1. About this Privacy Policy
This Privacy Policy explains how Saltroad Ltd ("Saltroad", "we", "us", "our") collects, uses, shares and protects personal data when you visit www.saltroad.com (the "Site"), use our digital marketplace platform (the "Platform"), or otherwise interact with us. It also explains the rights you have in relation to your personal data under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and (where applicable) the Irish Data Protection Acts 1988 – 2018 and the EU GDPR.
We process some categories of personal data - including session recordings and clinical documentation produced through the Saltroad Assistant - that are special-category data under UK GDPR.
Section 5 of this policy explains how that data is processed and the choices you have.
This Privacy Policy should be read together with our Client Terms of Use, our Therapist Terms of Use, our Services Policy and our Cookie Policy.
2. Who we are and how to contact us
The data controller of your personal data is:
Saltroad Ltd
4D Irwinstown Lane, Ballinderry Upper, Lisburn, BT28 2HD, Northern Ireland
Company number: NI709928
Registered with the Information Commissioner's Office as a fee-paying data controller.
For any questions about this Privacy Policy or to exercise your rights, contact us at privacy@saltroad.com or by post at the address above.
For general support enquiries, contact therapy@saltroad.com.
You also have the right to lodge a complaint with a supervisory authority.
In the UK that is the Information Commissioner's Office (ICO); in Ireland, the Data Protection Commission (DPC). We would, however, appreciate the chance to address your concerns first.
3. The personal data we collect
We collect and process the following categories of personal data:
Account Data — name, email address, phone number, account credentials, billing/contact address, and basic information about the child or ward receiving the S< Services. Collected from you when you register, complete forms or contact us.
Booking Data — information about your bookings, payments, cancellations, communications with your Professional, and any pre-Booking questionnaires. Collected from you and from your Professional through the Platform.
Session Recordings — audio (and where applicable, video) recordings of Bookings captured through the Saltroad Assistant. These will normally include personal data concerning your child's health (special-category personal data). Recorded during a Booking when your Professional uses the Saltroad Assistant.
Clinical Outputs — transcripts, SOAP notes, reports and similar clinical documentation generated, in whole or in part, from a Session Recording. These also constitute special-category personal data. Generated by the Saltroad Assistant from the Session Recording, then reviewed and finalised by your Professional.
Technical Data — IP address, device type, browser, operating system, referring URL, log data, and analytics events. Collected automatically when you use the Site or Platform.
Marketing Data — your preferences in receiving marketing from us, and any feedback or testimonials you provide. Collected from you, where you opt in or choose to provide it.You are not legally required to provide personal data to us. However, we may not be able to provide the Platform or the S< Services if you do not provide the information necessary to deliver them.
4. How we use your data and our lawful bases
We process your personal data only where we have a lawful basis to do so. The table below sets out, for each purpose, the lawful basis we rely on under UK GDPR Article 6, and (for special-category data) UK GDPR Article 9.
Operating your account, Bookings, payments and refunds. Categories used: Account Data and Booking Data. Lawful basis: Article 6(1)(b) (performance of contract).
Providing the Saltroad Assistant — recording Bookings, producing transcripts, SOAP notes and reports for your Professional, and supporting clinical record-keeping. Categories used: Session Recordings and Clinical Outputs. Lawful basis: Article 6(1)(b) (performance of contract) and Article 9(2)(h) (provision of health or social-care services by a regulated professional under a duty of confidentiality).
Communicating with you about Bookings, service updates, security and important changes. Categories used: Account Data and Booking Data. Lawful basis: Article 6(1)(b) (performance of contract).
Keeping the Platform secure, preventing fraud, debugging and improving stability. Categories used: Account Data, Booking Data and Technical Data. Lawful basis: Article 6(1)(f) (legitimate interests in operating a secure Platform).
Complying with legal, regulatory, accounting and tax obligations. Categories used: all categories as required. Lawful basis: Article 6(1)(c) (legal obligation); for special-category data, Article 9(2)(g) (substantial public interest) where applicable.
Defending or pursuing legal claims. Categories used: all categories as required. Lawful basis: Article 6(1)(f) (legitimate interests); Article 9(2)(f) (legal claims) where applicable.
Sending marketing communications about Saltroad services. Categories used: Account Data and Marketing Data. Lawful basis: Article 6(1)(a) (consent), which you can withdraw at any time.
