Privacy Policy
Sophie Wallace-Hadrill
www.sophiepsychology.com | contact@sophiepsychology.com
Last updated: 19 October 2026
1. About this policy
This Privacy Policy explains how Sophie Wallace-Hadrill (“I”, “me” or “my”) collects, uses, stores and shares personal information when you visit www.sophiepsychology.com, contact me, or receive coaching or therapy services from me.
I handle personal information in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended from time to time.
I am the data controller for the personal information described in this policy. If you have questions or want to exercise your data protection rights, contact me at contact@sophiepsychology.com
This policy is information about how I process data; it does not mean that you consent to every use described. Where consent is the appropriate legal basis, I will ask for it separately.
2. What information I collect
Depending on how you interact with me and my website, I may collect the following categories of information:
· Contact and identity details, such as your name, email address, telephone number and, where needed, postal address.
· Service and administrative records, including enquiries, appointment details, the client contract, invoices, relevant correspondence and records needed to administer our work together.
· Session notes and information you share during coaching or therapy. This may include information about your physical or mental health and other sensitive matters.
· Website and device information, such as IP address, browser and device type, pages visited, visit dates and times, and other diagnostic or usage information, where this is collected by the website or its tools.
You can choose not to provide information, but if you do not provide information needed to respond to an enquiry, arrange sessions, provide services or meet legal obligations, I may not be able to provide the relevant service.
3. Why I use your information and my lawful bases
I use personal information only where I have a lawful basis under the UK General Data Protection Regulation (UK GDPR).
Providing services and managing our relationship. I use contact details, appointment information, relevant correspondence and necessary administrative information to respond to enquiries, arrange appointments, provide agreed services and manage our working relationship. I rely on Article 6(1)(b) UK GDPR where processing is necessary to take steps at your request before entering into a contract or to perform a contract. For other purposes, I use a different lawful basis where appropriate and document the basis for the relevant activity.
Keeping client records and meeting professional responsibilities. I retain appropriate client, session and administrative records where necessary to document the services provided, manage professional responsibilities, deal with complaints and establish, exercise or defend legal claims. Depending on the specific purpose, I may rely on Article 6(1)(f) UK GDPR (legitimate interests), where the processing is necessary and my interests are not overridden by your rights, or Article 6(1)(c) where a specific legal obligation requires the processing or retention. I do not treat professional guidance alone as a legal obligation.
Financial and legal records. I use and retain invoices, payment records and accounting information to administer my practice and meet applicable legal and accounting requirements. I rely on Article 6(1)(c) where a specific legal obligation requires the processing or retention. Other financial administration may rely on a different applicable lawful basis.
Health and other special-category information. Information about physical or mental health, including information recorded in therapy or coaching notes, is special-category data where it concerns health. In addition to an Article 6 lawful basis, I must identify and meet an applicable Article 9 UK GDPR condition and any associated requirements in the Data Protection Act 2018. Article 9(2)(h), together with the relevant provisions of the Data Protection Act 2018, may apply to qualifying health or social care processing where the legal requirements are met. Article 9(2)(f) may apply where processing is necessary for the establishment, exercise or defence of legal claims. The appropriate condition depends on the service, purpose and circumstances; I do not assume that the same condition applies to all coaching and therapy records.
Retaining information after our work ends. I retain records according to the retention schedule in Section 6. I consider the purpose for which each category is held, applicable legal requirements, relevant professional guidance, the nature and sensitivity of the records and the need to establish, exercise or defend legal claims. Where an exception justifies keeping a particular record for longer, the reason is documented and the retention need is reviewed.
Website operation, security and analytics. I use relevant technical information to operate and secure my website and, where appropriate, understand how it is used. Depending on the activity, I may rely on legitimate interests where appropriate or consent where required. Non-essential cookies and similar technologies will be used only where the required consent has been obtained under applicable privacy and electronic communications law.
Marketing and updates. I send optional marketing communications only where permitted by applicable data protection and electronic marketing rules. Where consent is required, I will obtain it before sending communications. Where another permitted route applies, I will comply with its conditions. You can opt out of marketing at any time.
I handle client information in accordance with applicable confidentiality obligations and take appropriate steps to protect it. I do not treat the provision of a privacy notice as consent to processing, and I will seek consent separately wherever consent is the appropriate legal basis.
