Privacy Policy
Last updated: 12 January 2026
1. Introduction
Back & Forth MMH (Registered Charity No. 1210246) ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our App ("Back & Forth").
We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Data Controller
Back & Forth MMH is the data controller responsible for your personal data. You can contact us at backandforthmmh@gmail.com
3. What Data We Collect
We collect the following personal data:
Account Information:
- Email address
- Full name
- Display name (optional)
- Profile picture (optional)
- Personal motto (optional)
Wellness Data:
- Daily check-ins (mood scores, reflections, gratitude entries)
- Journal entries (content, tags, mood)
- Crisis safety plan (warning signs, coping strategies, emergency contacts)
- Progress analytics and streak data
Community Activity:
- Community posts and replies
- Direct messages between users
- Support reactions on posts
- Group memberships and group posts
Location Data (Reach Out feature):
- Approximate location (latitude/longitude) when you create a reach out request
- This data is only collected when you actively use the Reach Out feature
Technical Data:
- Last seen/online status
- Usage timestamps
4. How We Use Your Data
We use your data for the following purposes:
- To provide the service: Creating your account, storing your wellness data, enabling community features
- For safety monitoring: Automated keyword detection to identify users who may be in crisis
- To send notifications: Email and in-app notifications about replies, messages, and reach out responses
- To improve the service: Understanding how features are used to make improvements
- For support: Responding to your enquiries and providing assistance
5. Legal Basis for Processing
We process your data under the following legal bases:
- Consent: You consent to our processing when you create an account and use the App
- Legitimate interests: Safety monitoring and service improvement
- Vital interests: In emergency situations where we believe there is risk of harm
6. Data Privacy by Feature
Private Data (Only You Can See):
- Crisis safety plan
- Journal entries
- Daily check-ins
- Progress analytics and streak data
Shared Data (Visible to Other Users):
- Display name and profile picture
- Community posts and replies (unless posted anonymously)
- Direct messages (only to the recipient)
- Reach out requests (approximate location, message)
- Online status
7. Data Sharing
We do not sell your data. Your data may be shared in the following limited circumstances:
- Base44 Platform: We use Base44 as our technical platform provider for hosting and infrastructure
- Emergency services: If we believe there is imminent risk of serious harm
- Legal requirements: If required by law or legal process
- Other users: Data you choose to share publicly (community posts, reach out requests)
8. Data Retention
We retain your personal data for as long as your account is active. If you delete your account, your data will be permanently deleted within 30 days, except where we are required to retain it for legal or safety purposes. Anonymised and aggregated data may be retained for statistical purposes.
9. Your Rights Under UK GDPR
You have the following rights:
Right to Access
Request a copy of your personal data
Right to Rectification
Correct inaccurate or incomplete data
Right to Erasure ("Right to be Forgotten")
Request deletion of your account and data
Right to Data Portability
Receive your data in a machine-readable format
Right to Object
Object to processing based on legitimate interests
Right to Restrict Processing
Request limitation of how we use your data
To exercise these rights, you can use the data export and account deletion features in your Settings, or contact us via our social media channels.
10. Data Security
We implement appropriate technical and organisational measures to protect your personal data, including encryption, access controls, and secure hosting. However, no system is completely secure, and we cannot guarantee absolute security.
11. Children's Privacy
Our service is intended for adults aged 18 and over. We do not knowingly collect data from children under 18. If we become aware that we have collected data from a child, we will delete it promptly.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice in the App. Continued use after changes constitutes acceptance.
13. Your Right to Complain
If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:
ICO Website: ico.org.uk
Helpline: 0303 123 1113
14. Contact Us
For questions about this Privacy Policy or to exercise your data rights, please contact us at:
Questions about your privacy?
backandforthmmh@gmail.com