Privacy Policy &
AI Transparency Statement

​

Data Controller: Adam Coombes (Counsellor, EMDR Practitioner, and Clinical Supervisor)
ICO Registration Number: ZB779547
Contact Email: adamc.therapy@gmail.com

I am committed to protecting your privacy and handling your personal information with the highest levels of confidentiality and responsibility. This Privacy Notice explains how I collect, use, store, and safeguard your data, including specific details on how your information interacts with automated systems and closed-loop artificial intelligence (AI) tools utilised within my practice.

 

 

1. Scope of Data Collected & Lawful Bases

By the very nature of psychological therapy and clinical supervision services, I collect and process deeply sensitive information. This is legally categorised under the UK GDPR as Special Category Data (specifically, your mental and physical health details, clinical assessments, history, and session notes).

I process this data relying on two distinct lawful bases under the UK GDPR:

1. Explicit Consent [Article 9(2)(a)]: By engaging my services and completing intake or registration workflows, you grant clear, explicit consent for me to process your health data.

2. Provision of Health or Social Care Treatment [Article 9(2)(h)]: The processing is strictly necessary for the delivery of therapeutic counselling, EMDR treatment, and clinical oversight.

 

 

2. Website Hosting, Enquiries, and Intake (Wix)

My website is hosted on the Wix Platform.

• Data Processed: When you submit an online enquiry, booking request, or client registration form through my website, Wix secure databases process and store these intake records. This includes your name, contact information, and any initial summaries of your mental or physical health that you choose to provide in the descriptive text boxes.

• AI Guardrail: All custom form inputs and personal data are strictly ring-fenced within my secure Wix account. Wix's backend diagnostic systems and background automation tools have no access to harvest, store, or utilise your clinical information or personal descriptions to train commercial generative AI or Large Language Models (LLMs).

 

 

3. Core Practice Management & Administrative Ecosystem

To manage clinical files, execute administrative duties, and process financial records efficiently, I utilise industry-standard professional software. Some of these platforms employ specialised, built-in artificial intelligence and closed-loop machine learning to automate manual back-office tasks.

 

A. WriteUpp (Clinical Practice Management)

I maintain all official clinical case notes, appointment schedules, and diagnostic documents within WriteUpp (operated by Pathway Software), a dedicated practice platform for healthcare professionals.

• Security & Data Isolation: All clinical files and identity data are heavily encrypted and isolated inside a secure, single-tenant database architecture. No generative AI engines or transcription features are deployed on your case records. Your clinical information remains entirely secure, private, and inaccessible to public or third-party training networks.

 

B. Xero (Invoicing & Bookkeeping)

I utilise the cloud-based accounting platform Xero UK to issue invoices, facilitate card payments (through Stripe) handle digital bookkeeping, and comply with tax requirements.

• AI Interaction: When invoices are generated or payments are reconciled, your transaction metadata (such as name, fees, and basic invoice descriptions) interacts with Xero's internal, automated machine learning tools. This technology is used strictly to read incoming documentation, auto-populate routine administrative lines, and cross-reference bank settlements against open files.

• Security Guardrail: Your financial records and identifying metadata remain completely isolated and encrypted within my private business account. Xero guarantees that your transaction details and billing items are never used to train public or foundational third-party AI models.

 

C. Tide Banking (Financial Administration)

My business bank accounts are managed through the Tide Banking Platform.

• AI Interaction: When you settle fees or issue bank transfers, your financial data (such as account numbers, sort codes, names, and transaction references) interacts with Tide’s secure underlying network (powered by ClearBank Ltd). Tide utilises internal, closed-loop predictive machine learning models to perform automated security checks, anti-money laundering (AML) screening, and real-time fraud monitoring.

• Security Guardrail: Tide utilises specialised, secure generative tools internally (hosted via Amazon Bedrock/AWS) to assist their support staff with administrative overviews. Your sensitive payment history and transactional profile data are strictly contained within enterprise-grade Virtual Private Clouds (VPCs) and are never released to public commercial AI models.

 

D. GoodNotes (Digital Handwriting & Layouts)

For real-time note-taking, sketching clinical formulations, or brainstorming supervisor frameworks, I may use digital ink tools via GoodNotes.