AI Training — using Session Recordings and/or Clinical Outputs (in identifiable or de-identified form) to develop, fine-tune, evaluate or improve the machine-learning models used in the Saltroad Assistant. Categories used: Session Recordings and Clinical Outputs. Lawful basis: Article 6(1)(a) (consent) and Article 9(2)(a) (explicit consent). This is opt-in only and is not required to use the Platform or receive the S< Services.Where we rely on legitimate interests, we have carried out a balancing assessment and concluded that our interests do not override your rights and freedoms. You can ask us for more information about that assessment at privacy@saltroad.com.
5. Session recording, the Saltroad Assistant, and AI Training
This section sets out how we process Session Recordings and Clinical Outputs, and your choices in relation to AI Training. It mirrors clause 16 of our Client Terms of Use.
5.1 Recording and clinical documentation as part of the service. Your Professional may use the Saltroad Assistant to record a Booking and to produce a transcript, SOAP notes and a report. This is part of how the S< Services are delivered. Our and the Professional's lawful bases for this processing are Article 6(1)(b) (performance of contract) and Article 9(2)(h) (provision of health or social-care services). This processing is not based on your consent and may not be withdrawn while you continue to receive the S< Services from the Professional. If you do not wish a Booking to be recorded, please tell your Professional; they may either deliver the Booking without recording or, if recording is required to deliver the agreed S< Services, decline to proceed.
5.2 Confirmation before recording. Before recording begins, your Professional will confirm with you (or with the parent/guardian of the child receiving the S< Services) that you understand the Booking will be recorded for the purposes set out above.
5.3 AI Training (optional opt-in). Separately from the processing in 5.1, you may choose to allow your child's Session Recordings and Clinical Outputs to be used to train and improve the Saltroad AI models that power the Saltroad Assistant — for example, improving transcription accuracy on paediatric speech and improving the quality of clinical-note generation. This is voluntary and is not a condition of receiving the S< Services. We rely on your explicit consent (Article 6(1)(a) and Article 9(2)(a)) for this processing. Consent may be given by you directly through the Platform, or by confirming your consent to your Professional during a Booking (who will record your decision in the Platform on our behalf). Withdrawal is via your Platform account or by contacting privacy@saltroad.com.
5.4 What AI Training does and doesn't include. If you opt in, Session Recordings and Clinical Outputs may be used to fine-tune, evaluate or improve the speech-recognition, transcription and clinical-note generation models used in the Saltroad Assistant. We apply technical and organisational measures designed to limit identifiability and to keep training data within the controlled environment of Saltroad and its appointed sub-processors.
5.5 Withdrawing consent to AI Training. You can withdraw at any time by emailing therapy@saltroad.com. Withdrawal stops further use of your data for AI Training. It cannot undo training already performed using data lawfully processed before the withdrawal.
5.6 Clinical responsibility. Clinical Outputs produced by the Saltroad Assistant are AI-assisted drafts intended to support - not replace - your Professional's clinical judgement. Your Professional reviews, corrects and finalises Clinical Outputs before relying on them for clinical purposes.
6. Children's data
Our service is delivered to children with the consent and supervision of their parent or legal guardian. The parent or guardian who places a Booking is the person who interacts with the Platform, gives the contractual confirmations described in our Client Terms of Use, and exercises rights in relation to the child's personal data on the child's behalf.
We treat children's session data with additional care, in line with the ICO's Age-Appropriate Design Code (Children's Code). This includes, where appropriate to the child's age and understanding, taking the child's own views into account, applying data-minimisation defaults, and ensuring transparency materials are explained in age-appropriate language.
If you believe that we hold personal data of a child without appropriate parental authority, please contact us immediately at privacy@saltroad.com and we will take prompt action.
7. Cookies
The Site uses cookies and similar technologies for analytics, performance, and to remember your preferences. You can manage your cookie preferences through the cookie banner on the Site. For details of which cookies we use and what each cookie does, please see our Cookie Policy.
8. How long we keep your data
We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by Applicable Laws and clinical record-keeping standards. The default retention periods are:
Account Data — for as long as your account is active, plus 24 months after closure (or longer where required by law, e.g. for accounting/tax records — typically 6 years).
Booking Data and payment records — 6 years from the date of the Booking, to meet HMRC and Irish Revenue Commissioners record-keeping requirements.
