Privacy policy

1. Definitions

1.1. Personal data — information or a set of information about a natural person who is identified or can be specifically identified.

1.2. Sensitive personal data — personal data relating to health, psycho-emotional state, disability, and other data that under the law require an enhanced level of protection.

1.3. Processing of personal data — any action or set of actions, such as collection, registration, accumulation, storage, adaptation, modification, renewal, use and dissemination (distribution, sale, transfer), depersonalisation, destruction of personal data, including with the use of information (automated) systems.

1.4. Personal data controller — the Organisation, which determines the purpose of personal data processing, the composition of such data and the procedures for their processing.

1.5. Personal data processor — a natural or legal person to whom the Controller transfers personal data on the basis of a contract for processing in accordance with the defined purpose.

1.6. CRM system — an information system for managing user interactions (including Creatio) used by the Organisation to administer enquiries, registrations and to coordinate the activities of psychologists.

1.7. Mobile application — the Self-Help App software administered by the Organisation, which provides psycho-emotional support, self-help and contact with counsellors.

1.8. Website — the Organisation's website www.uamentalhelp.org.

2. Subject of the Policy

2.1. This Policy defines the conditions, procedures and legal grounds for the Organisation's processing of personal and sensitive personal data provided by Users in connection with: registration in the Self-Help App or on the Website; completion of forms, questionnaires, tests (including GAD-7, PHQ-9); participation in online or offline consultations; contacting the Organisation or interacting with its specialists; transfer of information of a technical or administrative nature.

2.2. The Policy applies to all information that may be collected by the Organisation during use of the digital services, regardless of the device used to access them.

2.3. This Policy is a public offer to the User and an integral part of the terms of use of the mobile application, the Website and related services.

2.4. The Organisation's digital services are intended exclusively for persons aged 18 and over. Registration and use by minors without the permission of a legal representative are prohibited.

3. Purposes of processing

3.1. Personal data are processed exclusively for the purposes of:

3.1.1. providing psychological aid, psycho-emotional support and conducting individual or group consultations (legal basis: Art. 6(1)(a) GDPR — consent; for sensitive data — Art. 9(2)(a) GDPR — explicit consent);

3.1.2. organising, administering and documenting the counselling process (legal basis: Art. 6(1)(b) GDPR — necessity for performance of obligations to the User);

3.1.3. carrying out supervisions and internal quality analysis of services provided (in depersonalised form only) (legal basis: Art. 6(1)(f) GDPR — legitimate interest of the Organisation);

3.1.4. enabling exchange of information between the User and the Organisation's specialists (legal basis: Art. 6(1)(a), (b) GDPR — consent and/or contractual necessity);

3.1.5. pursuing the Organisation's legitimate interests, in particular compliance with legal requirements regarding personal data protection (legal basis: Art. 6(1)(c) and 6(1)(f) GDPR — legal obligation and/or legitimate interest).

4. Categories of personal data processed

4.1. Within the purposes defined in this Policy, the Organisation processes personal data of Users obtained directly from the data subject or in the course of their use of the Self-Help App, the Website and other digital services, as well as during in-person or remote participation in psychological counselling.

4.2. The personal data that may be processed by the Organisation include:

4.2.1. Identification data allowing the User to be identified, in particular surname, name, patronymic (when voluntarily provided), date of birth, gender, and a unique system identifier created within technical records;

4.2.2. Contact data necessary for communicating with the User, including phone number, email address and other means of contact the User may indicate during registration or while receiving services (for example, messenger accounts or in-app profiles);

4.2.3. Socio-demographic information voluntarily provided by the User or obtained through screening questionnaires, including age, region of residence, type of employment, social status;

4.2.4. Information about the User's psycho-emotional state obtained through standardised initial assessment tools (including but not limited to GAD-7, PHQ-9), as well as other answers to screening forms, questionnaires or self-formulated requests containing information about emotional, mental or behavioural state;

4.2.5. Information communicated by the User during psychological consultations, including the substance of requests, personal experiences and descriptions of life situations which, depending on context, may directly or indirectly contain sensitive personal data;

4.2.6. Sensitive personal data relating to the User's health, including mental health, obtained in the course of providing psychological aid. Such data include information on complaints, psycho-emotional features, prior experience of psychotherapy or psychiatric intervention, and any information that under the law may be considered medical or constitute medical confidentiality. Collection and processing of such data is carried out exclusively with clear, informed and voluntary consent of the data subject and with special security guarantees;

4.2.7. Technical information generated through interaction with the Organisation's digital services, including data on the User's device, IP address, time and date of sessions, interface language, app version, type of operating system, browser, technical access logs and other information automatically recorded to ensure functioning of the service, data protection and quality improvement.

