deletes their Continuum account, we ask Google to revoke our access to their Google Calendar and delete all the Google data we hold; events already created stay in their calendar. Access can also be removed from the third-party connections page of the Google account.

7.5 Limited Use

Continuum's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. Data Retention

We retain personal data for as long as necessary to deliver the service and meet our legal obligations.

• Active accounts: data is retained for the duration of your use of the platform
• After account closure: personal data is deleted within 7 years, subject to any legal retention obligations
• Session transcripts: retained for 7 years and then deleted unless you or your practitioner request earlier deletion
• Google Calendar busy times: replaced at each refresh and deleted when the practitioner disconnects Google Calendar

If you request deletion of your data, we will action it promptly. In some cases, we may be required to retain certain records for legal or regulatory reasons, and we will tell you if that applies.

9. Security

We take the security of your data seriously, particularly given the sensitive nature of mental health information. Our measures include:

• Encryption of data in transit and at rest
• Access controls limiting who within Continuum can access personal data
• Regular review of our security practices
• Contractual security obligations on all sub-processors

No system is completely immune to risk. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the ICO as required by law.

10. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access: you can request a copy of the personal data we hold about you
• Right to rectification: you can ask us to correct inaccurate data
• Right to erasure: you can ask us to delete your data, subject to legal retention obligations
• Right to restriction: you can ask us to limit how we use your data in certain circumstances
• Right to data portability: you can request your data in a portable format
• Right to object: you can object to processing based on legitimate interests

To exercise any of these rights, contact us at contact@continuum.ac. We will respond within one month.

You can also delete your account yourself at any time, in the app under Manage account, then Delete account. Instructions are at www.continuum.ac/delete-account.

If you are a client and wish to raise a concern about how your data is handled, you can also speak to your practitioner, who introduced you to the platform.

11. Complaints

If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner’s Office (ICO).

ICO website: ico.org.uk

ICO helpline: 0303 123 1113

We would always prefer to resolve concerns directly first. Please contact us at contact@continuum.ac before escalating to the ICO and we will do our best to address your concern promptly.

12. Changes to This Policy

We will update this policy as the platform develops. Where changes are material, we will notify you by email or through the platform before they take effect.

The current version and effective date are shown at the top of this document.

13. Contact

Continuumco Ltd

Company number: 15602004

Email: contact@continuum.ac

Website: www.continuum.ac