Privacy Notice

Last updated: October 2026

Your privacy matters, especially in therapy. This notice explains what personal data I collect, why, and how I keep it safe. If you have any questions, email me at hello@finnmjclancy.com.

Who I am

I'm Finn Clancy, a private integrative therapist. I'm the data controller for the personal data described here.

Using this website

This website doesn't use tracking cookies or advertising. A few things work through third-party services:

Booking a consultation uses Google Calendar's booking tool, where you share your name, email and chosen time.
Sending a message through the form on this site uses Formspree, which passes your name, email and message on to me by email.
Applying for a low-cost place or joining a group uses Google Forms.
Emailing me means I receive your email address and whatever you choose to write.
Fonts are loaded from Google Fonts, which means your browser connects to Google's servers.

Google processes this data under its own privacy policy. I only use what you send me to respond to you and arrange sessions.

If you become a client

Before we begin, you'll receive a written agreement with a full privacy notice. In summary, I may hold:

Basic contact details (name, email, phone number) and GP details
Information you share as part of our work together
Anonymised notes about our sessions
Messages and emails between us
Session recordings, only if you explicitly agree, for note-taking purposes

I hold this data on the basis of legitimate interests, because it's needed to provide therapy. Health information is "special category data" under UK GDPR, which I hold with your explicit consent, given when you sign our agreement.

How I keep it safe

Records are stored in a Google Workspace business account protected by two-factor authentication and encryption.
Session notes use a reference code rather than your name, and the key linking the two is stored separately.
All devices are protected by passcodes and biometric security.

I don't share your data with anyone, except within the limits of confidentiality set out in our agreement, such as discussion with my clinical supervisor or where the law requires it.

How long I keep it

Client records are kept for 7 years after our work ends, as required by my professional insurance, and then securely deleted. Enquiries from people who don't go on to become clients are deleted once they're no longer needed.

Your rights

You have the right to access your data, correct it, restrict how it's used, or ask for it to be deleted (although I may need to keep client notes for the 7-year period above). I'll respond to any request within 30 days.

If you're unhappy with how your data has been handled, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.