XR Therapeutics understands that your privacy is important to you and that you care about how your personal data is used. We respect and value the privacy of all of our data subjects, clients and customers, and will only collect and use personal data in ways that are described here, and in a way that is consistent with our obligations under the law.
XR Therapeutics is a private limited company registered in England. Room 1.1, Northern Design Centre, Abbott’s Hill, Gateshead, NE8 3DF. VAT number GB377054873. Our Data Protection Lead is Chris Gowland.
Regulated by the MHRA as a manufacturer of a UKCA Class I Software as a Medical Device, developed to support healthcare professionals in delivering Cognitive Behavioural Therapy and other talking therapies for anxiety, phobias and other mental health conditions.
DTAC certified, meeting NHS standards for clinical safety, usability and accessibility.
Compliant with the requirements of NCSC Cyber Essentials.
This notice explains how we use your personal data: how it is collected, how it is held, and how it is processed. It also explains your rights under the law relating to your personal data.
Personal data is defined by the UK GDPR and the Data Protection Act 2018 as any information relating to an identifiable person who can be directly or indirectly identified from it. That covers obvious information such as your name and contact details, and less obvious information such as identification numbers and electronic location data.
Under the Data Protection Legislation you have the right to: be informed about our collection and use of your personal data; access the personal data we hold about you; have inaccurate or incomplete data rectified; be forgotten; restrict processing; object to processing; withdraw consent at any time where consent is our lawful basis; data portability; and rights relating to automated decision making and profiling.
If you have any cause for complaint about our use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office. We would welcome the opportunity to resolve your concerns ourselves first, using the contact details in section 10.
We may collect and hold personal data when communicating with private clients only: personal health information (a special category of data), personal contact information such as email address, phone number and address, and payment information including bank details and insurance details. This may reach us by email, through a website enquiry form, or through a consent form for private treatment.
No personal, patient identifiable data is collected by our Boundless software when it is used by therapists or third parties to deliver treatment.
We always have a lawful basis for using personal data. We use it to administer our business, supply our product, manage payments, personalise and improve our product, communicate with you, and, only where you opt in, to send you information you have asked for. Our lawful bases are the contract to provide private treatment, our legitimate interests in providing services and meeting our post market surveillance and clinical safety obligations, and your consent. You can opt out of marketing at any time, and we will never share your personal data with third parties for marketing purposes.
We keep personal data no longer than necessary. Health information, contact information, payment information and profile information are each kept for 8 years. Your personal data is stored only in the UK, in a cloud software system with a secure backup, and is fully protected under the Data Protection Legislation. Access is limited to those with a legitimate need to know, under duties of confidentiality, with defined procedures for handling any data breach including notifying you and the Information Commissioner’s Office where legally required.
We do not share your personal data with third parties, subject to limited exceptions: a sale, transfer or merger of parts of our business, and circumstances where we are legally required to share data. Where treatment is paid for through an insurance provider, payment information is shared with that provider in the United Kingdom. Any sharing is handled safely, securely and in accordance with your rights.
You can ask us for details and a copy of any personal data we hold about you. This is known as a subject access request, made in writing to the contact details below. There is normally no charge. We acknowledge requests within 7 days, aim to respond fully with a copy of your data within 28 days, and never take longer than one month for a standard request, or three months for a complex one, keeping you informed throughout.
For anything to do with your personal data and data protection, including subject access requests, contact us for the attention of the Data Protection Lead, Chris Gowland.
Email: hello@xrtherapeutics.co.uk
Post: Room 1.1, Northern Design Centre, Abbott’s Hill, Gateshead, NE8 3DF
We may change this privacy notice from time to time, for example if the law changes or if we change our business in a way that affects personal data protection. This notice was last updated in March 2026.
Download the full Privacy Notice (PDF)