Policies
Privacy notice.
Last updated 18 August 2026.
Who we are
Hora Psychotherapy Ltd is the data controller.
- Company number 16948848, registered in England and Wales
- Registered office: 27 Old Gloucester Street, London WC1N 3AX
- Information Commissioner’s Office registration ZC206629
To contact us about your information, write to the address above. If you want to see, correct or delete what we hold about you, that is covered underyour rights. We respond within one month.
Visitors to this website
Data
Page view counts. Our analytics tool uses no cookies and collects nothing that identifies you.
Purpose
Measuring use of the site.
Lawful basis
Legitimate interests: understanding how the site is used.
Required?
Nothing is asked of you.
Clients
Data
- Name, sex, gender identity, pronouns, date of birth
- Address, town, postcode, email, mobile, occupation
- Your GP’s name, and the practice’s name, email and phone
- An emergency contact’s name, relationship to you, email and mobile
- Mental health history: previous and current therapy, diagnoses, medication
- Physical health conditions
- How you heard about us
- Your location and a contact number, taken at the start of an assessment
- Your signature on the practice agreement
- Assessment notes, session notes, risk assessments, crisis plans, outcome measures
- Appointments, and messages sent through the client portal or by text
- Payment records. Card details are held by our payment processor; we do not see or store the full card number
Purpose
Providing assessment and therapy, and keeping you safe while we do.
Lawful basis
Contract. For health information, Article 9(2)(h) of the UK GDPR, provision of health care, with paragraph 2 of Schedule 1 to the Data Protection Act 2018. We do not rely on consent for clinical records.
Required?
Yes, as a condition of assessment and therapy, including the GP and emergency contact. Without them we cannot provide the service.
Applicants
Data
- Name, email, mobile, date of birth, pronouns
- Professional body and registration number, or training organisation, course and expected completion date
- Confirmation of your qualification or training stage, and of your right to work in the UK
- Modality, languages, availability, and your experience of assessment and risk
- DBS status and indemnity insurance
- CV and photograph
- How you heard about us
- A recorded video interview, and our notes on your application
Equality monitoring
Ethnicity; gender identity; whether your gender matches the sex registered at birth; sexual orientation; disability; neurodivergence; religion or belief; free school meals eligibility; first-generation university.
Every question carries a “prefer not to say”. Answers are not used in any selection decision and are analysed only in aggregate.
Purpose
Assessing your application. Where you ask us to, contacting your training organisation about becoming an approved placement.
Lawful basis
Legitimate interests in recruiting fairly and competently, and steps taken at your request before entering a contract. For equality monitoring, paragraph 8 of Part 2 of Schedule 1 to the Data Protection Act 2018, equality of opportunity or treatment. For contacting your training organisation, consent, which you may withdraw.
Required?
The eligibility questions are required to consider an application. Equality monitoring is not.
People who work with us
Data
- Full legal name, home address, emergency contact
- Right to work evidence
- National Insurance number, starter declaration or P45, student loan details, bank details
- References
- Enhanced DBS status and certificate details
- Indemnity insurance
- Professional registration, or training organisation confirmation, and supervisor details
- Photograph and biography
- Hours, sessions, supervision records, pay, training records
- Absence dates. Where absence is for health reasons, we record the absence and not the reason
Source
DBS status and dates are obtained from a criminal records checking service, to which you apply directly. References are obtained from the referees you name.
Safeguarding allegations
Any allegation about a person working with Hora is held in a separate restricted file.
Purpose
Engaging and paying you, meeting our legal obligations, and safe governance of the service.
Lawful basis
Contract. Legal obligation, for tax, right to work and safeguarding. Legitimate interests in safe governance of the service. For criminal offence data, paragraphs 10 and 18 of Part 2 of Schedule 1 to the Data Protection Act 2018.
Required?
Yes. Some by law, the rest as a condition of your contract. Without it we cannot engage you.
Partnership and placement enquiries
Data
Name, role, organisation, work email address, and what you tell us in your enquiry.
Purpose
Responding to your enquiry.
Lawful basis
Legitimate interests in responding to enquiries, and steps before entering a contract.
Required?
No.
Placements contacts at training organisations
Data
Name, role, work email address and organisation, and our correspondence with you.
Source
Your organisation’s website, where it was published as a placements contact, or an applicant who asked us to contact you.
Purpose
Telling training organisations about a placement their trainees can apply for.
Lawful basis
Legitimate interests in contacting training organisations about placements. You may object, using the data request form or by replying to any message from us, and we will stop.
