Policy
Privacy notice
How ThisWay collects, uses and protects your details, including anything you tell us about your health. It covers the website, the waitlists, membership of every ThisWay service, partner passes and ThisWay at Work.
In short
- We only collect what we need to run the service you chose, and we tell you why.
- We only use health information with your explicit consent, for the service you gave it to. You can withdraw that consent at any time.
- Each service keeps its health answers separate. ThisWay-Menopause answers are never shared with ThisWay-ADHD or ThisWay-Postpartum without your clear permission.
- We never sell your details, never use them for advertising and never share your health information with an employer.
- No advertising trackers, anywhere on ThisWay. We count visits without cookies.
- You can download or delete your data yourself, from your account.
Who we are
ThisWay is a trading name of OCCO Wellbeing Ltd, a company registered in England and Wales (company number 13518404). Our registered office is 369 Hagley Road West, Quinton, Birmingham, England, B32 2AL.
ThisWay-Menopause, ThisWay-ADHD and ThisWay-Postpartum are ThisWay services. OCCO Wellbeing Ltd decides how your details are used for all of them, which makes it the "controller" under UK data protection law (the UK GDPR and the Data Protection Act 2018).
For anything about your data, email hello@thisway.health or write to us at our registered office. Our co-founder, Ollie Godwin, is responsible for data protection at ThisWay.
What this notice covers
This notice covers everyone who uses ThisWay:
- visitors to thisway.health
- people who join a waitlist or pay a refundable founding payment
- members of ThisWay-Menopause, ThisWay-ADHD and ThisWay-Postpartum, including people who join through an employer, a charity or a gift
- partners and family members invited through a partner pass
- people who contact us, and people who buy ThisWay at Work for their organisation.
ThisWay-Menopause opens first, on 19 January 2027. ThisWay-ADHD and ThisWay-Postpartum aren't open yet. The parts of this notice about membership apply to each service from the day it opens.
The details we collect
Everyone who visits the website
- Visit counts. We count visits with Cloudflare Web Analytics. It doesn't use cookies, doesn't build a profile of you and doesn't follow you to other websites. We see totals, such as how many people viewed a page and which country they were in.
- Security records. Our hosting provider, Cloudflare, briefly records technical details such as your IP address and browser when you load a page. These are used to keep the site running and protect it from attack.
- The short questionnaire. On the public site, your answers to the short version of the questionnaire stay in your browser tab. They're never sent to us, and they're cleared when you close the tab.
If you join a waitlist or register interest
| If you | We keep |
|---|---|
| Join a waitlist | Which service's waitlist you joined, your email address, your first name if you give it, whether you'd like occasional articles, and the date |
| Register interest in ThisWay at Work | Your work email, your organisation's name, the number of employees if you give it, and the date |
| Arrive from a campaign link | The page you signed up on and the campaign name in the link (for example "newsletter"), so we know which messages work |
Which waitlist you joined could say something personal about you, or someone close to you. So we treat it as private: we only use it to tell you about that service, and never for advertising.
If you become a member
Your account: your name, email address, the UK nation you live in (because NHS routes differ), your password (stored scrambled, so we can't read it), how you joined (paid, employer code, community code or gift) and your settings.
Payments: our payment provider, Stripe, takes your card details on its own secure page. We never see or store your full card number. We keep a record of what you paid, when, and any refunds.
Your health information. This is what makes ThisWay useful, and it's the most sensitive information we hold. Depending on the service, it can include:
| Service | Health information you might give us |
|---|---|
| ThisWay-Menopause | Symptoms and how they affect you, your periods, your age range, any treatments you've tried and what helped, appointments and their outcomes, your weekly check-ins, and notes you write |
| ThisWay-ADHD | Why you're seeking an assessment, where you are on the waiting list, your provider, medicines and how they suit you (if you're diagnosed), and notes you write |
| ThisWay-Postpartum | Your recovery after birth, how you're feeling, feeding, appointments and checks, and notes you write |
Health information is "special category data" under UK law, so it has extra protection. See Health information: the extra rules we follow.
Information about your child. ThisWay-ADHD lets parents keep a record for a child who is being assessed, and ThisWay-Postpartum asks about your baby's age and care. You give us this as the child's parent or carer. We ask for as little as possible: a first name or nickname, their age or date of birth, and the notes you choose to add. We never contact your child.
