Privacy information

This draft explains how Woven Self Therapy handles website visits and secure form information. It must be reviewed and approved by the data controller before production launch.

Who is responsible for your information

The data controller is Vicki Whitby trading as Woven Self Therapy. Contact details and ICO registration details will be added here before launch once confirmed by the controller.

What the website collects

Public pages can be viewed without third-party analytics cookies. Secure enquiry and paperwork forms ask only for information needed to respond, arrange an exploratory call, or begin agreed therapeutic work. Depending on the form, this may include contact details, therapy context, accessibility preferences, address, emergency contact details, consent confirmations, and an electronic signature.

How secure forms work

Secure form contents are encrypted in your browser before they are sent. The public website stores encrypted envelopes and safe routing metadata only, such as submission ID, form type, key ID, receipt time, status, and expiry time. The website must not store names, contact details, therapy notes, health context, address, emergency contact details, or signatures in plaintext.

Vicki opens PracticeManager on an authorised local computer to fetch and decrypt submissions. Notification emails only say that a secure submission is waiting; they do not include personal information or form contents.

Why information is used

Information is used to respond to enquiries, assess whether Woven Self Therapy may be a suitable service, arrange sessions, keep therapy records, manage consent and agreements, meet legal and professional obligations, and respond to safeguarding or urgent-risk concerns where required.

The lawful basis and any special-category condition must be confirmed by the data controller before launch and recorded in the DPIA and Record of Processing notes.

How long information is kept

Encrypted website queue payloads are normally retained for up to 30 days before import, unless imported and acknowledged sooner. After PracticeManager confirms a successful import, the website deletes the encrypted payload material and keeps only minimal non-personal audit metadata for a limited period.

Local PracticeManager client records, consent records, signed paperwork PDFs, invoices, and clinical records are retained according to Woven Self Therapy's professional, legal, insurance, and privacy-notice retention policy.

Processors

Processor details for website hosting, email notification delivery, domain/DNS, backups, and security services are listed in the processor list and will be kept current before launch.

Your rights

You can ask to access, correct, erase, restrict, or receive a copy of personal information, and you can object to some processing. Some therapy, legal, safeguarding, insurance, or professional-record obligations may affect how a request can be fulfilled.

You can complain to the Information Commissioner's Office if you are unhappy with how your information is handled.

Urgent support

Woven Self Therapy is not a crisis service and messages are not monitored continuously. If you need immediate help, call 999, contact Samaritans on 116 123, text SHOUT to 85258, contact NHS 111, or attend Accident & Emergency.