Privacy Notice
govima.co · Version 1.1 · Effective September 2026
We (VIMA MATCH LIMITED, trading as “VIMA”) are committed to protecting the privacy and security of your personal information. This notice explains who we are, how and why we collect, store, use and share your personal data, your rights, and how to contact us or the supervisory authority if you have a complaint.
When we use your personal data we are regulated under the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.
Our two roles
VIMA has two data-protection roles. We are the controller of our account-holders’ (Therapists’) and website visitors’ personal data. We are only the processor of the personal and clinical data a Therapist records about their Clients — for that data, the Therapist is the controller. VIMA is not the controller of Client information; the Therapist is. We store and process it solely on the Therapist’s documented instructions, under a Data Processing Agreement, and do not access, use or share Client records for our own purposes.
Key terms
VIMA = VIMA MATCH LIMITED (CRN: SC839660), trading as “VIMA”, registered office 36/6 Hawthornvale, Edinburgh, EH6 4JN. Point of contact: Cécile Sami · hello@govima.co. Personal data = any information relating to an identified or identifiable individual. Special category (sensitive) data = data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic and biometric data, health, sex life or sexual orientation, or criminal offences. Therapist = a practitioner who uses VIMA to manage their practice, and the controller of their Client data. Client = a recipient of therapy from a Therapist.
We are registered with the Information Commissioner’s Office (ICO), registration number ZC190603.
Personal information we collect
Identity Data (name, username, title, date of birth, gender); Contact Data (address, email, phone; for Clients, emergency contact and GP details recorded by the Therapist); Financial Data (payment details processed by our provider — we do not see or store full card numbers, these are handled by Stripe); Transaction Data (payments, invoices, session details); Technical Data (IP address, login data, browser, time zone, device); Profile Data (username, password, preferences, feedback); Usage Data; Marketing and Communications Data. If you are a Client, we store the notes, logs and documents your Therapist records about you securely on their behalf and do not access them unless strictly necessary (e.g. to recover data lost through a fault). If you are a Therapist, we may also collect your qualifications, professional registrations and indemnity insurance.
Special category data
For Clients, this includes the notes your Therapist records about your sessions and related documents. These are stored securely with access controls and we will not access them unless absolutely necessary. As processor, we store them only on the Therapist’s instructions; the Therapist, as controller, is responsible for the lawful basis and for obtaining your explicit consent.
Information about other people
If you provide information about anyone other than yourself, you must ensure they’ve been informed and have consented. Our platform is not intended for children and we do not knowingly collect children’s data unless a parent/guardian consents to the child receiving therapy.
How we collect it
mostly directly from you (in person, phone, text, email, website, platform); also from publicly accessible sources, third parties, your Therapist (if you’re a Client), cookies, and our IT systems.
How and why we use it
to register you; provide services and fulfil our contract; administer our relationship including payments (Stripe Connect); comply with legal obligations; improve services and security; prevent fraud; for insurance; to exercise or defend legal rights; for statistics; to communicate about our services; and, where permitted, surveys and marketing. Lawful bases: contract, legal obligation, legitimate interests (incl. recognised legitimate interests under the Data (Use and Access) Act 2025), consent, or legal claims. For Client data we act only as processor under a Data Processing Agreement (available on request).
Who we share with
Supabase (database/storage, UK/EU), Cloudflare (hosting/security), Stripe (payments — we never see full card details; stripe.com/gb/privacy), Resend (email), and our professional advisers where necessary. We do not sell your data or your Clients’ data, and don’t let providers use it for their own purposes. We may disclose data where legally required.
Where it’s held
Your data is stored in the United Kingdom. Our database, authentication and file storage are provided by Supabase in its London region, and application hosting is provided by Cloudflare in the UK and EU. Where a provider processes data outside the UK we ensure an appropriate safeguard, such as UK adequacy regulations or standard contractual clauses.
How long we keep it, and deletion
Client/practice data (as processor): held only while the account is active. When a Therapist closes/cancels: read-only for 30 days to export and download everything, then all practice and Client data is permanently and irreversibly deleted — we keep no copy; backups purge on normal rotation. The Therapist, as controller, is responsible for exporting and keeping their own records to meet professional obligations (BACP guidance: at least 7 years after last contact for adults; for under-18s until age 25 or 8 years after last contact, whichever is longer; 7 years from death). Our own accounting records (e.g. your subscription payments) are kept ~6 years for HMRC/Companies Act — our own data, not Client data.
Security
encryption in transit and at rest; row-level access so each account sees only its own data; private file storage with signed, time-limited links; 2FA; least-privilege staff access (support cannot see Client notes; only authorised engineers can access sensitive records, only to restore lost data, via secured audited access); no access to card details. We have breach procedures and will notify you and regulators where required.
Your rights
access, rectification, erasure, restriction, portability, objection (incl. direct marketing at any time), and withdrawing consent. Email hello@govima.co. For Client data (Therapist is controller) we support the Therapist in responding.
Marketing
we may send updates where we have a legitimate interest or your consent; opt out any time via unsubscribe or hello@govima.co.
How to complain
contact us first at hello@govima.co; we operate a formal complaints process (Data (Use and Access) Act 2025). You may also complain to the ICO at ico.org.uk/concerns or 0303 123 1113.
Contact
VIMA MATCH LIMITED (trading as “VIMA”), 36/6 Hawthornvale, Edinburgh, EH6 4JN · hello@govima.co · https://govima.co