Therapy Privacy Notice
Samantha Coleman · Effective 26 September 2026
This notice explains how I use information when you enquire about, register for, book or receive therapy. The website Privacy Notice and Cookie Policy explain website analytics and cookies. The Recognition Loops® app has separate privacy information.
I am Samantha Coleman, trading as Samantha Coleman and Recognition Loops®. I am responsible for your therapy information. Contact me about privacy at samanthacoleman@recognitionloops.com.
What I collect and why
I use the contact details, appointment information and registration answers you give me to respond to your enquiry, assess whether I can offer the service and arrange appointments. During therapy, I keep relevant clinical notes and correspondence. If you agree to a report or Zoom transcription, I also use the information needed to prepare it. Payment providers give me transaction details and payment status; I do not receive full card details.
I need enough information to assess suitability, contact you and provide therapy. You can choose whether to receive reports or permit transcription. I do not use your therapy history to send marketing or add you to the app prelaunch list or Substack without a separate request from you.
I use the following UK GDPR grounds according to the purpose:
| Purpose | Article 6 lawful basis | Additional condition where sensitive health information is involved |
|---|---|---|
| Respond to enquiries, assess suitability and deliver booked therapy | Taking steps towards or performing a contract, Article 6(1)(b) | Provision of health care or treatment, Article 9(2)(h) and Data Protection Act 2018 Schedule 1 condition 2, where necessary and subject to professional confidentiality |
| Keep adequate records, maintain safe practice and confidential supervision | Performance of the therapy contract; legitimate interests in safe professional practice, Article 6(1)(f); a legal obligation where one applies, Article 6(1)(c) | Article 9(2)(h) where necessary for care; Article 9(2)(f) where necessary for a legal claim |
| Manage bookings, billing, refunds and tax records | Contract, Article 6(1)(b), and legal obligation, Article 6(1)(c), where applicable | Article 9(2)(h) if a necessary booking record reveals health information |
| Use optional Zoom transcription | Your separate consent, Article 6(1)(a) | Your explicit consent, Article 9(2)(a) |
| Send optional app or article updates | Your separate marketing consent, Article 6(1)(a), where required | Therapy health information is not used to target these updates |
Reports prepared from the professional notes I keep for therapy form part of the agreed service. Your separate report choice tells me whether you want one sent to you. Any future use of ChatGPT to assist report preparation requires its own information and explicit permission before a meeting summary is sent to it. Agreement to therapy, transcription or a report does not authorise that use.
Who handles your information
- Typeform holds new-client registration answers, including any sensitive information you choose to provide. The app prelaunch form is separate.
- Amelia on WordPress, at samanthacoleman.online, manages bookings and appointment communications.
- Stripe processes online card payments offered through booking. I receive payment status and details needed for accounts and refunds.
- Zoom provides online appointments and, with separate permission, creates written transcripts or meeting summaries. It may process session media to produce the text; I do not keep a separate audio or video recording in my clinical records.
- Google Workspace provides my professional Gmail and restricted-access Google Drive for correspondence, clinical notes, agreed transcripts and reports. My account uses two-factor authentication. Ordinary email is not guaranteed end-to-end encrypted; we can agree a more protected way to send reports.
- Professional clinical supervisors may hear relevant information under a duty of confidentiality. I may disclose necessary information to appropriate services or authorities for safeguarding, serious safety concerns or a legal requirement. These are foreseeable limits to confidentiality, and I will explain them before we begin. Where appropriate and safe, I will discuss a disclosure with you first.
These providers may process information outside the UK. You can contact me for information about the relevant transfer arrangements. Each provider also publishes its own privacy information. I restrict access to my professional records and take reasonable steps to keep them secure.
How long I keep information
I keep an adequate clinical record of each session, including the consultation, work undertaken, outcome and relevant follow-up. Relevant communications, registration answers, decisions and their reasons are included in or securely connected with that record. I keep clinical notes and any completed report forming part of the record for at least seven years after the last therapy session. A complaint, claim or another legal requirement may require longer retention.
If you agree to Zoom transcription, I keep Zoom-held written transcripts and meeting summaries for about two weeks. Working copies in restricted Google Drive are generally kept for up to six months. I may retain them longer if needed to keep an adequate clinical record or meet an insurance, complaint or legal requirement. The lasting clinical record is kept for the period above.
Typeform holds your submitted registration answers. I review them and remove copies when they are no longer needed for intake, therapy or a valid record-keeping purpose. Booking, email and payment information is kept for the period needed to administer the service, deal with a complaint and meet accounting duties. I periodically review those records and delete them when those purposes end. Provider backups may take longer to clear under their own schedules.
Your choices and rights
You can ask to see the personal information I hold about you, correct inaccurate information or request erasure or restriction where the law allows. You may have rights to object to certain processing or receive a portable copy of some information. You can withdraw a separate consent for future transcription or marketing at any time by emailing me. Withdrawal does not undo processing already carried out. A valid clinical or legal reason may require me to retain a record after a deletion request. I do not use automated decisions to decide whether to offer you therapy.
Email samanthacoleman@recognitionloops.com about your information or a privacy concern. You also have the right to complain to the Information Commissioner's Office.
This notice and the adult registration form cover therapy for people aged 18 or over. Enquiries about younger clients are handled through a separate process.