4. Who I share information with
I do not sell your personal information. I may share information where necessary with service providers that support my work, such as secure cloud storage, email, video-conferencing, website hosting or website analytics providers. These providers should only process information under appropriate arrangements and safeguards.
I use Google Workspace for encrypted cloud storage and password-protected access. When you book a session, data is held on Zoom, Calendly and Stripe.
I may also disclose information where required by law, in response to a valid request from a public authority, or where necessary to establish, exercise or defend legal claims. I will consider confidentiality and any applicable professional obligations when deciding whether disclosure is appropriate.
I do not routinely share identifiable client information for marketing.
5. Where information is stored and international transfers
Personal information is stored in Google Workspace using cloud-based storage and access controls, including password-protected access. Security measures are designed to reduce the risk of unauthorised access, loss, alteration or disclosure, although no method of electronic storage or transmission can be guaranteed to be completely secure.
Some service providers may store or access information outside the United Kingdom. Where a restricted transfer of personal information takes place, I will ensure that an applicable transfer mechanism is in place, such as UK adequacy regulations, appropriate safeguards or a valid exception, and will meet the relevant legal requirements. The transfer arrangements for each provider will be checked against the services used and the applicable contractual terms.
6. How long I keep information
I retain personal information only for as long as necessary for the purposes for which it is held, taking account of applicable legal requirements, relevant professional guidance, the nature and sensitivity of the information and the need to establish, exercise or defend legal claims.
Adult client records — including contracts, session notes and relevant client correspondence — are retained for seven years after the end of the service or the last session, whichever is later. Financial records are retained for seven years, unless a different period is required by law or is otherwise justified for a specific record.
Records relating to children are retained until the individual’s 25th birthday, or until their 26th birthday if they were 17 when treatment ended. This period is adopted as a benchmark aligned with the NHS England Records Management Code of Practice for children’s records; that Code does not automatically bind every private practice. I will also consider any applicable legal or professional requirements and documented safeguarding or legal-claim needs before disposal.
Routine enquiries, booking metadata, emails and information held by service providers such as Zoom and Calendly are reviewed separately and deleted when no longer needed for their stated purpose. They are not automatically retained for the same period as the core client record. Where a record forms part of the client record or is needed for a complaint, safeguarding matter or legal claim, it may be retained under the applicable retention period.
7. Cookies and website analytics
The website may use cookies and similar technologies through Squarespace and other website tools to make the site function, remember preferences and, where enabled, analyse website traffic. I will check the cookies and similar technologies actually in use and provide accurate information through the cookie notice. Non-essential cookies and similar technologies will not be used unless the required consent has been obtained.
8. How I protect information
I use safeguards intended to protect personal information, including encrypted cloud-based storage and password-protected access. Access is limited to people and providers who need the information for a legally authorised purpose. I will take reasonable steps to respond to suspected personal data breaches in accordance with applicable law.
Please avoid sending highly sensitive information through an email or other channel unless it is appropriate for the purpose. If you have a concern about the security of your information, contact me using the details below.
9. Your data protection rights
Subject to the circumstances and any applicable legal exemptions, you may have the right to:
· Be informed about how your personal information is used.
· Request access to the personal information I hold about you.
· Ask me to correct inaccurate or incomplete information.
· Request erasure of your information where the legal conditions are met.
· Request restriction of processing in certain circumstances.
· Object to processing based on legitimate interests and to certain direct marketing.
· Request portability of information where the legal conditions apply.
· Withdraw consent at any time where I rely on consent. Withdrawal does not affect processing carried out before withdrawal.
These rights are not absolute in every situation. For example, I may need to retain some records where a legal obligation applies or where the information is needed for legal claims. To make a request, email contact@sophiepsychology.com. I may need to verify your identity before responding.
10. Complaints
If you have a concern, please contact me first so that I can try to resolve it. You also have the right to complain to the UK Information Commissioner’s Office (ICO). Information and contact options are available at https://ico.org.uk/make-a-complaint/.
11. Links to other websites
The website may contain links to third-party websites. Those websites operate under their own privacy practices, which I do not control. Please review their privacy information before providing personal information to them.
12. Changes to this policy
I may update this policy when my practices or legal requirements change. The latest version will be published on www.sophiepsychology.com with the updated date. If a change materially affects how I use your information, I will provide further information where required.
13. Contact
Sophie Wallace-Hadrill
Website: www.sophiepsychology.com
Email: contact@sophiepsychology.com