Mendory Privacy Policy

Last updated: 21 September 2026
Effective from: 21/09/2026

1. Who we are

Mendory is an online therapist directory, matching and communication platform. It helps people discover and contact therapists, use search and matching tools, submit requests for therapists, and communicate with therapists. It also allows therapists to create and manage listings, receive enquiries, access client opportunities where eligible, and view aggregated information about the performance of their listing.

The controller responsible for the personal data described in this policy is:

Mendory Ltd
Company number: 11973312
Registered office: 37 Westminster Buildings, Office 469, Theatre Square, Nottingham, NG1 6LG
Privacy email: privacy@mendory.co.uk

This policy explains what personal data we collect, why we use it, who we may share it with, how long we keep it, and the rights available to you under UK data-protection law.

2. What Mendory is — and is not

Mendory provides a directory, matching and communication platform.

Mendory is not a healthcare provider, does not employ the therapists listed on the platform and does not itself provide medical advice, diagnosis or treatment.

Therapists listed on Mendory are independent professionals. You should consider whether a therapist's qualifications, professional registration, insurance, experience, services and approach are suitable for your needs before arranging treatment.

Mendory's AI Matching and Request a Therapist features are designed to help people identify potentially relevant therapists. They are not diagnostic or emergency services and do not replace advice from an appropriately qualified healthcare professional.

Mendory does not continuously monitor AI requests, client requests or messages and cannot contact emergency services on your behalf. If you believe that you or somebody else is in immediate danger or requires urgent medical attention, call 999 or use an appropriate urgent healthcare service.

3. Personal data we collect

The information we collect depends on how you use Mendory.

3.1 Website visitors

When you visit Mendory, we may collect technical and usage information such as your IP address and approximate location derived from it, browser and device information, operating system, screen information, pages viewed, dates and times, referring page or discovery source, interactions with site features, session or visitor identifiers, cookie choices, error information and security logs.

We may also use cookies, local storage and session storage for authentication, security, saved navigation, preferences, analytics and the operation of Mendory features.

3.2 Client and member accounts

If you create a Mendory account, we may collect your name, email address, member identifier, account type, sign-in and account status, saved therapists, preferences, communications with us, consent records and privacy choices.

Authentication is provided through our website platform. Mendory does not store your password in readable form.

3.3 Therapist listings

If you create or manage a therapist listing, information may include your name, business or practice name, profile description, profession, qualifications, training, professional memberships or registrations, services, specialisms, treatment approaches, body regions, client groups, languages, experience, practice location, service area, session types, fees, availability, opening hours, accessibility information, contact details, website, booking links, photographs, social links, whether you are accepting clients, subscription tier, listing status and verification status.

Where enabled, information relating to a connected Google Business Profile, such as rating or review information, may also be displayed.

Information that you publish on a therapist listing is publicly accessible. Search engines and other third parties may index, cache or archive public pages. Removing information from Mendory does not necessarily remove copies already held by those third parties.

3.4 Therapist verification

Where Mendory offers verification, we may collect identity information, qualification or training evidence, professional registration or membership information, insurance information, documents or images supplied as evidence, correspondence about the review, and internal decision and audit records.

Verification evidence is used for review purposes and is not normally published.

A Mendory verification badge indicates that Mendory reviewed the evidence required under the verification process that applied at the time. It is not an ongoing guarantee of a therapist's competence, conduct, availability or suitability for a particular person.

3.5 Manual search and AI Matching

When you search for a therapist, we may process search terms and selections, profession, services and specialisms, symptoms or conditions, affected body regions, treatment preferences, location or postcode, session preferences, availability preferences, therapists displayed or selected, and related technical information.

Some search information may reveal information about your physical or mental health. Health information is special category personal data and receives additional protection.

Where health-related search options require health-data consent, Mendory asks for that consent separately.

When you choose AI Matching, the information you enter may be processed using OpenAI's API so that Mendory can interpret your request and identify potentially relevant therapist listings.

AI Matching is optional. You can use Mendory's manual search instead.

