Who we are
The MLD Register is a trading name of Truly Empowered Ltd, registered in England and Wales, company number 11904082, registered office 71-75 Shelton Street, London, WC2H 9JQ. We are the data controller for the personal data described in this policy. Contact: hello@themldregister.com. You have the right to raise a concern with the ICO at any time (ico.org.uk).
The short version
We use personal data to assess applications, run member profiles and live badges, deliver enquiries and alerts, take payments and, with consent, measure how the site is used. We do not sell personal data to anyone, and we carry no advertising on this site. The sections below explain what we use, the lawful bases, who receives it and how long we keep it.
Members and applicants
Account security and choices: we store protected sign-in and recovery proofs, trusted-browser records, and any evidence needed for an operator-assisted account recovery. We also store your review-display choice, declared professional bodies, dated guidance acknowledgement and optional availability-email preference. These records support account security and your chosen settings. Essential service messages remain separate from optional availability reminders.
What we collect: your name, contact details, practice addresses, training school and level, insurance provider, uploaded documents (training certificate, insurance schedule, optional refresher certificates), payment records (processed by Stripe; we never see your full card number), profile content you write including any fees you choose to publish, your optional taking-new-clients confirmations, an optional gender you may declare (used only as a search filter, never shown as text on your profile, and entirely your choice to leave unset), and usage of your dashboard.
Why and on what lawful basis: to assess your application and verify your documents, to publish your profile and operate your membership (performance of a contract); to keep a proportionate record of verification decisions and handle disputes (legitimate interests); to keep invoices and payment records and meet tax and accounting duties (legal obligation); to send you service emails such as renewal reminders and document-expiry chasers (performance of a contract); and to tell you about relevant register features and offers (legitimate interests, with an opt-out in every email, or consent where we have asked for it).
Your documents: uploaded certificates and insurance schedules are stored securely, accessed only for verification and record-keeping, and are never published. To speed up review, we may use an AI assistant (Claude, run by Anthropic) to read the documents you upload and pull out the details for checking. Its reading only ever assists the human reviewer: every membership decision is made by a person. Your public profile shows the outcome of verification (school, level, dates), not the documents.
Your profile: where we build your profile for you, the answers you write for us are sent to the same AI assistant (Claude, run by Anthropic) to draft your bio. You read that draft, change anything you want, and nothing is published until you approve it. Anthropic processes what we send on our instructions as a data processor and, under our commercial terms, does not use it for model training by default unless we opt in or submit feedback.
Public data: your published profile (name, registration number, town, training school and level, verification dates, and the content you choose to add, including any published fees and the date of your latest taking-new-clients confirmation) is public by design; that is what a register is. Lapsed and removed statuses are shown as described in our Verification Standard and Complaints Procedure.
Retention: membership records and verification documents are kept for the duration of membership plus 6 years (limitation and record-keeping). Declined applications are kept for 12 months, then deleted.
Patients and enquirers
What we collect: when you send an enquiry through a profile, we collect your name, email, optional phone number, your selected enquiry type and your message. When you use the notify-me feature, we collect your email address and search location. When you sign up for launch updates, we collect your first name, your email address and the area you were searching for. These two sign-ups are separate: an alert about a practitioner joining near you is only ever sent to someone who asked for that, and never to someone who signed up for launch updates.
Why and on what lawful basis: to deliver your enquiry to the therapist you chose and acknowledge your saved message to you (legitimate interests: providing the service you asked for); to keep a delivery log so we can make sure the enquiry system works and investigate problems (legitimate interests); and to send you the single notify-me alert you requested, or the launch updates you asked for, whichever you signed up to (consent, which you can withdraw at any time by emailing us). The two are recorded separately: we only ever send you the one you agreed to.
Who sees it: the therapist you chose receives your enquiry. Our hosting and email providers process it only as needed to deliver and secure the service. We never use enquiry content for marketing, and we never sell it.
A note on health information: we ask you not to include detailed medical information in enquiries. Anything you choose to include is handled with extra care as special category data, on the basis of your manifest decision to send it to the therapist, and is not used for any other purpose.
Retention: enquiry logs are kept for 12 months, then deleted with their associated delivery records. Notify-me emails are deleted after the alert is sent or after 24 months, whichever is sooner. Launch-update emails are deleted 24 months after you sign up, or as soon as you ask us to remove you.
Reviews you leave: when you leave a review on a therapist's review page, we collect your name, your chosen public display name (which can be anonymous), your star rating, your review text, the exact consent statement you agreed to, and a hashed identifier of your connection used only to prevent abuse. Your review and display name are published on the therapist's profile (legitimate interests: operating a fair, transparent review system, on the basis of the consent statement you agree to when submitting); your name as typed is kept privately and never published. Please do not include detailed medical information; anything you choose to include in a published review is there by your own decision. The therapist can reply publicly. Reviews stay published while the profile is listed; to correct or remove your review, contact us and we will remove it.
Therapists we contact about the register (Article 14 notice)
In building the register we may hold limited professional contact information about MLD therapists we have not yet met, obtained from publicly available sources such as professional listings and practice websites: typically your name, practice name, town, publicly listed phone number, website and professional category. We use it only to assess the market and, where the law permits (for example, live telephone calls screened against TPS and CTPS, or postal mail), to invite you to join the register. Our lawful basis is legitimate interests: introducing a professional service to practitioners to whom it is directly relevant, using minimal data, with a documented Legitimate Interests Assessment on file. We do not send unsolicited marketing emails, texts or messages to sole traders without consent. You have the right to object at any time: one message to hello@themldregister.com and we will permanently suppress your details from any further contact and delete what we hold, unless we need a minimal suppression record to honour your objection. We do not publish any listing for a therapist who has not applied; the register is opt-in only.
Website visitors
We use essential cookies to make the site work. We also use Google Analytics, which sets its own cookies to measure how the site is used, for example which pages are opened and how visitors arrived. That information is processed by Google on our behalf and may be handled outside the UK under Google's own safeguards. You can block or delete these cookies in your browser settings at any time. Server logs (IP address, pages requested) are kept briefly for security.
Who we share data with
Service providers who help us run the register, under contract and only as needed: our hosting provider (UK/EU data centres), Stripe (payments), our email delivery provider, Google (website analytics), Anthropic (the AI assistant described above), and our accountant for financial records. We share data with authorities where the law requires. If the business is reorganised or sold, personal data may transfer where permitted by law, and we will provide notice where required.
International transfers
We keep data in the UK or EEA wherever possible. Where a provider processes data outside the UK, we rely on UK adequacy regulations or the appropriate safeguards (such as the UK International Data Transfer Agreement).
Security
Data is encrypted in transit, documents are stored with restricted access, payment card data is handled entirely by Stripe, and access to admin systems is limited and logged.
Your rights
You have the right to access your data, correct it, have it erased, restrict or object to processing (including an absolute right to object to direct marketing), and data portability, where those rights apply. To exercise any right, email hello@themldregister.com; we respond without undue delay and normally within one month, and where the law permits an extension for a complex or multiple request we will tell you within the first month. If you have a data protection complaint, please raise it with us first (we operate a complaints process for data concerns and will respond promptly) and you can complain to the ICO at any time: ico.org.uk or 0303 123 1113.
Changes
We will post any changes here and, for material changes affecting members, email you. Previous versions are available on request.