Privacy policy
How I look after your information.
Therapy depends on trust and that includes trusting what happens to your data. This notice explains, in plain English, what I collect, why, how long I keep it and your rights under UK data protection law.
Last updated September 2026
Data controller: Harjeet Hayre, trading as Inner Compass UK
Registered with the ICO, registration number ZC005736
Who I am
I am Harjeet Hayre, a sole-trader psychotherapist trading as Inner Compass UK. I am the data controller for the information described here. You can contact me about anything in this notice at innercompassuk@outlook.com or on 07738 131800.
What information I collect
-
Enquiries: your name, email address, phone number and whatever you choose to tell me in your message or on our introductory call.
-
Clients: contact details, emergency contact and GP details, the written agreement we sign, brief session notes and invoicing records.
-
Health information: anything you share about your mental or physical health. This is special category data under UK GDPR and is protected accordingly.
-
Website: this site uses only the cookies strictly necessary for it to work. No analytics or advertising cookies are set.
Why I use it and the legal basis
-
To respond to your enquiry: legitimate interests (UK GDPR Article 6(1)(f)).
-
To provide therapy under our agreement: performance of a contract (Article 6(1)(b)).
-
To process health information: the provision of health or social care or treatment (Article 9(2)(h)), under the professional duty of confidence that applies to my work, as provided for in the Data Protection Act 2018. Where I rely on your explicit consent for anything else, I will ask for it separately and you can withdraw it at any time.
-
To keep records for legal, insurance and professional purposes: legal obligation and legitimate interests.
Who I share it with
Nobody, except in these circumstances, which I explain before we begin:
-
Clinical supervision. I discuss my work with a supervisor, as BACP requires. You are not identified.
-
Serious risk. If I believed you or someone else were at serious risk of harm, I may contact your GP, emergency contact or emergency services. I would always try to discuss this with you first.
-
Legal requirements. Where the law requires disclosure, for example a court order.
-
Service providers. My video platforms (Microsoft Teams and Google Meet), email provider and accountant process limited data on my behalf under data processing terms. Clinical notes are never shared with them.
-
Professional will. A named colleague holds sealed instructions to contact clients if I were unable to practise.
Your data is stored in the UK or under safeguards recognised by UK law.
How I keep it safe
Session notes are brief and kept separately from anything that identifies you. Digital records are held on encrypted, password-protected devices and accounts. Paper records, where they exist, are locked away.
How long I keep it
-
Enquiries that do not lead to therapy: deleted within one month.
-
Client records: retained for seven years after therapy ends, which is commonly recommended for therapists and covers the three-year period in which a complaint can be raised with BACP, then securely destroyed. Data protection law does not set a fixed period; BACP asks members to decide and to inform clients.
-
Records for people under 18: retained until the 25th birthday or seven years after therapy ends if longer.
Your rights
You have the right to ask for a copy of the information I hold about you, to have inaccuracies corrected, to ask for deletion (subject to my professional and legal duties to retain records), to restrict or object to processing, to data portability and to withdraw any consent you have given. To exercise any of these, email me. I will respond within one month.
Complaints
If you are unhappy with how I handle your data, please tell me first so I can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Changes
I review this notice annually and whenever my practice changes. The date at the top tells you when it was last updated.
Sources
-
BACP (2026). Notes and record keeping; ICO, Right to be informed.
Ready when you are.
A free introductory call, no forms and no obligation. Just a quiet conversation to see whether working together feels right.