Privacy Policy

Personal Data means any information relating to an identified or identifiable individual. Special Category Data includes data concerning health or mental health, given specific protection under UK GDPR and EU GDPR. Usage Data is information collected automatically through use of our Service (IP address, browser type, pages visited). UK GDPR means the UK General Data Protection Regulation together with the Data Protection Act 2018. EU GDPR means Regulation (EU) 2016/679.

Grovvve serves mental health practitioners and, through the platform, their clients. This policy covers two distinct categories of personal data:

Practitioner data: Information we collect directly from practitioners (name, email, billing details, professional profile). For this data, Grovvve is the data controller.

Client data: Information about a practitioner's clients entered into the platform (client names, contact details, health information, session notes, form responses). For this data, the practitioner is the data controller and Grovvve acts as a data processor on their behalf, processing only on the practitioner's instructions under our Data Processing Agreement.

Personal Data we collect includes: name, email address, phone number, professional licence number, practice name, billing details, and practitioner type.

Usage Data collected automatically includes: IP address, browser type, browser version, pages visited, time spent on pages, and device identifiers.

We partner with trusted third-party providers to deliver our platform. All data sharing is governed by strict contractual agreements and processed in full compliance with UK and EU GDPR:

• Supabase Inc. - Database, authentication and file storage: client records, session notes, session-note images, account data
• Vercel Inc. - Application hosting and delivery
• Anthropic PBC - AI session-note generation: processed under terms prohibiting retention and model training
• Groq, Inc. - AI inference for note generation: same retention and training prohibitions
• Daily.co (Pluot, Inc.) - Telehealth video sessions: media is relayed, not recorded by Grovvve
• Resend, Inc. - Transactional email: appointment reminders, invoices, secure-message notifications
• Stripe, Inc. - Card payments and payouts. No clinical data is transmitted to Stripe
• Paddle.com Market Ltd. - Subscription billing and merchant of record. No clinical data
• Rapyd Financial Network Ltd. - Practitioner payouts in supported regions. No clinical data
• Google LLC - Calendar synchronisation, for practitioners who connect a Google account

We only share data with third parties where it is essential to deliver platform features. No data is sold or used for advertising.

We use collected data to: provide and maintain our service; process payments and manage subscriptions; send transactional communications; provide customer support; gather analytics to improve the service; detect and prevent fraud and security incidents; and deliver AI-assisted documentation features where a practitioner chooses to use them.

We do not use your data or client data for advertising, marketing to third parties, or AI model training.

Your data is primarily stored and processed within the European Union. A limited amount of processing occurs via third-party services that may operate in other jurisdictions. Where such transfers occur, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by relevant authorities.

Grovvve will take all steps reasonably necessary to ensure your data is treated securely and in accordance with this Privacy Policy.

Grovvve offers AI-powered features to assist with clinical documentation (note generation, voice transcription). These features are fully compliant with UK GDPR and EU GDPR and are designed as assistive tools only - not for automated decision-making about clients or their care.

AI is only involved in generating draft content. No personally identifiable client information is shared with AI services beyond what is strictly necessary, and all AI processing is governed by agreements prohibiting data retention and model training. All AI-generated content must be reviewed and approved by the practitioner before use.

We implement appropriate technical and organisational measures to protect personal data: AES-256 encryption at rest; TLS 1.2+ encryption in transit; row-level security ensuring each practitioner accesses only their own data; role-based access controls; and regular security reviews.

In the event of a personal data breach, Grovvve will notify you without undue delay and in any event within 72 hours of becoming aware of the breach.

We retain your personal data only as long as necessary to fulfil the purposes outlined in this Privacy Policy or as required by law. Upon account termination, you have 45 days to export your data. After this period, all personal data will be permanently deleted from our active systems.

Under UK GDPR and EU GDPR, you have the following rights:

• Right of access - request copies of your personal data
• Right to rectification - request correction of inaccurate or incomplete information
• Right to erasure - request deletion of your personal data, under certain conditions
• Right to restrict processing - request restriction of processing, under certain conditions
• Right to object to processing - object to our processing, under certain conditions
• Right to data portability - request transfer of your data to another organisation or directly to you
• Right not to be subject to automated decision-making - our AI features do not make such decisions

To exercise any of these rights, contact us at privacy@grovvve.com. We will respond within 30 days. See our dedicated GDPR Notice for more detail on your rights and how to raise a complaint with a supervisory authority.