Privacy notice

This page explains what personal information I collect, why, how I look after it, and your rights. I’ve tried to keep it clear and readable. If anything is unclear, please ask.

I’m Emma Harris, and I run Emma Harris Therapy. I’m responsible for your information, which makes me the “data controller”. I’m registered with the Information Commissioner’s Office (ICO), reference ZA830159.

I follow UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For any questions about your information, please email privacy@emmaharristherapy.com.

1. Who this covers

Website visitors, including anyone who contacts me or joins my mailing list. See section 3.
Clients, supervisees, mentees, and anyone else that I work with. See sections 4 to 8.

2. Your rights

You have the right to:

see the information I hold about you, free of charge
ask me to correct it if anything is wrong
ask me to delete it, or to limit how I use it
object to how I use it
have it moved to someone else, in a usable format
change your mind about anything you’ve agreed to, such as a session recording or receiving my newsletter

I’ll respond within one month. Sometimes the law means I can’t do what you’ve asked, for example deleting clinical records before the end of the time I’m required to keep them. If so, I’ll explain why.

I don’t use automated decision-making or profiling.

3. If you visit my website

Contacting me. If you get in touch through my website, by email or by phone, I use your details to reply to you. If we don’t go on to work together, I delete your enquiry within a year.

My mailing list. If you sign up, I hold your name and email address in MailerLite, my newsletter service, to send you occasional news. You can unsubscribe at any time using the link in every email.

Cookies and website statistics. My website uses cookies, which you can accept or decline when you visit. With your consent, Google Analytics helps me understand how the site is used, in a way that doesn’t identify you. My website host also keeps basic technical logs, such as your browser type and IP address, to keep the site running safely. You can read the details in my cookie policy.

Children. My website isn’t aimed at anyone under 18.

4. If we work together: what I collect

Contact details: your name, email, phone number, address and emergency contact.
Health information (clients): your history, risk assessment, relevant health information and notes about our work.
Supervision and mentoring notes (supervisees and mentees): notes about our sessions. When talking about clients, I ask supervisees not to include details which would enable me to identify them.
Payment records: fees and payments. I never see or hold your full card details. Card payments are processed securely by Stripe, through Zanda.
Messages: a record of our emails and text and WhatsApp messages.
Recordings and transcripts: only if you’ve given written consent. See section 7.

The legal basis

Data protection law asks me to explain why I use your information. In short:

Contact details, payment records and messages: so I can provide the work we’ve agreed, and run my practice.
Health information: with your consent, and to provide your care. In a rare emergency, to protect someone’s safety.
Recordings and transcripts: so I can develop my skills and practice. Only ever with your consent.
Occasionally, the law requires me to keep or share information.

You’re never obliged to share anything, although I do need a few basics, like your contact details, for us to work together.

5. Who sees your information

I don’t share your information, except in these situations:

Other professionals involved in your care, only with your explicit, written consent.
If there’s a serious risk of harm to you or someone else. I may contact the emergency services, your GP or your emergency contact. I wouldn’t do this lightly. Where possible I’d talk with my supervisor first, and with you, unless that would put you or others at risk.
My own clinical supervision. I take my work to supervision to keep it safe and ensure I am doing my best by you. I protect your identity and share only what’s needed.
Professional peer supervision groups. I don’t share identifying details.
My accountant may see financial records that include your name.
Health insurers. If an insurer funds your sessions, I may need to share your contact details, session dates, progress updates and fees with them.
If I’m suddenly unable to work. If illness, a personal emergency or my death means I can’t contact you, a trusted colleague named in my clinical will can access my client list to let you know, and offer support or referrals if needed.
Where the law requires it, such as a court order, or to prevent fraud or crime.

6. The tools I use

Your information is held by a small number of carefully chosen services. Each one handles it on my behalf, under data protection terms.

Zanda: my practice management system. Your records, notes, forms, bookings and invoices are held here.
Stripe: processes card payments, through Zanda.
Zoom: for online sessions. Sessions aren’t recorded, unless you’ve given written consent.
Google Workspace: my business email, calendar and documents.
Xero and Starling: my accounts and business bank.
MailerLite: my newsletter, only if you sign up.

AI. Most of these tools now have AI features. I explain how I do and don’t use AI, and where it meets your information, on my AI page.

Outside the UK. Some of the services I use are run by companies based outside the UK, so your information may sometimes be stored or processed there. Where this happens, your information must be protected to the same standard as in the UK. This is either because the UK has approved that country’s data protection laws, or because the company has signed legal agreements to protect it. I check each company’s data processing terms or privacy policy when I choose a service which touches personal information.

7. Recordings and transcripts

I may occasionally ask whether I can record a session, for my own supervision or consultation, or for assessment towards my professional accreditation. It’s always optional, and saying no won’t affect our work.

If you agree, I’ll ask for your written consent, either for a single session or for a set period. You can also choose whether Zoom makes an automatic transcript. That’s a separate, optional choice. Recordings and transcripts are stored securely in my password-protected Zoom account or business cloud storage, seen only by my supervisor, consultant or an accreditation assessor, and deleted once they’re no longer needed. You can withdraw your consent at any time.

8. How long I keep information

Clinical, supervision and mentoring records: seven years from our last session.
Contact, payment and message records: seven years from our last session, unless the law requires longer.
If a client is under 18 at the start of therapy: until their 25th birthday, or seven years from our last session, whichever is later.
Recordings and transcripts: until they’re no longer needed. I review any I hold every three months.
Enquiries that don’t lead to working together: within one year.
Mailing list: until you unsubscribe.

I review what I hold at least once a year, and delete anything I no longer need.

9. Keeping your information safe

Client records are kept in secure, password-protected systems, primarily Zanda.
Strong passwords and two-step verification on my accounts.
Encrypted devices with screen locks.
A private space for sessions.
I check the privacy and security settings of the tools I use at least once a year.

If something goes wrong. If there’s ever a data breach, I’ll follow UK data protection law. That includes reporting it to the ICO within 72 hours where required, and telling you promptly if it’s likely to put you at high risk.

10. Other websites

My website links to other websites. They have their own privacy policies, so please check those before sharing your information.

11. Concerns and complaints

If you’re unhappy with how I’ve handled your information, please email complaints@emmaharristherapy.com. I’ll look into it and reply as soon as I can. If you’re still not satisfied, you can complain to the Information Commissioner’s Office at ico.org.uk.