4.2.8. Processing of these categories is carried out only to the extent necessary to achieve the purposes of this Policy. If the purposes change, the Organisation undertakes to obtain new informed consent from the User in advance.

5. Mechanism for collecting, confirming and withdrawing consent

5.1. Before commencing processing of personal data the Organisation ensures that proper, freely given, specific, informed and unambiguous consent is obtained from the User in accordance with Art. 7 GDPR and the Law of Ukraine «On the Protection of Personal Data».

5.2. In electronic interaction the User's consent is deemed given if the User has performed a clear affirmative action, including but not limited to: 5.2.1. ticking a checkbox in an electronic form on the Website or app; 5.2.2. clicking buttons such as «Send», «Confirm», «Agree»; 5.2.3. submitting an electronic application/form containing personal data; 5.2.4. passing technical verification (identification by ID code, token or other unique parameter); 5.2.5. confirming familiarity with this Policy and accepting the User Agreement.

5.3. Consent is recorded by the CRM system or other software, capturing: 5.3.1. date and time of consent; 5.3.2. the user identifier; 5.3.3. IP address, device and type of interaction; 5.3.4. the consent mechanism used (checkbox, button, email, etc.).

5.4. All data related to consent are kept for the period defined by this Policy and may be used as evidence of proper informing of the User.

5.5. Sensitive personal data (in particular about health and psycho-emotional state) are processed only on the basis of separately given, explicitly expressed consent in accordance with Article 9 GDPR and Article 7 of the Law of Ukraine «On the Protection of Personal Data».

5.6. The User has the right to: 5.6.1. refuse to give consent before processing begins; 5.6.2. withdraw consent at any time by sending a notice 5.6.3. by email to the Organisation's official address; 5.6.4. via the Personal Cabinet or relevant online form; 5.6.5. or in writing (in the case of offline interaction).

5.7. Upon withdrawal of consent: 5.7.1. the record in the CRM or other system is updated with the date and time of withdrawal; 5.7.2. processing is stopped (except as required by law); 5.7.3. the User may be restricted from accessing services that require such processing (for example, psychological consultations), of which the User will be informed in advance.

6. Methods, terms of processing and storage

6.1. Processing of personal data is carried out in accordance with the principles of lawfulness, good faith, transparency, proportionality and data minimisation.

6.2. Personal data are processed both with and without automated tools through one or more actions: collection, registration, systematisation, accumulation, storage, clarification (renewal, modification), use, depersonalisation, blocking, deletion and destruction.

6.3. Data are processed using digital platforms, including but not limited to the Self-Help App, the Organisation's Website, internal electronic document management tools, and the Creatio CRM system used for organisational administration, technical support, processing of enquiries, communication with counsellors and scheduling sessions.

6.4. The retention period for User personal data does not exceed 36 (thirty-six) months from the date of the User's last interaction with the Organisation, except where a longer period is justified by: 6.4.1. compliance with statutory obligations to state authorities; 6.4.2. protection of the Organisation's legitimate interests in connection with possible claims, requests or court disputes; 6.4.3. separate written consent of the User to extended storage.

6.5. After the retention period expires, personal data are destroyed or depersonalised unless mandatory rules of Ukrainian or EU law provide otherwise.

6.6. The Organisation does not process personal data for the purpose of automated decision-making with legal effects on the User, including profiling, without prior notice and obtaining separate consent.

6.7. The Organisation takes all reasonable steps to ensure the accuracy and relevance of processed personal data and timely updating of such information based on User requests.

7. Transfer of personal data to third parties

7.1. The Organisation may transfer personal data of Users to third parties only in cases provided by this Policy, the User's consent, current Ukrainian law and/or the GDPR, and only within the purposes of processing.

7.2. Personal data may be transferred to the following categories of third parties: 7.2.1. Data Processors — legal or natural persons processing personal data on behalf of the Organisation strictly under a relevant contract. This includes providers of CRM systems (in particular Creatio), cloud services, testing tools, electronic communication services, etc. All such processors must ensure an adequate level of data protection and act exclusively on the Organisation's instructions. 7.2.2. Counsellors, psychologists, supervisors — only to the extent necessary to provide the User with psychological aid and support, subject to professional ethics and confidentiality. 7.2.3. State authorities — only on the basis of lawful demands, court orders or where there is a potential threat to the life, health or safety of the User or others.

7.3. Cross-border transfer of personal data, including to countries outside the European Union or European Economic Area, may be carried out only where: 7.3.1. the requirements of Articles 29–32 of the Law of Ukraine «On the Protection of Personal Data» are met; 7.3.2. an adequate level of protection is ensured in the country of destination; 7.3.3. separate informed consent of the User is given, where required by law.

