Privacy Policy
Sarah Harris-Smith (Sole Trader)
Last updated: 20/04/2026
1. Who I Am (Data Controller)
I am Sarah Harris-Smith, a sole trader
For the purposes of data protection law, I am the data controller of your personal data.
2. How to Contact Me
If you have any questions about this policy or your data, you can contact me:
Email: [email protected]
Phone: 07769692742
3. What Personal Data I Collect
I may collect and process the following information:
Identity data (name)
Contact data (email address, phone number)
Health and wellbeing information (shared during sessions)
Session notes and therapeutic records
Appointment and booking information
Payment information (processed securely via third-party providers where applicable)
4. Special Category Data
As part of providing therapy, I may collect special category data (e.g. information about your mental or physical health).
This data is processed under:
Article 6(1)(b) – Contract (to provide therapy services)
Article 9(2)(a) – Your explicit consent
You have the right to withdraw your consent at any time.
5. Lawful Bases for Processing
Under UK GDPR, I rely on the following lawful bases:
Contract – to provide therapy services
Consent – when you contact me or agree to treatment
Legitimate Interests – to manage and run my business effectively
Legal Obligation – where I am required to comply with the law (e.g. safeguarding)
6. How I Use Your Data
I use your data to:
Provide therapy and support
Communicate with you about appointments
Maintain accurate client records
Process payments
Comply with professional, legal, and insurance requirements
7. How Your Data Is Stored and Protected
I take appropriate technical and organisational measures to protect your data, including:
Password-protected digital systems
Secure storage of notes and records
Limited access to personal data
8. Data Retention
In line with professional guidelines, I retain client records for:
7 years after your last session
Children: until age 25 (or 7 years after last session, whichever is longer)
After this period, data is securely deleted or destroyed.
9. Sharing Your Data
Your data will be kept confidential and will not be shared with third parties unless:
You have given explicit consent
There is a legal or safeguarding obligation
It is required for professional supervision (data will be anonymised wherever possible)
If I use third-party services (e.g. booking systems or payment providers), they will be GDPR-compliant.
10. International Transfers
I do not intentionally transfer your data outside of the UK.
If any third-party providers process data outside the UK, I will ensure appropriate safeguards are in place (e.g. adequacy regulations or standard contractual clauses).
11. Your Data Protection Rights
Under UK GDPR, you have the right to:
Access your personal data
Rectify inaccurate data
Erase your data (“right to be forgotten”)
Restrict processing
Object to processing
Data portability
Withdraw consent at any time
To exercise any of these rights, please contact me.
12. Cookies and Website Use
If you visit my website, basic data such as cookies or analytics may be collected to improve your experience.
You can manage cookies through your browser settings.
13. Complaints
If you are concerned about how your data is handled, you have the right to complain to:
Information Commissioner’s Office (ICO)
Website: https://www.ico.org.uk
14. Changes to This Policy
I may update this privacy policy from time to time. The latest version will always be available on my website. 15. Working with Children and Young People
I provide therapy services to children and young people. In these cases, I collect and process personal data in line with UK GDPR and with appropriate consent.
For clients under the age of 16:
Consent will be obtained from a parent or legal guardian before therapy begins
Parents/guardians will be informed about the nature of the therapy and how data is used
Where appropriate, the young person will also be involved in understanding and agreeing to the process in an age-appropriate way
Confidentiality and Young People
I respect the confidentiality of young clients as an important part of building trust.
Session content is generally kept confidential between myself and the young person
However, I may share relevant information with parents/guardians where appropriate and in the best interests of the child
Confidentiality may be broken if there are safeguarding concerns or a risk of harm to the young person or others
Data Rights for Children
Where appropriate:
Both the parent/guardian and the young person may have rights to access personal data
I will always act in the best interests of the child when responding to any data requests
Parental Responsibility
It is the responsibility of the parent or legal guardian to ensure that:
They have the legal authority to give consent
The information they provide is accurate
They inform me of any relevant changes