Trust centre
Your data and your rights
Family Emotional Health Ltd is the data controller for Assembly under UK GDPR. Here's what that means in practice: what we hold, and what you can make us do with it.
What we hold
We only keep what's needed to run your account and the service. Your child's profile, answers and reports are processed in the UK, in Microsoft Azure. The only thing processed outside the UK is usage analytics (PostHog, EU): it's linked to a session, not your name, and it never receives your child's profile, answers or reports. Sign-in is passwordless and runs inside our own application: no third-party identity provider ever holds your account.
- Your account , Your email address and sign-in records, held in our own UK database. Sign-in is passwordless (an email link or code); no third-party identity provider is involved.
- Your children , Names, dates of birth and gender for the children you add.
- Answers and observations , Profiler answers and any free-text observations you share, per child.
- Chats and messages , Conversation history with Assembly, per child.
- Reports , Generated reports and PDFs for each child, stored in UK cloud storage with authenticated, logged downloads.
- Programme progress , Which programmes and episodes you've started or completed, per child.
- Usage analytics , Which features are used (PostHog, EU), so we can improve the product. Tied to a session, but never your child's profile or answers. We don't sell your data.
The full detail, including lawful bases, is in the privacy policy. Who processes it on our behalf is listed openly at who processes your data.
Your rights, and how to actually use them
Every right below is free to exercise, and none of them needs a form or a phone call. We respond within one calendar month, usually much faster.
See what we hold
Right of accessAsk for a copy of everything we hold about you and your children. We'll send it in a readable format within one calendar month, free of charge.
Request a copy of your dataFix what's wrong
Right to rectificationIf anything we hold is inaccurate, a name, a date of birth, an answer you gave, you can correct much of it in the app, or ask us to correct it for you.
Ask us to correct somethingDelete everything
Right to erasureHave your account and your children's data removed. This has its own page, because it should be easy to find.
How deletion worksTake your data with you
Right to portabilityAsk for your data in a structured, machine-readable format you can take elsewhere.
Request an exportPause or limit processing
Right to restriction and objectionAsk us to stop or limit what we do with your data, including analytics, while keeping your account.
Object to processingComplain to the regulator
Right to lodge a complaintYou can raise a concern with the Information Commissioner's Office at any time, free, without asking us first.
ICO complaintsWho answers
Requests go to our named data-protection lead at ayse@getassembly.co.uk , a person accountable for the answer, not a shared inbox that routes to nowhere.