PRIVACY POLICY

PRIVACY POLICY

This Privacy Policy explains how DEATH DOULA LTD, a private limited company incorporated in England and Wales (Company Number 17171845), with its registered office at 54 Mead Way, High Wycombe, England, HP11 1RH ("Company", "we", "us", or "our"), collects, uses, stores, shares, and protects personal data when you use our website, create an account, purchase or access digital Courses and services, use AI-assisted features, interact with the practitioner catalogue, or otherwise use our digital platform (the "Platform").

We process personal data in accordance with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, those laws as amended by the Data (Use and Access) Act 2025, and other applicable data protection and privacy laws.

This Privacy Policy applies to processing for which DEATH DOULA LTD determines the purposes and means. Certain professional-regulation activities are carried out by a legally separate affiliated non-profit organisation and may be subject to that organisation's own privacy documentation, as explained below.

1. WHO IS RESPONSIBLE FOR YOUR DATA

1.1. DEATH DOULA LTD

DEATH DOULA LTD is the controller for personal data processed for the operation of the Platform and for purposes including account administration, digital Course access, Platform purchases, subscriptions or fixed-term access, AI-assisted Platform features, technical support, security, and other activities described in this Policy.

Contact email: [email protected]

1.2. Affiliated professional organisation

The Platform may provide technical access to activities of the Ukrainian public organisation Громадська організація «Доула Смерті» (registration number 46392077), which is legally separate from DEATH DOULA LTD ("Affiliated Organisation").

The Affiliated Organisation may act as an independent controller for personal data processed for its own professional-regulation purposes, including professional applications, Education Certificates where issued by that organisation, qualification decisions, Active Specialist Status (Admission to Practice), the Register of Active Specialists, supervision, professional standards, complaints, disciplinary processes, and related professional records.

Those activities are governed by the Affiliated Organisation's own applicable privacy and professional documents.

Where DEATH DOULA LTD processes personal data solely on the documented instructions of the Affiliated Organisation, the parties' respective responsibilities are governed by the applicable data-processing arrangements and data protection law. Where DEATH DOULA LTD processes the same or related information for its own Platform, security, payment, or contractual purposes, it does so as controller for those purposes.

2. PERSONAL DATA WE COLLECT

We follow the principle of data minimisation and seek to collect only personal data reasonably necessary for the relevant purpose.

Depending on how you use the Platform, we may process the following categories of data.

2.1. Account and identity data

email address;
securely hashed password and authentication data;
account status, identifiers, roles, and preferences;
full name and other profile information where you choose or are required to provide it for a particular feature, Course, certificate, application, or account function.

We do not require a full name, telephone number, or date of birth for ordinary account registration unless a particular feature or legal requirement makes that information necessary.

2.2. Course and learning data

Course enrolments and access entitlements;
Course progress;
quiz, examination, assignment, or assessment results where applicable;
educational records and certificate issuance or verification information where the relevant document is administered through the Platform;
application or admission information for Courses that require an application or approval process.

2.3. Application data

If you submit an application through the Platform, we may process information such as:

full name;
country and city;
education or professional background;
motivation or other application responses;
supporting information requested for the particular application.

If an application concerns a professional-regulation decision of the Affiliated Organisation, the relevant application data may be provided to that organisation for its independent purposes as described in section 1.2.

2.4. Transaction and payment-administration data

For purchases and paid access, we may process:

transaction amount and currency;
product, Course, subscription, or access type;
locale and origin domain;
date and time of transaction;
payment and refund status;
provider-level transaction, checkout, customer, invoice, or payment identifiers;
limited billing information returned to us by the payment provider where necessary to administer the transaction.

We do not collect or store full payment-card numbers, CVV/CVC codes, private cryptocurrency keys, seed phrases, or cryptocurrency wallet credentials.

2.5. AI Chat and AI-assisted feature data

Where you use an AI-assisted informational feature, we may process:

messages and other content you submit;
generated responses;
conversation or thread identifiers;
timestamps;
usage counters and service-limit information;
technical and safety metadata associated with the interaction.

Because of the subject matter of the Platform, messages you choose to submit may contain emotionally sensitive information or special category personal data, including information relating to health. See section 5.