How you use ThisWay: which steps you've completed, packs you've downloaded, reminders you've set and when you last signed in. We use this to run your account, not to profile you.
If you're invited through a partner pass
Your name and email address, the member who invited you, and your own settings. You see content written for partners. You only see the member's own information if they choose to share it with you, and they can stop sharing at any time.
If you contact us
Your name, email address and whatever you tell us, so we can reply. Please don't send health details by email unless you need to. We can help with most account questions without them.
If you buy ThisWay at Work
Your name, work email and job title, your organisation's name, address and VAT details, what you bought and paid, and the access codes issued to your organisation.
Why we use your details, and our lawful basis
UK law says we need a lawful reason (a "lawful basis") for each thing we do with your details.
| What we do | Lawful basis |
|---|---|
| Run your membership: your account, pathway, record, packs and reminders | Contract: we need it to give you the service you signed up for |
| Use your health information to rank your next steps and keep your record | Your explicit consent (see below) |
| Take payments, send receipts and handle refunds | Contract, and legal obligation (we must keep accounting records) |
| Send service emails, such as renewal reminders, price-change notices and changes to these policies | Contract and legal obligation |
| Email you when a waitlist service opens | Consent |
| Send occasional articles or news | Consent. Every email has an unsubscribe link |
| Keep the website secure and working | Legitimate interests: keeping ThisWay and your data safe |
| Count visits, without cookies | Legitimate interests: knowing which pages help people, without tracking anyone |
| Handle complaints, questions and your data rights requests | Legal obligation, and legitimate interests |
| Keep records of your consents | Legal obligation: we must be able to show you agreed |
| Protect someone from serious harm in an emergency | Vital interests (see Safety) |
| Sell and run ThisWay at Work | Contract, and legitimate interests for contacting people at organisations that asked us to |
Health information: the extra rules we follow
- Explicit consent, per service. Before you give any health information, we ask for your explicit consent, separately for each ThisWay service. We explain what we'll do with it in plain words, and nothing is pre-ticked.
- Only for your service. Your health answers are only used to give you that service: to choose and rank your next steps, keep your record and build your packs.
- Kept apart. Health answers are stored separately for each service, and apart from marketing data. If you join a second service, we'll ask before any answers are carried across.
- Withdrawing consent. You can withdraw consent at any time in your account settings. We'll then stop using and delete your health information for that service. Without it, we can't give you a personalised pathway, but you can keep using the parts of the service that don't need it, or cancel.
- Never for advertising, never sold, never to employers. Not in any form.
- No AI training. We don't use your health information to train artificial intelligence models, and we don't put it into AI tools.
- Nobody reads it for fun. Only a small number of people at ThisWay can access member data, only when needed (for example, to fix a fault you've reported or answer a request from you), and every access is logged.
How your next steps are chosen
ThisWay uses your answers and a fixed set of rules to choose and order your next steps. The rules come only from published research and official guidance, and every step shows its reason and source. It's automatic, but it isn't a decision about you: it doesn't diagnose you, affect your access to care, or decide anything with a legal or similar effect. You can ignore any step, and your GP or other professional always has the final say.
Some answers, such as bleeding after menopause or thoughts of harming yourself, show an urgent message first. These messages follow NHS wording and tell you who to contact.
Who we share your details with
We never sell your details. We share them only with companies that help us run ThisWay, under contracts that let them use your details only to provide their service to us, and keep them secure:
| Company | What they do for us | Where |
|---|---|---|
| Cloudflare | Hosts the website, stores our database, protects the site, counts visits | Our database is set to stay in the European Union. Cloudflare's network is worldwide |
| Stripe | Takes payments and manages subscriptions | UK, EU and USA |
| Our email provider | Sends account, reminder and launch emails. It only receives what it needs to send each email | We'll name it here before we send any member email |
| Apple (iCloud Mail) | Runs our hello@, support@ and other inboxes | EU and USA |
Stripe is also responsible in its own right for some payment information, for example to prevent fraud and meet financial rules. Its privacy notice is at stripe.com/gb/privacy.
We may also share details if the law requires it (for example, a court order), to protect someone from serious harm (see below), or with professional advisers such as our accountants and lawyers, who must keep them confidential. If OCCO Wellbeing Ltd or ThisWay were ever sold or merged, your details would pass to the new owner only under the same promises, and we'd tell you first.