3.6 Messages and therapist enquiries

If you contact a therapist through Mendory, we may process the identities of the participating client and therapist, conversation identifiers, message content, timestamps, delivery and notification information, conversation status and limited security information.

Messages may contain health information if you choose to include it.

Please provide only information reasonably necessary for the initial enquiry.

Once a therapist receives information from you, they may process it independently for purposes such as assessing your enquiry, arranging an appointment, providing treatment and keeping clinical records. The therapist will normally be independently responsible for that professional processing and should provide their own privacy information where required.

3.7 Request a Therapist and Client Opportunities

Mendory's Request a Therapist feature allows a client to describe what they are looking for and enables Mendory to identify potentially suitable therapist profiles.

A request may contain information including the profession sought, selected specialisms, a description of the problem or support required, body regions, preferred session types, approximate location or postcode, search radius, availability and other preferences.

Because the description of a request may contain information about symptoms, injuries, conditions, disability or treatment needs, it may contain health data.

Before a health-related request is submitted, Mendory requires an affirmative consent choice covering Mendory's processing of the health information and its sharing with suitable matched therapists for the purpose of considering and responding to the request.

A submitted request is matched against relevant therapist profiles. Therapists may initially receive limited information indicating that an opportunity has matched their profile. Therapists with the appropriate Mendory access may then view the information made available for that opportunity and decide whether to respond.

Mendory does not include the client's full health/request content in ordinary opportunity notification analytics or general platform analytics.

A Request a Therapist request remains open for up to 14 days, unless it is withdrawn or closed earlier. Mendory currently limits a request to a maximum of five therapist responses.

A client can withdraw an open request. If a client chooses a responding therapist, Mendory may create or reuse a normal Mendory conversation between them. That conversation is then handled under the messaging provisions of this policy rather than being deleted as part of Request a Therapist retention.

3.8 Subscriptions and payments

If a therapist purchases a Mendory subscription or paid service, we may process plan and subscription details, order information, payment status, billing information, invoices, refunds, cancellation information and records necessary for accounting, fraud prevention or dispute handling.

Payment-card information is entered into and handled through the payment and checkout providers used by the site. Mendory does not intend to receive or store complete card numbers or card security codes.

3.9 Analytics

Mendory records limited information to understand how the platform and therapist listings are used.

This may include search appearances, profile views, approximate unique visitor measurements, engaged time, profile clicks, contact clicks, booking-link or website clicks, saved therapists, completed enquiries, discovery sources and selected search categories.

Request a Therapist analytics may include lifecycle events such as a request being created, matched, viewed, responded to, selected, withdrawn or expired.

Mendory's Request a Therapist analytics are designed not to copy the request description, health information, body regions, specialisms associated with an identifiable request, postcode, therapist response text, matching reasons or matching scores into ordinary analytics records.

Therapists receive aggregated information relating to their own listing. Mendory does not provide therapists with raw visitor identifiers, underlying analytics event records or exact free-text health searches.

3.10 Information from third parties

We may receive personal information or related service information from organisations including Wix, Google, postcode/location services, payment providers, professional registers or insurers where relevant to verification, search engines and referral sources, and people who contact Mendory about a listing, communication or safety concern.

4. How we use personal data and our lawful bases

We process personal data only where we have an appropriate lawful basis.

For creating and managing accounts, providing search, saved-therapist functionality, messages, subscriptions and other requested services, we generally rely on performance of a contract or steps taken at your request before entering into a contract.

For creating, publishing, ranking and maintaining therapist listings, we may rely on performance of a contract and our legitimate interests in operating a useful and trustworthy therapist marketplace.

For therapist verification, fraud prevention, platform integrity, reports and safety matters, we may rely on performance of a contract, our legitimate interests, and where appropriate a legal obligation.

For AI Matching, we rely on your choice to use the feature and, where health information is processed, your explicit consent for the processing of special category health data.

For health-related manual-search information where explicit consent is requested, we rely on that explicit consent for the relevant health-data processing.

