Your Privacy Matters
LIFT Music App – Privacy Policy
Effective Date: 14 August 2026
Developer: Headsoup Ltd
Contact: info@headsoup.info
The LIFT Music app is designed to respect your privacy. This policy explains how we handle data when you use the app.
What We Collect
We collect only the information needed to let you use the app and view reports.
For account holders (facilitators, staff, teachers, etc.):
- Username and password (authentication is handled securely through Google Firebase Authentication; passwords are stored as secure hashed credentials and are not accessible to Headsoup personnel)
- Optional contact email (if provided for support or password reset)
For participants using the app to make music:
- A name, number, or code that you enter to identify a participant
- Activity data (e.g. number of sessions, music interactions)
You control what information is entered for participants. We encourage organisations to use a nickname, pseudonym, number or other identifier that does not directly identify the individual wherever practicable. A customer organisation may be able to associate that identifier with a particular individual using information it holds separately. Participant identifiers and associated usage data may therefore constitute personal data even where Headsoup cannot independently identify the individual.
How We Use the Data
- To let registered users log in and access reporting tools
- To show usage reports over time
To improve app performance and understand engagement
Headsoup does not require organisations to enter real participant names or other directly identifying information. Where Headsoup uses usage information for operating, maintaining, improving or supporting the service, access is limited to authorised personnel and the information is handled in accordance with applicable data protection requirements.
No Tracking or Ads
- No ads
- No tracking for marketing
- No selling or sharing of data
- No location tracking
Data Security
Customer data is stored using Google Firebase services hosted in Belgium within the European Economic Area (EEA). Data is encrypted in transit and at rest, and access is restricted to authorised systems and personnel.
Account information, participant identifiers and identifiable or pseudonymised usage/reporting data are retained while an organisation’s account remains active. Following cancellation, these data are normally retained for 30 days and then permanently deleted or irreversibly anonymised, subject to applicable legal or contractual requirements and, where Headsoup acts as a Data Processor, the instructions of the relevant Data Controller.
Headsoup may retain information that has been irreversibly anonymised so that it no longer identifies an individual or customer organisation. We may use and retain anonymised data for product development, service improvement, research and statistical analysis, including the development of other Headsoup products and technologies.
Health and Care Organisations
Where LIFT Music is provided to an organisation such as an NHS organisation, care provider or other service, that organisation may determine how and why participant information is used and may therefore act as the Data Controller. Headsoup may process that information on the organisation’s behalf as a Data Processor.
LIFT Music does not require organisations to enter medical diagnoses, NHS numbers, care plans, clinical notes or other clinical records. However, information associated with an individual in a health or care setting may in some circumstances constitute data concerning health. Where this applies, the customer organisation is responsible for establishing the appropriate lawful basis and special-category data condition for its processing, and Headsoup processes the information in accordance with the organisation’s documented instructions and applicable data-processing arrangements.
Our Lawful Basis
Where Headsoup acts as Data Controller, we process account information where necessary to provide the LIFT Music service and may process limited usage information where necessary for our legitimate interests in operating, maintaining, improving and supporting the service.
Where Headsoup acts as Data Processor for a customer organisation, that organisation is responsible for determining the appropriate lawful basis for its processing.
Your Rights
Depending on the circumstances, you may have rights under UK data protection law including:
• access to your personal data
• correction of inaccurate personal data
• deletion of your personal data
• restriction of processing
• objection to processing
• data portability
Where a customer organisation is the Data Controller, requests concerning participant data should normally be made to that organisation. Headsoup will assist the organisation where required in responding to data protection requests.
You can contact Headsoup with questions or concerns at info@headsoup.info. You also have the right to complain to the Information Commissioner’s Office (ICO) if you are unhappy with how your personal data have been handled.
Email: info@headsoup.info
Contact Us
Headsoup Ltd
Email: info@headsoup.info
Website: https://www.liftmusic.org
We may update this policy as the app develops. Any changes will be made clear in app updates or on our website.