This notice explains how Human Nurture Psychotherapy collects, uses, stores, and protects your personal information. Please read it carefully. If you have any questions, contact us using the details below.

1. Who We Are

Human Nurture  is a sole practice providing individual psychotherapy EMDR therapy and clinical supervision, based in Northamptonshire.

Data Controller

Name: Rachel Hewitt-Hall

Email: rachel@humannurture.co.uk

Phone: 07823 816367

As data controller, Rachel is responsible for deciding how and why your personal data is used, and for ensuring it is handled lawfully and securely.

2. What Personal Data We Collect

Depending on the nature of your contact with us, we may collect and hold the following:

• Your name, date of birth, address, phone number, and email address
• Emergency contact details
• Referral information and your reason for seeking therapy or supervision
• Medical and mental health history relevant to your care
• Session notes, assessments, and clinical records (including EMDR-specific records where applicable)
• Correspondence with you (including emails and letters)
• Appointment and attendance records
• Billing and payment records

Some of this information — including details about your physical or mental health — is classified as special category data under UK data protection law. It receives a higher level of protection and is only processed where we have a specific legal basis to do so.

3. How We Collect Your Data

We collect your personal data in the following ways:

• Directly from you — through enquiry forms, intake assessments, and during sessions
• From referrers — such as your GP or another healthcare professional, where you have given consent
• Through your use of our services — including appointment and session records

4. Our Legal Basis for Processing

We only process your personal data where we have a lawful basis to do so. The table below sets out the main purposes and the legal basis that applies.

Purpose                                                                                                                       Legal Basis

Providing psychotherapy, EMDR and clinical supervision services           Contract; Vital interests (special category:                                                                                                                                         health care provision)

Maintaining clinical records                                                                               Legal obligation; Legitimate interests

Communicating with you about your appointments                                    Contract; Legitimate interests

Processing payment                                                                                           Contract

Consulting with a clinical supervisor                                                                Legitimate interests (professional duty of                                                                                                                                         care); special category: health care provision

Sharing information with your GP or referrer in exceptional                        Vital interests; Legal obligation; Explicit             circumstances                                                                                                                                 consent (where applicable)        

Responding to complaints or legal claims                                                      Legal obligation; Legitimate interests

5. Who We Share Your Data With

We treat your information as strictly confidential. We will not share your personal data with any third party without your knowledge, except in the following circumstances:

• Clinical supervisor: We discuss clinical work with a qualified supervisor as part of our professional obligations. This is done on an anonymised or pseudonymised basis wherever possible. Our supervisor is bound by the same professional duties of confidentiality.
• Your GP or referrer: In exceptional circumstances — such as where we have significant concern for your safety or the safety of others — we may share relevant information with your GP or referring professional. Where possible, we will discuss this with you first.
• Legal or regulatory obligation: Where we are required by law to disclose information — for example, to prevent serious harm, or in response to a court order.
• Professional indemnity insurer: In the event of a complaint or claim, limited information may be shared with our insurer on a strictly confidential basis.

We do not sell, rent, or share your personal data for marketing purposes.

Zoom: We use Zoom for online therapy sessions. Zoom may process connection data (such as IP address and device information) as part of delivering the service. We use Zoom in compliance with its data processing terms. You can review Zoom's privacy policy at zoom.us/privacy. Sessions are not recorded without your explicit consent.

6. How Long We Keep Your Data

We retain personal data only for as long as necessary. Our standard retention periods are:

• Adult clinical records: Seven years from the date of last contact
• Records where the client was a minor: Until their 25th birthday, or seven years from last contact — whichever is longer
• Financial and billing records: Six years (in line with HMRC requirements)
• Enquiries that did not proceed to therapy: One month from last contact, then securely deleted

After the relevant retention period, records are securely destroyed. Paper records are shredded; digital records are permanently deleted.

7. How We Keep Your Data Secure

We take the security of your personal data seriously. Our measures include:

• Password-protected and encrypted devices
• Secure, locked storage for any paper records
• Using only secure, reputable platforms for digital communication and session delivery
• Limiting access to your data to those who need it for your care

In the unlikely event of a data breach that is likely to affect your rights and freedoms, we will notify you and the Information Commissioner's Office (ICO) as required by law.

8. Your Rights

Under UK data protection law, you have the following rights in relation to your personal data:

Right of Access (SAR): Request a copy of the personal data we hold about you. We will respond within one calendar month.

Right to Rectification: Ask us to correct inaccurate or incomplete data we hold about you.

Right to Erasure: Ask us to delete your data where there is no longer a lawful reason to hold it. Note that professional retention obligations may apply to clinical records.

Right to Restrict Processing: Ask us to limit how we use your data — for example, while a dispute is being resolved.

Right to Object: Object to processing carried out on the basis of legitimate interests.

Right to Data Portability: Request your data in a structured, commonly used format where processing is based on consent or contract.

To exercise any of these rights, please contact Rachel at rachel@humannurture.co.uk. We will acknowledge your request within 30 days and respond without undue delay. There is no charge for making a request.

Our full Subject Access Request Policy is available on request.

9. Complaints

If you are unhappy with how we have handled your personal data, you have the right to complain to the Information Commissioner's Office (ICO):

• Website:www.ico.org.uk
• Phone:0303 123 1113
• Post:Wycliffe House, Water Lane, Wilmslow, SK9 5AF

You may also raise a concern with us directly using our Complaints Procedure, which is available on this website and on request.

10. Changes to This Notice

We review this Privacy Notice annually and update it whenever there is a change in how we process data or in the law. The current version is always available on this page. Where changes are significant, we will take reasonable steps to inform you directly.

This notice was last reviewed June 2026. 

Registered with the Information Commissioner's Office (ICO) — Registration No: ZA780192.