7.4. The Organisation does not transfer personal data for direct marketing or commercial benefit of third parties.

7.5. All third parties to whom personal data may be transferred must comply with this Policy and provide adequate organisational and technical security guarantees.

8. Personal data protection

8.1. The Organisation considers protection of personal and sensitive personal data one of its key obligations and takes all necessary legal, organisational and technical measures to ensure their confidentiality, integrity and availability in accordance with the Law of Ukraine «On the Protection of Personal Data», the GDPR and other relevant acts.

8.2. To protect personal data we implement a set of measures, including: 8.2.1. Organisational measures: appointment of a person (or unit) responsible for compliance with personal data protection requirements; regular training of employees and counsellors on confidential handling of personal data; granting access only to those who need it for their professional duties; entering into confidentiality agreements with all persons involved in processing. 8.2.2. Technical measures: use of certified software and secure communication channels (HTTPS, SSL/TLS); access restrictions to information systems containing personal data via multi-factor authentication; regular software updates, antivirus protection and monitoring of unauthorised access attempts; backups stored in a secure environment; security audits. 8.2.3. Procedural measures: maintaining an internal personal data processing log; regular review and updating of internal documentation; incident response procedures and notification of relevant state authorities and data subjects in case of breaches.

8.3. We undertake to immediately inform data subjects in case of a security breach that may pose a risk to their rights and freedoms and, if necessary, notify the Ukrainian Parliament Commissioner for Human Rights or the supervisory authority in the data subject's jurisdiction.

8.4. The Organisation continuously improves its personal data protection system in light of technological developments, best practices and legislative changes.

9. Rights of data subjects

9.1. All data subjects whose personal or sensitive personal data are processed by the Organisation have the rights provided by law, the exercise of which is guaranteed in accordance with the Law of Ukraine «On the Protection of Personal Data» and the GDPR.

9.2. In particular, a data subject has the right to: 9.2.1. know about the sources of collection, location of their personal data, the purposes of processing, and the location or place of residence of the Controller or Processor. 9.2.2. obtain information about the conditions of access to personal data, including information about third parties to whom data are transferred. 9.2.3. access their personal data and the content of such data within thirty calendar days of the relevant request, except as provided by law. 9.2.4. submit a reasoned objection to processing if such processing is unlawful or does not correspond to the declared purpose. 9.2.5. demand modification or destruction of their personal data if processed unlawfully or inaccurate. 9.2.6. be informed about automated processing mechanisms, where applicable. 9.2.7. challenge processing before the Ukrainian Parliament Commissioner for Human Rights or in court. 9.2.8. withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. 9.2.9. apply legal means of protecting their rights in case of breach of processing or protection rules. 9.2.10. The data subject may withdraw consent at any time by email, via the Personal Cabinet or in writing. The Organisation stops processing as soon as possible but no later than 5 working days from receipt of the notice.

9.3. If the User is in the European Union, they have additional rights, including: 9.3.1. the right to restriction of processing; 9.3.2. the right to data portability; 9.3.3. the right to object to processing, including direct marketing; 9.3.4. the right not to be subject to automated decisions with legal effects or significant impact; 9.3.5. the right to lodge a complaint with the supervisory authority in the relevant jurisdiction.

9.4. Exercise of data subject rights: 9.4.1. To exercise their rights, the data subject may contact the Organisation in writing or electronically using the contact details in this Policy. 9.4.2. To handle the request properly and prevent fraud, the Organisation may request identity verification. 9.4.3. The Organisation undertakes to respond within 30 calendar days of receiving the request. 9.4.4. If the request is manifestly unfounded or excessive, the Organisation may charge a reasonable fee or refuse the request with a justification.

10. Conditions for transferring personal data to third parties

10.1. The Organisation may transfer personal and sensitive personal data to third parties only in cases provided by Ukrainian law, in particular the Law of Ukraine «On the Protection of Personal Data», and where applicable the GDPR.

10.2. Transfer to third parties may be carried out only within the defined purpose of processing, provided such parties ensure an adequate level of data protection no lower than that established by this Policy and the law.

10.3. In particular, personal data may be transferred to: 10.3.1. Data Processors — entities with which the Organisation has entered into relevant contracts (in particular, the Organisation uses CRM Creatio for processing and administering enquiries). 10.3.2. Counsellors, psychologists and specialists of the Organisation — to the extent necessary to provide services. 10.3.3. State, law-enforcement or supervisory authorities — only in cases directly provided by law. 10.3.4. Partners or donor organisations — only in depersonalised (anonymised) form.

10.4. All third parties receiving personal data must use them only for the defined purpose, not disclose them without the User's consent and ensure adequate technical and organisational protection.

