Privacy & Data Protection Statement

Our Commitment

The Digital CAT Psychotherapy File is designed to protect your personal reflections. This statement explains how your data is stored, encrypted, and kept private, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

How Your Data Is Stored

Your responses are encrypted on your device before they are saved. They are then stored on a secure cloud server. Because the encryption happens before the data leaves your device, the stored content cannot be read by anyone — including the app developers and administrators — without your password.

  • Client-side encryption: Your responses are encrypted using AES-GCM, a recognised industry-standard encryption method, before being uploaded.
  • Password-protected access: Your encryption key is derived from the password you choose when starting the form. Only someone with that password can decrypt and read your responses.
  • Hashed password: Your password is stored only as a one-way hash (SHA-256). This means the password itself cannot be reverse-engineered from what is stored.

What Data We Store

To allow you to save and return to your form, we store the minimum information needed:

  • Your initials and the date you started the form — used to identify your saved file when you return.
  • A hashed version of your password — used to verify your identity on return.
  • Your encrypted responses — the content of your reflections, which cannot be read without your password.
  • Your progress position — so you can resume where you left off.

What We Do Not Collect

We do not collect your full name, email address, phone number, or any other personally identifying contact details at any stage of you using the app. No account or email registration is required to use this app.

Data Sharing

Your data is never shared with any third party. It is not used for advertising, analytics, or research. The only way your responses leave the app is if you choose to export them as a PDF.

Your Rights Under UK GDPR

As a data subject, you have the following rights regarding your stored information:

  • Access & Portability: You can return to your saved form at any time using your initials, start date, and password, and export your responses as a PDF.
  • Erasure (Right to be Forgotten): You can permanently delete your saved form at any time by using the "Start a New Form" / restart option, which removes your data from the server.

Keeping Your Password Safe

Your password is the only key to your encrypted responses, and it is not stored in any form we can recover. Please keep it somewhere safe: if you forget it, nobody — including us — can read or reopen your saved responses.

You will need all three of these to return to your form: your password, your identifying initials (maximum 3 characters), and the start date you entered when completing the form. If you cannot recall any of them, your saved form cannot be reopened and you will need to start the form again from the beginning.

Contact

If you have any questions about how your data is handled, or wish to exercise your data protection rights, please contact us:

privacy@learnwithcato.co.uk

This statement was last updated on 13 September 2026.