Privacy Policy for the Barney Mobile App

1. Who We Are

• Data Controller: The Barney App Limited

• Registered office: Lindfield, West Sussex

• Company Registration Number: 16119272

• Contact email: tom@barneyrecovery.com

If you access the App via a treatment centre or care provider, that provider may also act as a separate Data Controller. Please consult their Privacy Policy for more information.

2. What Data We Collect

 
a) Personal Data:

• Name

• Email address

• Username / login credentials

• Date of birth (if required by your provider)

• Gender (optional)
   

b) Health-Related Data (Special Category Data):

• Self-reported mood and wellbeing reflections

• Gratitude entries

• Responses to SAQs and daily questionnaires

• Usage activity within the App

• Progress and engagement metrics

• Participation in virtual aftercare sessions
   

c) Technical Data:

• Device type

• IP address

• App version

• Usage analytics

3. How We Use Your Data

We use your personal data to:

• Provide you with access to the App and its features

• Enable you to participate in aftercare and alumni programs

• Share your progress and engagement with your treatment provider

• Monitor and improve the App’s performance and effectiveness

• Ensure the App’s security and integrity

• Comply with legal obligations

4. Lawful Basis for Processing

We process your personal data on the following lawful bases under UK GDPR:

• Consent — where you actively agree to certain processing (e.g. completing questionnaires)

• Contractual necessity — to provide services to you via the App

• Legitimate interests — to ensure App functionality and improve user experience

• Legal obligation — to comply with applicable laws and regulations

When processing special category data (health-related data), we do so under Article 9(2)(a) — with your explicit consent.

You may withdraw your consent at any time via the App settings or by contacting us.

5. How We Share Your Data

• With your treatment centre or care provider (where applicable), for your ongoing support and aftercare

• With authorised third-party service providers (e.g. cloud hosting, analytics platforms) under strict data processing agreements

• Where required by law or to protect your vital interests

We do not sell your data.

6. International Data Transfer

We primarily store and process your data in the UK or EEA. Where we use third-party processors outside the UK/EEA (e.g. US-based cloud services), we ensure appropriate safeguards are in place (e.g. UK Addendum to SCCs or other approved mechanisms).

8. Your Rights

Under UK GDPR, you have the right to:

• Access your personal data

• Rectify inaccurate or incomplete data

• Erase your personal data (“right to be forgotten”)

• Restrict processing of your data

• Object to processing

• Data portability (receive a copy of your data in a portable format)

• Withdraw consent where processing is based on consent

​To exercise any of these rights, contact us at tom@barneyrecovery.com.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Data encryption in transit and at rest

• Secure user authentication

• Access controls

• Regular security monitoring and testing