• AI Interaction: GoodNotes uses localised, on-device machine learning algorithms strictly to index handwriting for search functions and spelling corrections.

• Security Guardrail: Cloud-based generative text features or automated auto-complete algorithms are deliberately deactivated or bypassed for clinical notes. Your records remain localised, encrypted, and structurally isolated from commercial AI cloud training modules.

 

E. Gmail & Microsoft 365 (Core Infrastructure)

I use professional editions of Google Gmail and Microsoft 365 Enterprise to handle standard business correspondence, calendar scheduling, and internal files.

• AI Interaction: Machine learning on these infrastructures is strictly limited to foundational security mechanisms, including anti-phishing scripts, automated spam filters, data loss prevention (DLP) flags, and basic scheduling suggestions. No clinical notes or client records are analysed to build or feed public data platforms.

 

F. Canva (Design & Marketing Assets)

I utilise Canva solely as a creative workspace for generic public-facing marketing material, educational handouts, and presentation designs.

• Security Guardrail: There is an absolute operational separation maintained between this design environment and my client infrastructure. No client data, names, clinical transcripts, or personal health histories ever enter or interact with the Canva platform or its built-in design AI generators.

 

 

4. Remote Consultation & Video Ecosystem (Zoom & Microsoft Teams)

To provide accessible, flexible therapy and clinical supervision remotely, I conduct secure virtual video sessions using Zoom and Microsoft Teams.

• Zoom Session Protections: When conducting clinical or supervision sessions over Zoom, I explicitly turn off the Zoom AI Companion feature. No automated AI meeting transcripts, live captions, or summary logs are generated by Zoom's AI tools during our sessions, ensuring absolute verbal confidentiality. All video and audio streams are fully encrypted in transit.

• Microsoft Teams Guardrails: If we connect via Microsoft Teams, I maintain complete control over my private business tenant. Under Microsoft's strict Enterprise Data Protection (EDP) standards, no conversation feeds or audio streams are shared with external AI sub-providers, and your data is never accessible to train public commercial large language models (LLMs).

• Right to Opt-Out: If Teams is utilised, you retain the absolute right to request that any standard platform transcription features be deactivated entirely during our live sessions together.

 

 

5. Third Parties & Data Retention Boundaries

I never sell, trade, or lease your personal or health data to third parties for marketing purposes. Your information is shared exclusively with the trusted technical software processors listed above—each legally bound by strict confidentiality agreements—or under extreme statutory exemptions (such as emergency medical risk to life or explicit legal court mandates).

In alignment with professional regulations and UK accounting requirements:

• Clinical Records & Session Notes: Retained securely for 7 years following the conclusion of our therapeutic relationship, after which they are permanently and securely destroyed.

• Financial & Invoicing Records: Retained for 6 years to comply with HMRC tax requirements.

• Website Inquiries: Temporary contact submissions are routinely deleted from web servers once successfully transferred to my secure clinical management software.

 

​

6. Your Statutory Rights Under UK GDPR

Under the UK Data Protection Act, the Data (Use and Access) Act 2025, and UK GDPR frameworks, you hold extensive, non-negotiable rights regarding how I manage your data. You have the right to access a copy of your data, request rectification of inaccuracies, object to specific automated processing workflows, or request data erasure (subject to my 7-year professional regulatory retention requirements).

Data Protection Complaints Process:
If you have any concerns or wish to raise a formal complaint regarding how your personal or health data is handled, stored, or interacted with by AI tools, please submit your complaint in writing to adamc.therapy@gmail.com.

• I will formally acknowledge your complaint within 30 days of receipt.

• I will conduct a thorough investigation into the matter and provide you with a detailed outcome report without undue delay.

If you remain unsatisfied with my response, you retain the statutory right to escalate your complaint directly to the Information Commissioner’s Office (ICO) at www.ico.org.uk.

​

If you have any questions, wish to exercise any of these structural data controls, or have concerns regarding how technology assists my workflows, please contact me directly at adamc.therapy@gmail.com. You also retain the baseline right to escalate queries or file formal complaints with the Information Commissioner’s Office (ICO) at www.ico.org.uk.