2.6. Technical, security, and usage data

We may automatically process data such as:

IP address;
browser type and version;
device or operating-system information;
user-agent information;
authentication and session information;
server, security, diagnostic, and audit logs;
information reasonably necessary to prevent abuse, investigate errors, and maintain Platform security and reliability.

2.7. Communications and preferences

Where applicable, we may process:

support requests and correspondence;
language and locale preferences;
newsletter or communication preferences;
consent choices and records;
other communications you send to us.

2.8. Information we do not normally request

We do not ask you to provide personal data that is unnecessary for the feature you are using. In particular:

we do not collect your full card details;
we do not collect private cryptocurrency keys or seed phrases;
we do not collect shipping information unless a transaction actually requires physical delivery;
we ask that you do not provide personal data about another person unless you have a lawful basis to do so.

3. HOW WE COLLECT PERSONAL DATA

We may collect personal data through the following sources.

3.1. Directly from you

You provide information when you create or update an account, enrol in a Course, submit an application, use AI Chat, contact support, make choices in the Platform, or otherwise submit information to us.

3.2. Automatically through the Platform

Technical and security information may be generated when you use the Platform, including through server logs, authentication systems, browser storage, and cookies or similar technologies. See our Cookie Policy for more information.

3.3. From payment and service providers

We receive limited information from payment providers and other service providers where necessary to confirm transactions, provide the requested service, prevent fraud, or support Platform operations.

3.4. From the Affiliated Organisation

Where appropriate and lawful, the Affiliated Organisation may provide limited information necessary for the Platform to display or administer professional information, such as current qualification or professional-status information, where the Platform is used to present that information.

4. PAYMENT PROVIDERS

Payments are processed by third-party providers presented to you before or during checkout. Depending on the product, payment method, currency, and availability, these may include Stripe, NOWPayments, Lemon Squeezy, or another provider identified in the relevant transaction flow.

Payment providers process payment information under their own terms and privacy notices.

We may receive limited information required to administer a transaction, such as payment status, transaction or checkout identifiers, amount, currency, timestamps, refund information, and provider references.

Where a provider acts as our processor, we use it subject to appropriate data-protection obligations. A provider may also act as an independent controller for certain activities it determines itself, such as regulatory compliance, fraud prevention, or its own legal obligations.

5. AI-ASSISTED FEATURES AND SPECIAL CATEGORY DATA

5.1. Nature of the service

The Platform may include AI-assisted informational features ("AI Chat"). AI Chat is not an emergency, medical, psychiatric, psychological, psychotherapeutic, or crisis-intervention service.

5.2. Information you choose to submit

You decide what information you enter into AI Chat. Because conversations may concern death, grief, illness, loss, or related subjects, you may choose to provide information that is sensitive or that constitutes special category data under the UK GDPR, such as health-related information.

Please do not provide more sensitive information than is reasonably necessary for your use of the feature, and do not submit special category or other personal data relating to another identifiable person unless you have an appropriate lawful basis to do so.

5.3. Legal requirements for special category data

Special category data is subject to additional protection under the UK GDPR. Where we process such data, we must have both an appropriate lawful basis under Article 6 UK GDPR and a valid condition under Article 9 UK GDPR.

Where we rely on explicit consent as the Article 9 condition, that consent must be obtained in a clear and specific form appropriate to the special category data and processing involved. Mere use of the Platform or mere submission of information is not treated by this Policy as a substitute for any explicit-consent requirement imposed by law.

If no valid Article 9 condition applies to a proposed use of special category data, we will not use that data for that purpose.

5.4. AI service providers

To provide AI-assisted features, relevant content may be transmitted to one or more third-party AI service providers acting as processors or sub-processors for functions such as model inference, retrieval, embeddings, or related technical processing.

We seek to use providers under contractual and technical arrangements appropriate to the role they perform. We do not authorise providers to use your Platform conversations to train their general-purpose models except where this is expressly disclosed to you and a valid legal basis exists.

5.5. Storage of conversations

Where chat history is a feature of your account, messages and generated responses may be stored as conversation threads so that you can return to them. Associated timestamps, identifiers, and usage counters may also be stored.