For Request a Therapist, we process ordinary information to provide the service you request. Where the request contains health information, and where information is shared with suitable matched therapists, we rely on your explicit consent for that special category processing.

For messages containing health information, Mendory relies on your explicit consent to process that health information through the Mendory messaging service.

For subscriptions, transactions, accounting and disputes, we may rely on performance of a contract, legal obligation and our legitimate interests.

For security, fraud detection, misuse prevention, service reliability and enforcement of our terms, we generally rely on our legitimate interests and, where applicable, legal obligation.

For service improvement and platform analytics, we may rely on our legitimate interests. Where cookies or similar technologies require consent, we obtain that consent before using the relevant non-essential technology.

For optional marketing communications, we rely on consent or another lawful permission available under applicable direct-marketing law.

Where we rely on legitimate interests, we consider the purpose of the processing, whether it is necessary and the effect on your rights and interests.

5. AI Matching and OpenAI

When you choose AI Matching, Mendory sends the text and relevant filters you submit to the OpenAI API so the information can be structured and used to identify potentially relevant therapist listings.

This may include health information where you choose to provide it.

Mendory configures its Responses API requests with storage disabled so that the response is not retained as normal retrievable Responses application state.

OpenAI states that information submitted through its API is not used to train or improve its models by default unless the API customer expressly opts in.

Under OpenAI's standard API arrangements, separate abuse-monitoring logs may contain API input and output and may be retained for up to 30 days unless a different permitted arrangement or legal requirement applies.

Within Mendory, temporary AI-processing records have short technical lifetimes. Raw AI interpretation jobs are designed to become inaccessible after approximately 10 minutes, rate-limit records after approximately 24 hours, and temporary processing locks after approximately 90 seconds. Scheduled maintenance removes expired technical records.

AI Matching may rank or filter therapist listings but is not intended to make a solely automated decision that has legal or similarly significant effects on you.

AI Matching does not diagnose a condition, determine treatment or guarantee that a therapist is suitable.

If you do not want health-related information processed using OpenAI, use Mendory's manual search instead.

6. Health and other special category data

Information about symptoms, injuries, conditions, disabilities, treatment requirements or other health matters may be special category personal data under UK data-protection law.

Where Mendory relies on explicit consent for health-data processing, the relevant consent control is separate from ordinary website terms, marketing consent and cookie consent.

You may withdraw consent for future processing. Withdrawal does not make processing that was lawful before withdrawal unlawful.

Withdrawal may mean that Mendory can no longer provide the relevant health-dependent feature.

Please avoid providing more health information than is reasonably necessary.

In particular, you should not submit extensive medical records, identification documents or detailed clinical histories through an initial therapist enquiry unless there is a clear reason to do so and an appropriate secure process is available.

7. Who we share information with

Mendory may share personal data with clients and therapists where necessary to provide enquiries, Request a Therapist matching, responses and conversations.

We may also use service providers including Wix for hosting, website infrastructure, membership, databases, CRM, communications, subscriptions, checkout and security; OpenAI when you choose AI Matching; Google for relevant Business Profile, rating, review, mapping or linked services; postcode or location services; payment and accounting providers; and email, notification, support, monitoring and technical service providers.

We may also disclose relevant information to professional advisers, insurers, auditors, regulators, courts, law-enforcement bodies or public authorities where disclosure is lawfully required or reasonably necessary.

Information may also be disclosed in connection with a business sale, investment, restructuring or transfer, subject to appropriate protections.

We do not sell personal data.

8. Independent therapists

Mendory is responsible for its processing in operating the Mendory platform.

Therapists are independent professionals and will normally be separately responsible for personal data that they subsequently use to assess an enquiry, arrange an appointment, provide treatment, maintain clinical records, take payment for treatment or comply with their own professional, legal or insurance obligations.

Therapists should provide their own privacy information and maintain appropriate systems for confidential professional information.

Questions about a therapist's independent use of your information should normally be directed to that therapist.

