Effective date: 17 February 2026
Version: 2.0
1. Who we are
WitnessMatch is a service operated by TrustedPsych Ltd (company no. 15705041), registered address 71–75 Shelton Street, Covent Garden, London WC2H 9JQ (“we/us/our”).
We are the data controller for personal data described in this policy.
Contact (Data Protection Lead): tom@witnessmatch.com | +44 (0)7525 475 964
2. What data we collect
We may collect:
- Identification data: name, job title, organisation
- Contact details: email, phone, address
- Professional credentials: qualifications, regulatory numbers, CVs, references
- Profile content: bio, rates, expertise, availability, case-history summaries (non-identifying)
- Media: photos, intro videos, slides
- Usage/technical data: IP, device identifiers, browser type, logs, referral URLs
- Payment data: last four digits, billing address (payments processed by Stripe)
- Communications: messages via platform, support emails, survey responses
Important: do not upload patient data or special category data unless strictly necessary and you have a lawful basis and safeguards.
3. How we obtain data
- Directly from you (registration, profile completion, uploads, purchases)
- Automatically (cookies and similar technologies)
- From third parties (e.g., payment confirmations; public professional registers)
4. How we use data and our lawful bases
We use personal data for:
A) Providing the Service (Contract)
- Creating your account and providing Platform Features
- Matching/search functionality and facilitating introductions
- Operating subscriptions, billing and customer support
Lawful basis: performance of a contract / steps to enter a contract.
B) Publishing Expert profiles (Contract + Legitimate Interests)
- Displaying professional profile information publicly (where you choose/public settings permit)
- Enabling directory search and discovery
Lawful basis: contract necessity and/or legitimate interests in operating a professional directory.
(Where we offer optional visibility controls, you can change these in your dashboard.)
C) Security, integrity and improvement (Legitimate Interests)
- Preventing abuse/fraud, maintaining security, troubleshooting, analytics, product improvement
Lawful basis: legitimate interests.
D) Legal compliance and claims (Legal obligation + Legitimate Interests)
- Accounting/tax records, compliance requests, establishing/defending legal claims
Lawful basis: legal obligation and legitimate interests.
E) Marketing
- Service updates, renewal reminders, and permitted marketing
Lawful basis: legitimate interests and/or consent where required.
You can opt out at any time (email preferences or contact us).
5. Automated decision-making / profiling
We may use basic automation to help rank or recommend relevant Experts (e.g., based on selected filters, specialties, availability, location). This does not produce legal or similarly significant effects. If you have concerns, contact us.
6. Data retention
Typical retention periods:
- Account data: life of account + 6 years
- Payment records: 7 years (tax/financial rules)
- Analytics/logs: up to 24 months
- Marketing opt-out lists: retained to honour your preferences
We may retain longer where necessary for legal claims/compliance.
7. Security
We use appropriate technical and organisational measures designed to protect personal data, such as encryption in transit, access controls and staff security measures.
Where we describe specific security measures, we may update them as our systems evolve.
8. Sharing data / processors / international transfers
We use a small number of service providers (processors), typically including:
- Stripe (payments/subscriptions)
- Webflow (website/CMS hosting)
- Outseta (authentication/CRM/email automation)
- Google Analytics / Microsoft Clarity (analytics, where enabled)
Some providers may process data outside the UK/EEA. Where so, we rely on adequacy decisions or safeguards such as SCCs/IDTA.
We do not sell personal data.
9. Cookies
We use essential cookies and (where enabled) analytics/marketing cookies.
A cookie banner allows you to accept/reject/customise non-essential cookies.
10. Your rights
Subject to UK GDPR, you may request:
- access, rectification, erasure, restriction,
- portability,
- objection,
- withdrawal of consent (where consent is used),
- complaint to the ICO.
We aim to respond within one month after verifying identity.
11. Children
The Service is for professionals aged 18+. We do not knowingly collect data from children.
12. Changes
We may update this policy. We will highlight material changes via email or on our website. The effective date shows the latest version.