10.5. The Organisation does not sell, lease, exchange or otherwise commercially transfer personal data to third parties without separate consent of the User.

10.6. Cross-border transfers may be carried out where there are legal grounds under the Law of Ukraine «On the Protection of Personal Data» or relevant international acts including the GDPR. Transfers to countries outside the European Economic Area (EEA) are carried out in accordance with Articles 44–49 GDPR.

11. Security and protection measures

11.1. The Organisation takes all necessary legal, organisational and technical measures to ensure an adequate level of security of personal and sensitive personal data being processed, in accordance with the Law of Ukraine «On the Protection of Personal Data», the GDPR and other applicable regulations.

11.2. The personal data protection system is built on the principles of lawfulness, proportionality, data minimisation, access restriction and accountability of those involved in processing.

11.3. To prevent unauthorised access, loss, unlawful destruction, forgery, damage, blocking, disclosure or distribution of personal data, the Organisation implements: modern encryption technologies, firewalls, intrusion detection, antivirus protection; storage of data on protected servers with multi-level access control; regular backups; physical protection of premises; restriction of access to authorised employees only; an internal personal data processing log; regular staff training.

11.4. The Organisation is responsible for compliance with legal requirements on personal data processing and protection and ensures the operation of a person or unit responsible for personal data protection.

11.5. In case of confidentiality breach or a personal data security incident, the Organisation acts in accordance with internal response procedures, including: identification, documentation and analysis of the incident; risk assessment for the rights and freedoms of natural persons under Article 33 GDPR — in case of high risk the Organisation notifies the competent supervisory authority no later than 72 hours from detection; informing the data subject of the nature of the incident; documenting the incident in the internal Data Breach Log; carrying out a Data Protection Impact Assessment (DPIA) where necessary; taking measures to remedy the incident and prevent recurrence.

12. Cookies and other tracking technologies

12.1. To ensure proper operation of the Website and/or mobile application and to improve interaction with the User, the Organisation may use cookies and other similar tracking technologies that collect technical information about the User.

12.2. Such technologies may include: Cookies — small text files stored in the User's browser when accessing the site; SDK trackers — embedded software elements integrated into the mobile app (e.g. Firebase, AppMetrica); Device IDs — unique device identifiers (e.g. GAID, IDFA); Web beacons / pixels — invisible graphical objects allowing the User's actions to be tracked.

12.3. The Organisation may use the following types of cookies and trackers: Functional — to save user settings; Analytics — to collect statistical information (in particular Google Analytics, Firebase); Marketing — to personalise advertising messages (used only with the User's consent); System (necessary) — without which the platform cannot fully operate.

12.4. Analytics and marketing tracking technologies are only used with the User's prior consent given via a banner, pop-up or other technical means.

12.5. The User has the right to: refuse the use of tracking technologies (except necessary ones); manage cookies through browser or device settings; manage permissions within the app's functionality.

12.6. All information collected through tracking technologies is not used for direct identification of the person unless the User provides such information themselves.

12.7. To measure the effectiveness of its advertising, the Organisation uses Google Ads (Google Ireland Limited / Google LLC). When the User arrives at the Website from a Google ad and makes a donation, the donation confirmation page reports the conversion to Google (for donations in US dollars, the amount and currency are included as well). In regions where the law requires consent (the EU, the United Kingdom, Switzerland, Canada), advertising cookies are activated only after the User accepts the cookie banner; until consent is given, or if it is declined, Google receives only limited technical signals without advertising cookies. The User may withdraw consent at any time by clearing the site data in their browser settings. Learn more about how Google processes data: https://business.safety.google/privacy/

13. Amendments to the Policy

13.1. The Organisation reserves the right to periodically amend or update this Policy in accordance with changes in legislation, data protection practices, partner requirements or internal procedures.

13.2. In case of material changes to processing conditions, the Organisation undertakes to notify Users by publishing the new version of the Policy on the official website www.uamentalhelp.org and, where possible, by email or through the mobile app.

13.3. Users are advised to review the Policy periodically. Continued use of the Organisation's digital services after publication of changes is deemed acceptance of those changes.

14. Contact information

14.1. For all matters related to this Policy and the processing, storage, correction or deletion of personal data, the User may contact the Organisation at:

Organisation name: Charitable Organisation «UA Mental Help Foundation» (EDRPOU code: 44794719)

Email: support@uamentalhelp.org

Website: www.uamentalhelp.org

Responsible person: Tetiana Viacheslavivna Nahorna, Executive Director — tetiana.nahorna@uamentalhelp.org

14.2. Requests may be submitted in writing or electronically. The Organisation may request additional information to verify the User's identity.

14.3. The Organisation undertakes to respond to requests, queries or demands of data subjects within the timeframes established by current legislation.