GPs, emergency contacts and referees
Data
- A client’s GP: practice name, email and phone
- A client’s emergency contact: name, relationship to the client, email and mobile
- A referee: name, role, organisation, work email, and the reference given
Source
The client, or the applicant who named you.
Purpose
Contacting a GP or emergency contact about a client’s safety. Obtaining a reference.
Lawful basis
Legitimate interests, and in an emergency, vital interests.
Who we share information with
We do not sell your information or use it for advertising.
Suppliers processing information on our written instructions:
- A practice management system holding clinical records, appointments, messaging and payments, hosted in the UK
- A video platform, provided through that system, used for sessions
- A card payment processor
- A cloud database for staff, compliance and operational records, hosted in the United States
- Email, calendar and file hosting
- A staff portal and training platform
- An electronic signature service in the UK, used for staff contracts only
- A video interview platform in Spain, used for applicants only
- A criminal records checking service in the UK
- A payroll system and a payment service, both in the UK
- A registered office and post handling service in the UK
- Website hosting and a cookieless analytics tool
Others we may share with, who decide for themselves what they do with the information:
- Your GP, emergency services, social care or the police, where there is a serious risk to you or another person
- A therapist’s clinical supervisor. Where we share with a supervisor directly, we identify you by a client reference number
- A trainee’s training organisation and professional body
- HM Revenue and Customs
- Our insurers, insurance broker and professional advisers, where a claim or serious allegation is made
- A court or regulator, where required by law
Outside the UK
Clinical records are held in the UK. Three exceptions:
- The cloud database holding staff and operational records is in the United States. We rely on the UK Addendum to the standard contractual clauses.
- The video interview platform, used for applicants only, is in Spain, covered by UK adequacy regulations for the EEA.
- Our website analytics tool stores its counts in the United States and the European Economic Area. We rely on the UK Addendum to the standard contractual clauses, and on UK adequacy regulations for the EEA. Nothing it collects identifies you.
Health information and criminal offence data are held only in UK systems.
How long we keep things
| What | How long |
|---|---|
| Clinical records, including assessments, session notes and risk assessments | 7 years after therapy ends |
| An assessment not followed by therapy | 7 years from the assessment |
| A booking enquiry that did not become an assessment | 12 months |
| Safeguarding allegations about a person working for Hora | 25 years |
| Unsuccessful application: CV, photograph, personal statement, video, date of birth, equality monitoring answers | 1 month from our decision |
| Unsuccessful application: name, email, stage, outcome, date, number of applications | 3 years |
| Records about a person who works or worked for us | 6 years after the engagement ends |
| Right to work evidence | The engagement, plus 2 years |
| Training records | The engagement, plus 6 years |
| Enhanced DBS status and dates | The engagement. We do not keep the certificate |
| Partnership enquiries | 2 years from last contact |
| Placements contacts at training organisations | While the relationship is live or possible, reviewed at least every 2 years |
| Data rights requests | 3 years |
| Website analytics | Aggregate counts only |
Information is securely deleted at the end of its retention period.
Your rights
You have the right to be informed, and the rights of access, rectification, erasure, restriction of processing, objection to processing, and data portability. Where we rely on consent, you may withdraw it.
Some rights are limited. We cannot erase clinical records we are professionally required to keep, or payroll records HMRC requires us to hold. If we refuse part of a request, we will tell you which part and why.
Use the data request form or write to us. We respond within one month. A complex request may take up to two further months, and we will tell you within the first month if so. Where we need to verify your identity, the month begins when you provide what we have asked for.
Complaints
Complain to us using the data request form or by post, or to the Information Commissioner’s Office at any time.
- ico.org.uk
- 0303 123 1113
- Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Automated decisions
No decision about you is made by automated means, and we do not carry out profiling.
We use software for routine tasks such as appointment reminders and expiry alerts, and AI tools for administrative work. Client information is not put into AI tools.
Changes to this notice
We review this notice at least annually, and whenever our processing or the law changes. The date at the top shows when it was last updated. We will tell you directly about a change that materially affects you.
Complaints about the service
The section above is about your information. This one is about the service itself. We take concerns seriously and want to put things right. If you’re a current client, the easiest first step is to speak with your therapist directly, or with Hora’s Clinical Lead.
If that doesn’t resolve it, you can make a formal complaint in writing. We’ll acknowledge it within five working days and respond within twenty. If you’re still unhappy, you can ask for the decision to be reviewed by someone independent of the original response.
You can also raise a concern outside Hora at any point: with the UKCP or with your therapist’s training organisation on matters of conduct, or with the Information Commissioner’s Office on matters of personal data.
Hora Psychotherapy Ltd, registered in England & Wales, company no. 16948848.