Last updated: July 2025 | Effective from: July 2025 1. Who We Are The Brain Injury Therapist is the trading name of Natalie Mackenzie, Cognitive Rehabilitation Therapist, operating as part of THE BIS SERVICES LIMITED, registered in England and Wales. Data Controller Natalie Mackenzie, The Brain Injury TherapistGHL House, 12-14 Albion Place, Maidstone, Kentnatalie@thebraininjurytherapist.co.uk This policy explains how we collect, use, store and protect your personal data, including any data collected through our clinical rehabilitation apps and integrations with third-party wearable devices. 2. What Data We Collect 2.1 Data you provide directly • Name and contact details • Information you enter into our fatigue management and cognitive rehabilitation apps • Symptom scores, activity logs, sleep data and mood entries submitted through the app • Voice memos and diary entries submitted through the app • Communications with us by email or during sessions 2.2 Data from third-party wearable devices With your explicit consent, we may connect to data from wearable health devices including the Oura Ring. This data may include: • Sleep metrics: duration, stages, score, disturbances • Heart rate and heart rate variability (HRV) • Readiness score and body temperature • Activity and movement data You authorise this connection through the device manufacturer's own authentication process (OAuth 2.0). You may withdraw this consent at any time by revoking access within your device account settings, and by notifying us in writing. 2.3 Data collected automatically • Website usage data including IP address, browser type and pages visited • Cookie data as described in Section 7 3. Special Category Health Data Some of the data we process — including symptom scores, cognitive assessments, sleep data and wearable data — constitutes special category health data under UK GDPR Article 9. We process this data on the following legal bases: • Explicit consent (Article 9(2)(a)) — you have given clear, specific consent for us to process your health data for rehabilitation purposes • Health and social care (Article 9(2)(h)) — processing is necessary for the provision of health or social care treatment by a health professional You have the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. 4. How We Use Your Data • To deliver cognitive rehabilitation and fatigue management services • To monitor your progress and adjust your rehabilitation programme • To analyse correlations between symptoms, activity, lifestyle and wearable data • To produce session summaries and clinical reports • To communicate with you about your programme • To improve our services and clinical tools We do not sell, rent or share your personal data with third parties for marketing purposes. We will never sell your data. 5. Data Storage and Security Your data is stored securely using industry-standard encryption. App data is hosted on secure cloud infrastructure. We retain clinical data in accordance with NHS and professional body guidelines — typically a minimum of 8 years for adult health records from the date of last contact. Wearable data obtained through third-party integrations is processed in accordance with both this policy and the privacy policy of the relevant device manufacturer (e.g. Oura Health Oy). We recommend you review their privacy policy separately. 6. Your Rights Under UK GDPR you have the right to: • Access the personal data we hold about you • Correct inaccurate data • Request erasure of your data (subject to legal retention requirements) • Restrict or object to processing • Data portability — receive your data in a structured, machine-readable format • Withdraw consent at any time To exercise any of these rights, contact us at natalie@thebraininjurytherapist.co.uk. We will respond within 30 days. If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113. 7. Cookies Our website uses cookies to improve your experience and analyse traffic. We use: • Essential cookies — required for the website to function • Analytics cookies — to understand how visitors use our site (Google Analytics) You can manage your cookie preferences through your browser settings at any time. 8. Third Party Integrations Our rehabilitation apps may connect to the following third-party services with your consent: • Oura Health Oy (Oura Ring) — sleep, HRV and activity data Each integration requires your explicit authorisation and can be revoked at any time. We are not responsible for the data practices of third-party platforms, and we recommend you review their respective privacy policies. 9. Changes to This Policy We may update this policy from time to time. Where changes are material, we will notify you by email. The current version is always available at www.thebraininjurytherapist.co.uk/privacy. 10. Contact Get in touch Natalie MackenzieThe Brain Injury Therapistnatalie@thebraininjurytherapist.co.ukwww.thebraininjurytherapist.co.uk © 2025 The Brain Injury Therapist | Natalie Mackenzie | THE BIS SERVICES LIMITED