9. International transfers

Some organisations providing services to Mendory may process personal information outside the United Kingdom.

Where UK data-protection law requires safeguards for an international transfer, Mendory uses or relies upon an appropriate lawful transfer mechanism. This may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved Standard Contractual Clauses or another lawful mechanism.

You may contact privacy@mendory.co.uk for further information about relevant safeguards.

10. How long we keep personal data

We keep identifiable personal data only for as long as reasonably necessary for the relevant purpose, subject to legal, accounting, security, regulatory and dispute-resolution requirements.

InformationNormal retention

AI interpretation jobApproximately 10 minutes, followed by scheduled cleanup

AI rate-limit eventApproximately 24 hours, followed by scheduled cleanup

AI processing lockApproximately 90 seconds, followed by scheduled cleanup

OpenAI standard abuse-monitoring dataUp to 30 days under OpenAI's standard API arrangements, subject to exceptions

Raw Mendory analytics events90 days

Monthly per-listing analytics summariesWhile the listing is active and for 24 months afterwards

Active Request a Therapist requestUp to 14 days unless withdrawn or closed earlier

Closed, withdrawn or expired Request a Therapist request, matches and responses90 days from closure

Account and member-profile personal dataWhile active and ordinarily for 90 days following account closure, subject to the closure process and other required retention

Published therapist listingWhile active and ordinarily for 90 days after closure, subject to third-party caching

Messages and conversationsOrdinarily 24 months after the last activity, or within 90 days following account closure, unless longer retention is needed for a complaint, safety matter or legal claim

Verification evidence90 days after the final verification decision

Verification outcome and audit recordsSix years

Subscription, invoice and accounting recordsNormally up to six years after the relevant accounting period

Support enquiries and privacy complaintsNormally two years after closure of the matter

Security and access logsNormally 12 months unless an incident or legal matter requires longer preservation

Marketing preferencesUntil consent is withdrawn or you opt out; a minimal suppression record may then be retained to honour the opt-out

When an account is closed, some Mendory data may pass through a recovery or retention period before final deletion. Data needed for legal, accounting, safety, fraud-prevention, complaints or legal claims may be kept for longer where justified.

Anonymised information that no longer identifies an individual may be retained for statistical and service-planning purposes.

11. Account closure

Where Mendory offers account closure, an account may have a recovery period before final deletion.

A therapist's public listing may be removed or archived as part of the closure process.

Where a paid subscription remains active until the end of a paid billing period, relevant subscription access or records may continue for that period.

After the applicable recovery and retention stages have passed, eligible personal data is deleted or anonymised in accordance with Mendory's retention processes, subject to information that must lawfully be retained for another purpose.

12. Data security

Mendory uses technical and organisational measures intended to protect personal data.

These include member authentication, access controls, participant and role checks, restricted backend access, validation of inputs, rate limits, limited data returned to public pages, privacy-thresholded analytics and security measures provided by the platforms and service providers we use.

Request a Therapist operational collections are not intended to be publicly accessible as general website datasets.

No website, system or transmission method can be guaranteed to be completely secure.

You are responsible for keeping your login credentials confidential and should contact us promptly if you believe your account has been compromised.

13. Accuracy and user responsibilities

Please keep your account and contact information accurate.

Therapists are responsible for maintaining accurate listing information, including qualifications, registration, insurance, services, availability and contact details.

Mendory may correct, restrict, suspend or remove information that appears inaccurate, misleading, unlawful, unsafe or contrary to our terms.

We may ask for additional evidence before making certain changes or restoring a listing.

14. Cookies and similar technologies

This section acts as Mendory's cookie notice.

Mendory and Wix use cookies and similar technologies, including browser storage, local storage and session storage.

These technologies may be strictly necessary for authentication, security, account sessions, checkout, navigation and privacy choices; functional, to remember settings or enable features; analytical, to understand use of Mendory and performance; or marketing-related if Mendory introduces advertising or related measurement.

Mendory uses the Usercentrics for Wix consent system.