Session Recordings — up to 12 months following the Booking, after which the recording is deleted unless required for an active complaint, dispute or regulatory matter, or unless you have separately consented to longer retention for AI Training.
Clinical Outputs (transcripts, notes, reports) — retained as part of the clinical record for the period required by your Professional's regulator (typically a minimum of 8 years for adults, or until the child's 25th birthday for paediatric records).
Data used for AI Training (where you have opted in) — retained for the period needed to develop, evaluate and validate the relevant model versions, and then deleted or rendered fully anonymous in accordance with our retention schedule.
Marketing Data — until you withdraw consent or unsubscribe.
Cookies and analytics — as described in our Cookie Policy.
When data is no longer needed, we delete or anonymise it.
9. Sharing your data and sub-processors
We do not sell your personal data. We share it only as set out below, and only where the recipient is bound by appropriate written terms (including, where applicable, Article 28 processor terms or international transfer safeguards):
Your Professional: the Professional who delivers your S< Services receives Account Data, Booking Data, Session Recordings and Clinical Outputs as part of providing the S< Services. The Professional is a separate or joint data controller of clinical content as set out in our Therapist Terms of Use.
Sub-processors we appoint to operate the Platform - including cloud hosting, transcription and AI service providers, payment service providers, email and communications providers, and analytics providers.
Professional advisers (lawyers, accountants, auditors and insurers) where reasonably necessary, and bound by confidentiality.
Authorities where required by law (for example, in response to a court order, regulatory request, or where necessary to investigate or prevent a crime).
Successors and acquirers if Saltroad or any of its assets is reorganised, merged, sold or transferred (in which case we will require the recipient to honour this Privacy Policy or to provide an equivalent level of protection).
10. International transfers
Where your personal data is transferred outside the UK or the European Economic Area, we use safeguards recognised under UK GDPR — for example, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or transfers to countries covered by an adequacy decision. We do not transfer Session Recordings or Clinical Outputs outside the UK or EEA without an appropriate safeguard in place. Details of the regions in which your data is stored are listed on our sub-processors page.
11. Security
We use a combination of technical and organisational measures designed to protect your personal data, including encryption in transit and at rest, role-based access controls, vendor security reviews, logging, and staff training. No system can be guaranteed to be completely secure; if we become aware of a personal data breach that meets the relevant regulatory threshold, we will notify the ICO (and where required, you) in accordance with UK GDPR.
You also have a role to play in keeping your data safe — please choose a strong password, do not share it, and tell us at therapy@saltroad.com immediately if you suspect unauthorised access to your account.
12. Your rights
You have the following rights in relation to your personal data, subject to the exceptions and conditions set out in UK GDPR and the Data Protection Act 2018:
Access — to be told what personal data we hold about you and to receive a copy.
Rectification — to have inaccurate data corrected.
Erasure — to ask us to delete your data in certain circumstances. Please note that we may need to retain clinical records and certain other data for the periods set out in section 8.
Restriction — to ask us to restrict processing of your data in certain circumstances.
Objection — to object to processing based on legitimate interests, or to direct marketing.
Portability — to receive certain data in a portable format and have it sent to another controller, where technically feasible.
Withdraw consent — where we rely on consent (including for AI Training and marketing), you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Complain — to lodge a complaint with the ICO (UK) or DPC (Ireland), as set out in section 2.To exercise any of these rights, email privacy@saltroad.com. We may need to verify your identity before responding. We will respond within one month, with the option to extend by a further two months for complex requests (in which case we will tell you within the first month).
13. Automated decision-making
We do not use Session Recordings or Clinical Outputs to make solely automated decisions about you that produce legal or similarly significant effects. The Clinical Outputs produced by the Saltroad Assistant are drafts that your Professional reviews and finalises before they are relied upon clinically.
14. Links to other websites
The Site and Platform may contain links to third-party websites. We are not responsible for the privacy practices of those websites. Please read the privacy policies of any third-party websites you visit.
15. Changes to this Privacy Policy
This Privacy Policy was last updated on 1st May 2026. We may update it from time to time. If we make material changes — for example, changes affecting recording, AI Training or sub-processors — we will notify you in advance through the Platform or by email.
The current version is always available at www.saltroad.com/privacy-policy.
