Last updated: 17 August 2026
01 · The controller
Who is responsible for your information?
Amber Sexton, trading as Hand in Hand Therapy, is the data controller for the personal information described in this policy.
1 Church Street, Epsom, KT17 4PF amber@handinhandtherapy.co.uk 07731 422400This policy covers use of the public website, initial enquiries and the online booking journey. Clients also receive more detailed GDPR information about clinical records, confidentiality and therapy before treatment begins.
02 · What is collected
Information collected
Information you provide
- Your name, email address and telephone number.
- Your preferred type of session and the contents of your enquiry.
- Information entered in the Zanda client portal when you book or manage an appointment.
- Information you send by email, telephone or another communication channel.
Please avoid putting detailed or highly sensitive clinical information in the website enquiry form. If your message includes information about your physical or mental health, it is treated as special category data and protected accordingly.
Information collected automatically
- Basic request and security information such as IP address, browser type, device information, timestamps and requested pages.
- A short-lived Cloudflare Turnstile verification token when you use the enquiry form, to help distinguish genuine submissions from automated abuse.
- Your cookie choices, stored in your browser.
- If you consent, website usage, advertising-attribution and session-interaction information described in the cookie section below.
Some information may also be received from a parent or guardian, someone acting with your authority, Zanda when you use the booking portal, or a technology provider used to operate the website.
03 · Purpose and lawful basis
How and why information is used
Enquiries and bookings
To reply to you, discuss your needs, arrange an appointment and take steps you request before entering a therapy agreement.
Lawful basis: steps at your request before a contract and performance of a contract.
Running a safe and responsive practice
To deliver the website, prevent spam or misuse, maintain security, manage communications and keep proportionate business records.
Lawful basis: legitimate interests in operating and protecting a small therapy practice and responding to genuine enquiries. These interests are balanced against your privacy rights.
Legal and professional responsibilities
To meet tax, accounting, insurance, safeguarding, regulatory or other legal and professional obligations.
Lawful basis: legal obligation, legitimate interests and, in a genuine emergency, vital interests as applicable.
Optional website tools
To understand website use, diagnose technical problems and measure whether advertising leads to completed bookings.
Lawful basis: your consent. Refusing or withdrawing consent does not affect access to the website or therapy services.
You are not required by law to provide information through the enquiry form. However, without enough contact information and a short message, Amber may be unable to reply or arrange the service you request. Hand in Hand Therapy does not use website information to make decisions about you solely by automated means that have legal or similarly significant effects.
04 · Sensitive information
Health information and confidentiality
Information about mental or physical health is special category data under UK data protection law. Where it is necessary to assess or provide counselling and psychotherapy, it is processed under the health or social care condition in Article 9(2)(h) of the UK GDPR and Schedule 1, Part 1, condition 2 of the Data Protection Act 2018. Amber is a BACP registered member and handles this information under a professional duty of confidentiality.
Information is not normally disclosed outside the therapeutic relationship without your knowledge. Limited disclosure may be necessary where required by law, to protect someone’s vital interests, to address a serious safeguarding concern or for legal claims. Wherever it is safe and appropriate, Amber will discuss this with you first.
For children and teenagers, information may also be obtained from or shared with a parent or guardian for practical arrangements, consent or safeguarding. The detailed client privacy information explains how clinical confidentiality applies to therapy with someone under 18.
06 · Processing locations
International transfers
Some of the companies that provide our website, email, booking and other technology services may store or access personal information outside the UK. This does not mean that your information is sold or made public. It means that your information may cross UK borders when the technology providers listed above deliver their services. Where required, appropriate legal protections are put in place.
If UK law treats this as a restricted international transfer, we make sure an approved legal protection is in place. Depending on the country and provider, this may include:
- UK adequacy regulations: the UK has recognised that the country, territory or approved scheme provides an acceptable level of data protection.
- An approved data-protection agreement: a contract requires the provider to protect the information. This may be the UK International Data Transfer Agreement or the UK Addendum to standard contractual clauses.
- Another legal safeguard: another form of protection permitted by UK data-protection law.
You can contact Amber to ask which provider handles your information, where it is processed and which protection applies.
07 · Retention
How long information is kept
- Initial enquiries: kept while the enquiry is handled and for a proportionate follow-up period. Information needed for a complaint, dispute, safeguarding matter or legal obligation may be kept longer.
- Client and booking information: if you become a client, relevant information forms part of the client record and is kept according to the clinical retention schedule explained in the GDPR information provided before therapy.
- Security and technical records: kept only for as long as needed to operate, protect and troubleshoot the service, taking account of supplier settings and legal requirements.
- Optional tracking: retained according to the configured supplier period and the browser-storage durations below. Data is deleted or aggregated when it is no longer needed.
Retention is reviewed periodically. The factors used include why the information was collected, professional and legal requirements, the sensitivity of the information, risk and whether the purpose can be met with less or anonymised data.
09 · Your choices
Your data protection rights
Depending on the circumstances and lawful basis, you may have the right to:
- ask for a copy of your personal information;
- correct incomplete or inaccurate information;
- ask for information to be erased or its use restricted;
- receive information you provided in a portable format;
- withdraw consent at any time; and
- object to processing based on legitimate interests.
These rights are not absolute and an applicable legal or professional requirement may limit a request. To exercise a right, email amber@handinhandtherapy.co.uk. Amber may need to confirm your identity before releasing or changing information.
10 · Contact
Questions and complaints
Please contact Amber first if you have a question or concern. Hand in Hand Therapy will take your concern seriously and respond without undue delay.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection.
This policy may be updated when services, legal requirements or data practices change. Important changes will be highlighted where appropriate, and the date at the top will be updated.