Privacy Notice

What I do with your information

Here's what happens to your data, explained clearly rather than hidden in legal language.

The short version: I keep your details secure, I don't sell them to anyone, and the small number of situations where anything leaves the room are all listed below.

The long version: here's everything you need to know.

Who's responsible for your data

I am. Luke Row, sole practitioner, and the data controller for everything described here. For questions, requests or complaints about your data, email hello@talktoluke.com.

What information I collect

It depends how far we get:

• If you enquire: your name, email, and whatever you choose to put in your message.
• If you book: name, email, phone, date of birth, address and postcode, country and timezone, your GP's details, an optional message, a record of what you agreed to, and a payment reference. For couples, the same details for your partner. While you are filling the form in, a copy is kept in your browser tab only, so nothing is lost if you step away to pay; it is cleared when you finish or start again.
• If you join the waiting list: names, emails, preferred times, and anything you add in the message box.
• If we work together: session notes, and the health and personal history that matters to the work.
• Around the site: blog comments (name and email) and your IP address, held briefly to prevent abuse. Analytics are privacy-first: no cookies, no advertising profiles, nothing sold.

Please share only what's needed at each stage. The message boxes aren't for urgent help.

Why I'm allowed to use it

UK data protection law requires a legal basis for everything above. Mine, in plain words:

• Providing the therapy you've asked for, and running the bookings and payments that come with it.
• Health information gets extra protection in law. I hold it as a counselling professional bound by confidentiality, for the purpose of providing your care.
• Keeping the website secure and preventing abuse.
• Keeping payment records because tax law says I must.

Consent is not the basis for your clinical records. Your therapy doesn't rest on something you might feel pressured to give. Where I do rely on consent, you can withdraw it at any time.

How I store your information

The house rules first: every account involved in running this practice has two-factor authentication or passkeys enabled, with physical Titan security keys on the accounts that matter most, and I use end-to-end encryption wherever it's available. The details:

Email: Google Workspace, which has handled my practice email since March 2026. My account is protected with hardware passkeys and Google's Advanced Protection Program.

Text messages: iMessage or WhatsApp, both encrypted.

My computer: password-protected, encrypted Mac. Session notes are stored separately from your personal details, with identifying information kept to a minimum. If notes could still be linked to you they count as personal data, and I treat them that way.

Scheduling: I built and run the booking system myself (booking.talktoluke.com), and I decide what happens to the data in it. Specialist providers run parts of it, and each one touches something different:

• Neon hosts the database, where your booking sits until it's stripped seven days after your first meeting.
• Vercel runs the website and the code that handles your booking, so your details pass through it at the moment you press submit. It doesn't keep them. It does keep brief technical logs of requests, things like which page was asked for, which browser, and whether it worked, and those are built to leave personal details out.
• Stripe takes the payment and holds the payment record.
• Resend delivers the emails, and holds a copy of what was sent for 30 days before deleting it.
• Google Calendar holds the appointment in my private practice calendar, with your name and contact details on the entry so I have them to hand. Those are stripped from the calendar on the same seven-day schedule as everything else, leaving just the date, time and type.
• Upstash counts requests for a few minutes at a time so the booking forms can't be abused. Your IP address is checked here and expires with the count.

Some of these companies are based outside the UK. Where that's the case, the transfer is covered either by the UK-US data bridge (Stripe, Vercel and Google are certified) or by UK-approved contract terms that bind the provider to the same standards (Neon, Resend and Upstash).

Payments: the first session is paid through my booking system via Stripe. After that, UK clients pay by bank transfer; international clients continue using Stripe. I don't store your card details. Stripe handles that with bank-level encryption.

Online sessions: sessions run on Zoom, using my personal meeting room rather than a scheduled event, so Zoom never receives appointment details from my booking system. That room is set up for end-to-end encryption. Some clients prefer FaceTime, which is end-to-end encrypted by default. Either way, sessions are never recorded.

How I use AI

This is worth being precise about, so here it is in full.

In therapy, not at all. Sessions are never recorded or transcribed. I don't use AI to take notes, to summarise what we discuss, or to help me think about your case. Nothing you tell me is typed into a chatbot.

In the booking system, as a coding tool. I built the booking system myself, and I use an AI coding assistant to help write and maintain the software behind it. To keep that well away from your information, the assistant reaches the database through a separate restricted account that cannot read names, emails, phone numbers, dates of birth, addresses or GP details. Those columns are blocked by the database itself, so it doesn't depend on me remembering to be careful. When I need to investigate a problem with a particular booking, I work from a reference number and masked values such as p***@t***.com.

Nothing about you is decided by a machine. No automated system makes decisions about your care, your suitability for therapy, or your appointments. Those are all mine, and I'm accountable for them.

When I share your information

Supervision: I'm in clinical supervision every week to discuss my work; it's an ethical requirement of practising. I keep identifying details to a minimum, first names at most, and no supervisor has access to your records or contact details.

Safety: if I'm seriously worried about your safety or someone else's, I'll talk to you first wherever that's safe and possible, and we'd usually agree together what support to involve, such as your GP or crisis services. I can only break confidentiality without your consent where the law requires it, or where the risk is serious enough that disclosure is legally and ethically justified. If that ever happens, I share the minimum necessary. My Safeguarding page sets out how this works and who you can contact.

If I die or become incapacitated: my therapeutic executor will contact current clients to let them know. The contact details needed for this are held in an encrypted, password-protected document.

When I delete your information

• Your first meeting: the booking system only ever holds your first meeting. Ongoing sessions are arranged directly between us and never go into it. Seven days after that first meeting, an automatic nightly job removes your name, email, phone number, date of birth, address, postcode, country, GP details and anything you wrote in the message box. It clears the calendar entry at the same time. What's left is a short code made from your initials, plus the date, time, session type and payment reference, which I keep because tax law requires it.
• Waiting list: entries are archived automatically once they're no longer active, at the latest 12 months from when you join or from the last time you confirm you're still interested, whichever is later. I'll email you 30 days before that happens, so you can confirm you'd like to stay on the list if you would. Archived entries are permanently deleted 30 days after that.
• Session notes: kept for seven years after we finish working together, in line with BACP guidance, then destroyed. If something genuinely requires a longer period, such as legal proceedings, I keep the record only as long as that reason lasts.
• Enquiry emails: deleted after 12 months if we don't end up working together.
• Blog comments: they stay until you ask me to remove them.
• IP addresses held for abuse prevention: deleted within 24 hours.

Your rights

You can:

• Ask for a copy of what I hold about you. It's free.
• Correct any mistakes.
• Ask me to delete things. Usually yes. For clinical records there are limited situations where the law or professional requirements mean I have to keep them, and I'll explain if so.
• Restrict or object to some uses of your data, and take a copy elsewhere where that right applies.
• Withdraw consent where consent is what I'm relying on.
• Complain to the Information Commissioner's Office: ico.org.uk, or 0303 123 1113. I'd appreciate the chance to sort a problem out first, but you don't need my permission.

The bottom line: I treat your information the way I'd want mine treated - securely, respectfully, and with the minimum fuss necessary.

This privacy notice forms part of our contract when we begin working together. When you book, you also receive a copy of our working agreement in your confirmation email, so you have a record of what you agreed to and when.

Questions? Just ask. I'd rather explain something clearly than hide behind legal jargon.