Privacy notice.

Who we are

Time To Talk About Sex is a clinical group therapy programme led by Dr Michael Yates, Clinical Psychologist. It is provided by Michael Yates Psychology Limited (company number 16755269), which delivers the free places offered through a Community Interest Company (CIC). For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Michael Yates Psychology Limited is the data controller. You can contact us through our Contact page.

What information we collect

The personal information you send through this website is what you enter in the form on our Contact page: your name, email address and message. Messages are held by our website host, Netlify, and sent to Dr Michael Yates by email. We use them only to reply to you. There is no application form on this site. When you are ready to enquire, you leave this website and register with Jane, our secure medical records provider, at timetotalkaboutsex.janeapp.co.uk. Any personal information you provide is collected inside Jane, under Jane's own privacy protections and our data-processing agreement with them.

When you register with Jane, you are asked for your name, email address, phone number and date of birth. The questionnaire Dr Michael Yates then sends you asks about your presenting concerns, brief clinical history, safety information, and your preferences for in-person or online attendance.

If you contact us by email, we receive whatever you choose to share. The site uses standard web server logs (IP address, browser, page accessed, timestamp) which are automatically deleted after 30 days.

Cookies and website analytics

This site uses Cloudflare Web Analytics, a cookieless, privacy-preserving analytics service. It counts aggregate visits and reports which pages are viewed and where visitors come from, without setting any cookies, without fingerprinting your device, and without collecting any personal data. IP addresses are hashed and discarded. This site sets no cookies of its own. Videos are hosted on YouTube and only load when you press play. When you do, YouTube (Google) receives your IP address and may store information on your device under Google’s own privacy policy.

We do not use advertising cookies, cross-site tracking, session recording, or profiling of any kind.

Why we collect it (lawful basis)

For ordinary personal data (Article 6 UK GDPR) we rely on your consent (you choose to apply or contact us) and on our legitimate interest in operating a clinical service responsibly and safely.

For special category data (Article 9 UK GDPR), including information about your sexual life, sexual orientation, mental or physical health, or substance use, we rely on two conditions: (a) your explicit consent, given via the tick-box you complete during registration inside Jane; and (b) the provision of healthcare by a qualified professional under a duty of confidence (Article 9(2)(h) UK GDPR, read with Schedule 1 Part 1 paragraph 2 of the Data Protection Act 2018).

How we use it

We use your information to assess whether the programme is the right fit, to arrange and conduct a confidential conversation with Dr Michael Yates or the clinical team, to allocate you to a group if appropriate, and to deliver the programme safely. We use it to keep clinical records as required by professional regulation. We do not use your information for marketing, profiling, or any commercial purpose unrelated to your care.

The flow of your data

Your data moves through the following steps, and only these steps:

1. Registration in Jane. You leave this website and register with Jane, our secure medical records provider. During registration you provide your name, email address, phone number and date of birth, and give explicit consent for us to hold and process your information for clinical purposes. Jane operates under its own data-processing agreement with us.
2. Screening questionnaire. Once your Jane account is set up, Dr Michael Yates emails you a short, confidential screening questionnaire so we can prepare for your first conversation. Your responses are held inside Jane.
3. Confidential conversation. Dr Michael Yates or a clinician on the team reviews your responses and arranges a confidential conversation with you.
4. Programme delivery. If the programme is the right fit, your clinical records continue to be maintained inside Jane and are seen only by Dr Michael Yates and the necessary clinical or administrative staff of Michael Yates Psychology Limited, all of whom are bound by confidentiality.

Who can see it

Your information is seen only by Dr Michael Yates and, where strictly necessary, the clinical and administrative staff of Michael Yates Psychology Limited who are bound by confidentiality. We do not share your information with anyone else without your explicit consent, except in the limited circumstances described below.

When we may share it without consent

We may share information without your consent only in narrow, specified circumstances: where there is a serious risk of harm to you or another person; where we are required to do so by law or by a court order; or where we are required to do so by professional or regulatory bodies (such as the Health and Care Professions Council, HCPC) in the course of an investigation. Any such disclosure is limited to the minimum necessary.

Session recording and research

Group sessions are recorded for clinical notes. You are told this, and asked to sign your agreement, before you accept a place. Recordings are deleted as soon as the clinical notes and a pseudonymised record of the session have been made, and in any case within 48 hours. Michael Yates Psychology Limited may use pseudonymised material for research, and only anonymised results are published. Before any data is used for research, we confirm whether ethics approval is needed and, if it is, obtain it. Men’s Mental Health Clinical Outcomes CIC does not hold patient records.

How long we keep it

Clinical records are retained in line with HCPC professional standards, typically 20 years from the end of treatment, or longer where a clinical or legal reason applies. Application records for people who do not proceed to the programme are deleted within 12 months unless you ask us to delete them sooner.

Where it is stored, and by whom (processors)

Your information is stored securely with appropriate technical safeguards, including encryption in transit and at rest and role-based access controls. The following processors act on our instructions under written data-processing agreements:

• Website hosting and contact form. The site is hosted on Netlify and served over HTTPS. Messages sent through the Contact page form are held by Netlify and forwarded to Dr Michael Yates by email.
• Website analytics. Cloudflare Web Analytics counts visits to the site without cookies and without collecting personal data.
• Clinical management (Jane). Jane App is our clinical record system. Jane provides UK-compliant secure hosting and is widely used in regulated healthcare settings.
• Email. Email correspondence between you and Dr Michael Yates uses a secure, encrypted email service.

We do not transfer your information outside the UK or European Economic Area (EEA) without ensuring an adequate level of protection through the appropriate UK GDPR mechanism.

Your rights

Under UK GDPR you have the right to: be informed about how your data is used; request a copy of your data (subject access request); correct inaccurate data; ask for deletion in certain circumstances; restrict or object to certain processing; ask for data portability where applicable; and withdraw consent at any time. To exercise any of these rights, contact us through our Contact page and we will respond within one calendar month.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. Some clinical records must be retained even if you withdraw consent, as set out in the section on how long we keep it.

Complaints

If you are unhappy with how we have handled your information, please contact Dr Michael Yates first. You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection. The ICO can be contacted at ico.org.uk or on 0303 123 1113.

Changes to this statement

We may update this statement from time to time. The current version will always be available at this page, with the date at the top.