Client privacy notice template

This notice explains how [Practice name] ("we", "us") uses your personal information when you contact us, book a session or receive therapy from us. [Practice name] is responsible for your information. You can contact us at [email address], [phone number] or [postal address].

We collect:

• your contact details, such as your name, email address and phone number, and your date of birth;
• details of your bookings and sessions;
• information about your health and wellbeing that you share with us, and the notes we make about your care;
• your answers to any forms we ask you to fill in;
• messages you send us;
• payment details, such as what you paid and when. Card details are handled by payment processors, not stored by us.

We use your information to:

• provide therapy and care to you;
• arrange and manage your sessions;
• take payment;
• keep clinical and financial records, as the law and our professional rules require;
• contact you about your sessions;
• protect you or others where there is a serious risk of harm, and meet our legal duties.

For clients in the United Kingdom: our legal basis is [the contract between us / our legitimate interests in providing care], and for information about your health, that it is needed to provide health or social care under a duty of confidentiality (UK GDPR Article 9(2)(h) and the Data Protection Act 2018). [Delete this paragraph if you do not work in the United Kingdom.]

We use TranqBay to run our practice website, bookings, video sessions, notes, messages and payments. TranqBay holds your information for us and uses it to provide its service to us, under a contract that protects it. It does not sell your information. If you create a TranqBay account, TranqBay adds you to its mailing list and may send you its own emails, including news and offers, which you can unsubscribe from at any time. TranqBay's list of the companies it uses is at TranqBay sub-processor list.

• Video sessions are end-to-end encrypted and are not recorded. As a safety measure, TranqBay may run an automated check on session audio for contact details being shared. If it finds any, it keeps the type of detail found and may keep a short masked excerpt, for 12 months.
• Our website, hosted by TranqBay, uses Google Analytics to count visits.
• Payments are processed by TranqBay's payment processors.
• Your information is stored in data centres in the European Union, and some service providers are in the United States.

We use an AI tool to help write our session notes. When it is on, what is said in a session is turned into text, and an AI model drafts a note that we read and correct before it goes in your record. The text of the session is deleted after 30 days, and removed from backups within a further 90 days. Your information is not used to train AI models. [We will ask for your agreement before we use it / You can ask us not to use it], and it does not change the care you receive.

We share your information only:

• with service providers who help us run our practice, such as TranqBay;
• with others involved in your care, with your agreement;
• where the law requires it, or to protect you or someone else from serious harm.

We keep your records for [number] years after our last session, as [law or professional body] requires, and then delete them securely.

You can ask to see the information we hold about you, to correct it, and in some cases to have it deleted or to limit how we use it. Contact us at [email address].

If you are unhappy with how we handle your information, please tell us first. You can also complain to [the Information Commissioner's Office (ico.org.uk) in the United Kingdom / the US Department of Health and Human Services Office for Civil Rights / the Office of the Privacy Commissioner of Canada / your local data protection authority].

We last updated this notice on [date].