Privacy Policy
Who we are
Monita is a mental health service currently providing free self-help and learning before a full clinical service launch in 2027. The data controller is IHG Mental Health Limited, a company registered in England and Wales, trading as Monita. Contact for all privacy matters: via the Contact page.
Because our target users are across the Gulf and our company is in the United Kingdom, we work to the UK General Data Protection Regulation and Data Protection Act 2018, and to the Kingdom of Saudi Arabia's Personal Data Protection Law (PDPL) and other applicable GCC data protection laws.
What we collect
-
Account details you give us when you register: name and email address.
-
Newsletter details: your email address, with your confirmed (double opt-in) consent.
-
Messages you send us through the contact form or by email.
-
Course progress, so the platform can remember where you are and issue your certificate.
-
Self check-in responses (for example the anxiety and wellbeing check-ins). These may reveal information about your health, which is special category data. We ask for your explicit consent before any check-in result is stored, and you can use check-ins without saving results. Check-ins are a private self-reflection tool — they are not shared, and they are not a medical record.
-
Technical data: device type, browser, IP address and how the site is used — collected through cookies only with your consent, except where strictly necessary for the site to work (see the Cookie Policy).
We do not collect payment information. Monita's self-help platform is free — there is nothing to pay for.
Why we use it, and our legal bases
-
To provide the platform, your account, your courses and your certificate — performance of our terms with you.
-
To respond when you contact us — our legitimate interest in answering you.
-
To send the newsletter and updates — your consent, withdrawable at any time via the unsubscribe link.
-
To store check-in results — your explicit consent.
-
To keep the platform secure and improve it — our legitimate interests, using aggregated or consented analytics data.
-
To meet legal, regulatory and safeguarding obligations — legal obligation.
We do not sell personal information, we do not use it for advertising to you, and we do not make automated decisions with legal or similar effects about you.
Who we share it with
Only with service providers who process data on our instructions under contract: our website platform (Wix.com Ltd — hosting and forms), our email service provider for the newsletter and account emails, and consented analytics.
We may disclose information where the law requires it or where there is a serious safeguarding risk.
If Monita introduces clinical services in future, any handling of clinical information will be covered by a separate, explicit privacy notice before you are asked for anything.
International transfers
Our website platform stores data on cloud infrastructure that may be located outside the country you live in and outside the UK.
Where personal data is transferred internationally, we rely on appropriate safeguards (such as the UK International Data Transfer Agreement / EU Standard Contractual Clauses and the PDPL's transfer provisions).
How long we keep it
Account data: while your account is open, then deleted or anonymised within 12 months of closure.
Newsletter data: until you unsubscribe.
Contact messages: up to 24 months.
Check-in results: until you delete them or close your account.
Technical logs: short rolling periods set by our providers.
Your rights
You can ask for a copy of your data, correct it, delete it, restrict or object to its use, take it with you, and withdraw any consent — without affecting your use of the free platform.
Contact [privacy email] and we will respond within the legal timescale.
You can also complain to the UK Information Commissioner's Office (ICO) or the Saudi Data & AI Authority (SDAIA), or your local authority.
Children and young people
Monita's platform is currently designed for adults (18+). We do not knowingly collect personal data from under-18s, and content for young people will only be introduced with appropriate safeguarding, consent and clinical sign-off.
If you believe a child has given us personal data, contact us and we will delete it.