5.6. No model training by DEATH DOULA LTD

We do not use your private AI Chat conversations to train our own general-purpose machine-learning model.

5.7. Human access

Access to private AI Chat content by authorised personnel is limited to circumstances where access is reasonably necessary for purposes such as user-requested support, security, abuse prevention, incident investigation, or legal compliance, and is subject to appropriate access controls and confidentiality requirements.

5.8. Your controls

Where available in the Platform, you may delete individual conversations or use other account controls. You may also contact [email protected] to exercise applicable data-protection rights described in section 10.

6. PURPOSES AND LAWFUL BASES

Depending on the processing activity, we may rely on one or more of the following lawful bases under the UK GDPR.

6.1. Performance of a contract

Where processing is necessary to:

create and administer your account where required for a service;
provide purchased or enrolled Course access;
administer subscriptions or fixed-term digital access;
confirm and administer payments and refunds;
provide AI-assisted services you request;
provide technical support connected with a contract.

6.2. Legitimate interests

Where necessary for our legitimate interests or those of another person, provided those interests are not overridden by your rights and interests, including:

protecting Platform and account security;
preventing fraud, abuse, and misuse;
maintaining audit, security, and diagnostic logs;
investigating errors and incidents;
maintaining the operational integrity and reliability of the Platform;
establishing, exercising, or defending legal claims where appropriate.

6.3. Consent

Where we ask for your consent, including where required for:

non-essential cookies or similar technologies;
certain marketing or optional communications;
a specific processing activity for which consent is the appropriate lawful basis.

You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Special category data is subject to the additional requirements described in section 5.3.

6.4. Legal obligation

We may process information where necessary to comply with legal duties, including tax, accounting, fraud-prevention, regulatory, court, or other legal requirements.

6.5. Other lawful bases

In limited circumstances, another lawful basis may apply where expressly permitted by data protection law. Where special category data is involved, an additional Article 9 condition must also apply.

7. DATA RETENTION

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security, dispute-resolution, and reporting requirements.

Indicative retention periods include:

Account data: generally while the account is active, followed by deletion or anonymisation within a reasonable period after a verified deletion request, subject to information we must retain for legal, security, fraud-prevention, or transaction purposes.
Payment and transaction records: generally up to 6 years after the relevant transaction or accounting period where required for UK tax, accounting, or legal purposes.
Course enrolment and progress data: generally while your account is active and while necessary to administer your Course access, learning record, or contractual rights.
Course assessment and educational records: for the period reasonably necessary to administer, evidence, or verify the relevant educational outcome.
Certificate issuance or verification records administered by DEATH DOULA LTD: for the period reasonably necessary for verification, contractual administration, fraud prevention, and legal obligations.
Professional-regulation records controlled by the Affiliated Organisation: retained under that organisation's own applicable retention and privacy rules.
AI Chat conversations: generally while the relevant conversation or account remains available, unless you delete the conversation, request erasure where applicable, or a longer period is necessary for a specific legal or security reason.
Technical, diagnostic, security, and audit logs: generally up to 12 months, unless a longer period is reasonably necessary for an active security incident, fraud investigation, legal claim, or legal requirement.
Marketing preferences: until you withdraw consent or unsubscribe, with limited suppression information retained where necessary to respect your opt-out.

Where personal data is no longer required, we delete or anonymise it unless retention is required or permitted by law.

8. WHO WE SHARE PERSONAL DATA WITH

We do not sell personal data.

Where necessary for the purposes described in this Policy, we may share personal data with:

payment providers;
AI, model-inference, retrieval, or embedding service providers;
cloud hosting, database, storage, infrastructure, security, and monitoring providers;
email delivery and communications providers;
professional advisers such as lawyers, accountants, or auditors where necessary;
the Affiliated Organisation where necessary for a professional application, professional status, registry, or other activity for which that organisation is responsible;
public authorities, regulators, courts, or law-enforcement bodies where disclosure is required or permitted by applicable law;
a purchaser, successor, or restructuring party where relevant to a lawful corporate transaction, subject to appropriate safeguards.