When the consent system is active, non-essential cookies and scripts controlled through that system are not intended to load until the visitor has provided the relevant consent.

You can accept or reject categories of non-essential cookies through the cookie banner.

You can later review or change your choices at any time using the privacy/cookie settings trigger displayed on the Mendory website. Selecting that control reopens the consent settings.

The consent interface provides information about the relevant cookie and service categories detected on the website.

Some third-party applications or custom technologies may require separate configuration to ensure that they respect the selected consent status. Mendory reviews the technologies used on the site and their consent categorisation as part of its website maintenance.

Rejecting optional cookies will not prevent basic use of the website, although some optional functions or measurements may not operate.

Cookie consent is separate from consent to process health information.

15. Marketing communications

You may unsubscribe from optional Mendory marketing communications at any time by using the unsubscribe option included in the communication or by contacting us.

Stopping marketing does not prevent essential account, security, enquiry, subscription, privacy or service communications.

Therapists must not use information obtained through Mendory for unrelated direct marketing unless they have their own lawful basis and comply with applicable marketing law.

16. Your data-protection rights

Depending on the circumstances and the type of processing involved, you may have the right to:

• be informed about the use of your personal data;

• request access to personal data held about you;

• ask us to correct inaccurate or incomplete information;

• ask us to erase information;

• ask us to restrict processing;

• object to certain processing, including processing based on legitimate interests and direct marketing;

• receive certain information in a portable format;

• withdraw consent for future processing at any time; and

• obtain protections relating to qualifying automated decisions.

These rights are not absolute and their application depends on the circumstances and applicable law.

We may need to verify your identity before fulfilling a request.

You can exercise a privacy right by emailing privacy@mendory.co.uk or by using Mendory's Privacy & Data Requests facility.

17. Data-protection complaints

If you are concerned about how Mendory has used your personal data, please contact us:

Email: privacy@mendory.co.uk
Post: Mendory Ltd, 37 Westminster Buildings, Office 469, Theatre Square, Nottingham, NG1 6LG

You may also use Mendory's Privacy & Data Requests facility where appropriate.

We will acknowledge a data-protection complaint within 30 days.

We will investigate the complaint without undue delay, keep you informed where appropriate and communicate the outcome.

You also have the right to raise a complaint with the Information Commissioner's Office (ICO), the UK data-protection regulator.

Information about making a complaint to the ICO is available through the ICO website.

18. Children and minimum age

Mendory accounts and interactive client features are intended for people aged 18 or over at launch.

People under 18 must not independently create a Mendory account or directly submit personal or health information through AI Matching, Request a Therapist, Mendory messaging or similar interactive client features.

An adult parent, guardian or other responsible adult may use Mendory to search for a therapist for a child or young person where appropriate.

A therapist listing may state that the therapist works with children or young people. This does not mean that Mendory's account or matching services are intended for independent use by somebody under 18.

If Mendory later introduces services designed for direct use by children or young people, we will review the service design, age-assurance arrangements, privacy information, consent processes and other safeguards before doing so.

If you believe that somebody under 18 has provided personal information directly to Mendory contrary to these requirements, contact privacy@mendory.co.uk.

19. Third-party websites and services

Therapist listings may contain links to external websites, booking platforms, social networks, Google services or other third-party services.

Those organisations are responsible for their own processing and privacy practices.

Mendory is not responsible for the privacy notice or content of a third-party website merely because it is linked from a Mendory profile.

You should review the relevant organisation's privacy information before providing personal data to it.

20. Changes to this policy

We may update this policy where Mendory's services, providers, technical systems or legal obligations change.

The latest version will be published on Mendory and the “Last updated” date will be changed.

If a change materially affects how we process personal information, we will provide additional notice or obtain new consent where required.

21. Contact us

For questions about this Privacy Policy, personal-data rights or Mendory's use of personal information, contact:

Mendory Ltd
37 Westminster Buildings, Office 469
Theatre Square
Nottingham
NG1 6LG

Email: privacy@mendory.co.uk