Employers never see individual information. If you join through ThisWay at Work, your employer only gets anonymised totals, such as how many codes were used. We don't report groups smaller than ten people, so no one can be picked out.
Sending data outside the UK
Our database is stored in the European Union, which the UK recognises as protecting personal data properly. Some of our providers are based in, or use support teams in, the USA. When details go outside the UK, we make sure they're protected by one of the safeguards UK law requires: a UK "adequacy" decision (such as the UK-US data bridge, for companies certified to it), or the UK's approved contract terms (the International Data Transfer Agreement or Addendum). Email us for a copy of the safeguard that applies.
How long we keep your details
| Details | How long |
|---|---|
| Waitlist details | Until 12 months after that service opens, unless you unsubscribe sooner |
| Refundable founding payments | Treated as membership records (below). If you ask for your money back before launch, we keep the payment record for 6 years |
| Your account and health record, while you're a member | For as long as you're a member |
| Your account and health record, after membership ends | 24 months, so you can come back to your record. We email you 30 days before we delete it. You can delete it yourself sooner, at any time |
| Health information after you withdraw consent | Deleted within 30 days |
| Free accounts that aren't used | Deleted after 24 months without a sign-in, with 30 days' warning |
| Payment and accounting records | 6 years after the end of the financial year they relate to, as UK tax law requires |
| Emails to support | 2 years after our last reply |
| Records of emails we've sent you | 12 months |
| Partner pass details | Deleted 30 days after the pass ends |
| ThisWay at Work interest | 24 months, unless you ask us to stop sooner |
| ThisWay at Work licence records | 6 years after the licence ends |
| Data rights requests | 3 years after we've dealt with them |
| Complaints | 3 years after the complaint is closed |
| Safety records (the rare cases where we've acted to protect someone) | 6 years |
| Records of your consents | For as long as we hold the details they cover, plus 6 years |
| Security records | Up to 30 days, unless we need them to look into an incident |
| Backups | Deleted details can stay in encrypted backups for up to 30 days before they're overwritten |
If we're worried about your safety
ThisWay isn't a crisis service, and nobody watches your answers as you give them. If you tell us something by email that makes us believe you or someone else, including a child, is at risk of serious harm, we'll reply with who to contact for urgent help. If we believe there's an immediate risk to someone's life or a child is at risk of significant harm, and we have enough information to act, we may share only what's needed with emergency services or the local authority, even without your consent. The law allows this. Read our safety and urgent help policy.
Children
ThisWay is for adults aged 18 or over. We don't knowingly let anyone under 18 open an account. If we find we have, we'll close the account and delete the details. Information about a child that a parent adds (see above) is protected in the same way as the parent's own health information, and is deleted with the parent's record.
Keeping your details safe
- Data is encrypted when it travels (HTTPS) and when it's stored.
- Access is limited to the few people who need it, protected by two-step sign-in, and logged.
- We test the security of ThisWay before each service opens, and after major changes.
- Reminder emails and texts never name a medicine, symptom or condition, in case someone else sees your screen.
If something ever goes wrong with your data, and it's likely to put you at risk, we'll tell you without delay and tell the Information Commissioner's Office (ICO) within 72 hours, as the law requires.
Your rights
You have the right to:
- see the details we hold about you, and get a copy
- correct details that are wrong or incomplete
- delete your details
- restrict how we use them, for example while we check something you've told us
- object to us using them where we rely on legitimate interests, and to any direct marketing
- take them with you in a common format (data portability)
- withdraw consent at any time, without affecting what we did before you withdrew it.
You can download or delete your data yourself from your account settings. Or email hello@thisway.health. It's free, and we'll reply within one month. If a request is complicated, we can take up to two more months, and we'll tell you why within the first month. We may need to check it's you before we act.
Complaints
If you're unhappy with how we've handled your details, please tell us first at hello@thisway.health. We'll acknowledge your complaint within 5 working days and follow our complaints policy.
You can also complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes to this notice
We'll update this notice when anything changes, and show the date at the top. If a change affects how we use details you've already given us, we'll email you before it takes effect, and ask for your consent again where the law requires it.
Questions about this policy? Email hello@thisway.health. See all policies.