Service providers that process personal data on our behalf are required to process it under appropriate contractual and data-protection obligations.

Where information is transferred to the Affiliated Organisation as an independent controller, that organisation is responsible for its subsequent processing under its own applicable privacy documentation.

9. INTERNATIONAL DATA TRANSFERS

Our service providers and technical infrastructure may process personal data in countries outside the United Kingdom.

Where a transfer is subject to the UK GDPR rules on restricted international transfers, we use a lawful transfer mechanism where required. Depending on the circumstances, this may include:

UK adequacy regulations;
the UK International Data Transfer Agreement (IDTA);
the UK Addendum to the European Commission Standard Contractual Clauses;
another appropriate safeguard or permitted exception available under applicable UK data protection law.

Where required, we also assess whether the relevant transfer provides an appropriate level of protection and implement supplementary measures where necessary.

10. YOUR DATA PROTECTION RIGHTS

Depending on the circumstances and the applicable legal conditions, you may have the right to:

request access to personal data we hold about you;
request correction of inaccurate or incomplete personal data;
request erasure of personal data;
request restriction of processing;
object to certain processing;
request data portability;
withdraw consent at any time where processing is based on consent;
object to certain direct marketing;
make a data protection complaint directly to DEATH DOULA LTD;
make a complaint to the UK Information Commissioner's Office ("ICO").

These rights are not absolute and may be subject to legal conditions or exemptions.

To exercise a right in relation to processing controlled by DEATH DOULA LTD, contact [email protected]. We may need to verify your identity before completing a request.

We respond within the period required by applicable data protection law. In many cases this is one month, although the law may permit an extension in certain circumstances.

If your request concerns personal data for which the Affiliated Organisation is the independent controller, we may direct you to that organisation or, where appropriate, assist in routing the request.

11. DATA PROTECTION COMPLAINTS

11.1. Complaints to DEATH DOULA LTD

If you believe that DEATH DOULA LTD has infringed your rights under applicable UK data protection law, you may make a complaint directly to us at [email protected].

We will facilitate the making of data protection complaints through this contact channel. We will acknowledge receipt of a complaint within 30 days beginning with the day on which we receive it.

We will take appropriate steps, without undue delay, to investigate and respond to the complaint, keep you informed of relevant progress where appropriate, and tell you the outcome.

11.2. Complaints to the ICO

You also have the right to make a complaint to the UK Information Commissioner's Office ("ICO"). You may contact the ICO whether or not you have first complained to us.

Making a complaint to us does not restrict any right you have to contact the ICO, seek a judicial remedy, or exercise another right available under applicable law.

12. SECURITY

We use technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

Depending on the relevant system, these measures may include:

encrypted transport using HTTPS/TLS;
password hashing;
authentication and session-security controls;
role-based or permission-based access controls for administrative functions;
logging and audit controls;
restricted access to production and administrative systems;
security monitoring, backups, and incident-response processes.

No online service can guarantee absolute security. We review and adapt safeguards in light of the nature of the processing and reasonably foreseeable risks.

13. CHILDREN

The Platform is intended for adults. Account registration and purchases are restricted to persons aged 18 or over.

We do not knowingly offer ordinary Platform accounts to children under 18. If you believe that a person under 18 has provided personal data through an account in circumstances contrary to this requirement, contact [email protected] so that we can review and take appropriate action.

14. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies, browser storage, and similar technologies for functions such as authentication, security, preferences, and, where applicable and permitted, analytics.

Our Cookie Policy explains the technologies we use, their purposes, and the choices available to you.

15. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy to reflect changes in law, regulatory guidance, Platform functionality, service providers, security practices, or our processing activities.

The current version will be published on the Platform with its "Last Updated" date. Where a change materially affects how we use personal data or your rights and applicable law requires notice or consent, we will take the required steps before or when the change takes effect.

16. CONTACT

For privacy questions or to exercise rights relating to personal data controlled by DEATH DOULA LTD:

DEATH DOULA LTD

Company Number: 17171845 (England and Wales)

Registered Office: 54 Mead Way, High Wycombe, England, HP11 1RH

Email: [email protected]