Privacy Notice

Last updated: 11 October 2026

Your privacy matters. This notice explains how I collect, use and protect information when you contact ZC Therapy, receive therapy or use this website.

Who is responsible for your information?

I am Zach Cairns, trading as ZC Therapy, and I am the data controller. This means I am responsible for deciding how your information is used.

Practice address: 11 Station Road, Cheadle Hulme, SK8 5AF, United Kingdom.
Email: zach@zc-therapy.co.uk
Telephone: 07450 766559
ICO registration number: ZB869061.

What information do I collect?

I collect information relevant to responding to your enquiry and providing safe, appropriate therapy. Depending on our work together, this may include:

• Your name, date of birth, contact details and preferred way of communicating.
• Information you share in enquiries, assessments and therapy, including relevant health information, personal circumstances, goals, questionnaires and clinical notes.
• Relevant GP, emergency-contact, parent or carer details, where appropriate.
• Appointment, payment, invoice and insurance details.
• Relevant correspondence and any reports or referrals shared with your agreement, or where a lawful confidentiality exception applies.

Most information comes directly from you. When working with young people, relevant information may also come from parents or carers. With appropriate permission, information may come from a referring professional or insurer. I aim to collect only what is needed.

Why I use information and the legal bases

I use your information to respond to enquiries, assess whether I can help, arrange and provide therapy, keep an accurate clinical record, review our work and manage appointments and payments.

• Contract: taking steps at your request before therapy and providing the service we agree (UK GDPR Article 6(1)(b)).
• Legitimate interests: necessary practice administration, confidential supervision, maintaining appropriate records and handling concerns or claims, balanced against your rights (Article 6(1)(f)).
• Legal obligation: where a specific law requires me to keep or share information (Article 6(1)(c)).
• Consent: optional recording and transcription, and other optional uses explained to you (Article 6(1)(a)). You can withdraw consent.

Health information has additional protection as special category data. For necessary therapy and clinical records, I rely on the health or social care condition (Article 9(2)(h), with Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018), subject to my duty of confidentiality. Optional recording and transcription relies on your explicit consent (Article 9(2)(a)). Where relevant, information may also be needed to establish, exercise or defend legal claims (Article 9(2)(f)).

Providing relevant information helps me offer safe and appropriate therapy. If essential information is unavailable, I will discuss whether I can provide the service. Optional transcription is your choice.

Where your clinical record is kept

I use Zanda to store your final clinical notes and clinical record. Zanda is the ongoing record-storage system; Upheal has a separate role in transcription and drafting notes.

Zanda allocates UK-registered practices to its primary UK hosting region. It uses encryption and access controls. Its data-processing agreement also allows necessary overseas processing for purposes such as support, backup and resilience, subject to contractual safeguards. UK hosting does not mean that every processing activity takes place only in the UK.

I use Microsoft 365/Outlook for practice email and correspondence. Access to your information is restricted to people who need it for their role and are subject to confidentiality requirements. Any paper information is kept securely.

Optional recording, transcription and draft notes

With your explicit consent, I use Upheal for session transcription and note formation. It processes session audio to produce a transcript and draft clinical note. I check and, where needed, correct the draft before saving the final clinical note in Zanda. I remain responsible for the clinical record and decisions about your care.

• Session recording: temporary, and deleted once transcription and processing are complete.
• Transcript: deleted after 7 days, using my configured transcript-deletion setting.
• Final checked clinical note: retained in Zanda as part of your clinical record for the periods explained below.

The seven-day transcript setting is separate from retention of draft notes or other generated content in Upheal. Upheal is used for processing and drafting, rather than as my ongoing clinical-record system.

I will explain this process and obtain your permission before using it. You can decline or withdraw your consent and receive therapy without recording or transcription; I can take notes myself. Withdrawal stops future consent-based processing and does not undo processing already carried out lawfully or automatically remove clinical records that need to be retained on another lawful basis. For young people, consent and understanding are considered in line with their age, capacity and the involvement of a parent or carer where appropriate.

There are no solely automated decisions about your therapy. AI-generated text is a drafting aid and is reviewed by me.

Confidentiality, supervision and sharing

What you share in therapy is treated confidentially. My confidentiality responsibilities also extend to my clinical supervisor. Supervision is required for my BABCP accreditation and supports clinical judgement, professional practice and the care I provide. I limit identifying details wherever possible.

I will normally seek your explicit permission before sharing information with a GP, another professional or another person. Confidentiality has limits: information may need to be shared to address serious safety or safeguarding concerns, comply with a legal requirement or court order, or deal with a relevant complaint or legal claim. I share only what is necessary and, where possible and appropriate, discuss this with you first.

For insurer-funded therapy, an insurer may request relevant information or a clinical summary for authorisation or funding. I explain these arrangements and share only the information needed for that purpose. The insurer's own privacy notice explains how it uses information it receives.

When working with children and young people, we discuss confidentiality and parent or carer involvement together. Parents do not automatically receive everything a young person shares.

Service providers and international processing

Services used to run the practice include Zanda for clinical records, Upheal for optional transcription and draft notes, Microsoft 365/Outlook for email, and IONOS for website hosting and contact forms. Providers may use contracted subprocessors to deliver their services.

Upheal is a US company and its services involve processing outside the UK, including in the United States. Its EU/UK data-processing agreement provides Standard Contractual Clauses with a UK Addendum for restricted transfers. Zanda's global data-processing agreement also provides transfer safeguards, including Standard Contractual Clauses and a UK Addendum where applicable.

Other providers may process information internationally under their applicable arrangements. You can contact me for information about the safeguards relevant to your data, including how to obtain a copy of them. Further provider information is available from Zanda's terms and data-processing agreement and Upheal's client privacy notice.

How long information is kept

• Adult clinical records: 7 years after therapy ends.
• Children and young people's clinical records: until their 25th birthday.
• Enquiries that do not lead to therapy: deleted once it is clear that therapy will not proceed.
• Upheal recordings and transcripts: the shorter periods described above apply; these are separate from your final clinical record.

Clinical records support continuity of care and professional accountability. Information may need to be kept longer where a specific legal requirement, safeguarding matter, complaint or claim requires it. Information is securely deleted or destroyed when it is no longer needed. Technical backups may follow a provider's separate deletion cycle.

Website, cookies and external services

This website is hosted by IONOS. When you visit, technical information such as your IP address, browser details and access logs may be processed to deliver and secure the website. Contact-form information is used to respond to your enquiry. Please share only the information needed at this stage.

IONOS SiteAnalytics provides website-use statistics. Google Analytics is also configured on the website under its consent controls. Analytics helps me understand how the site is used; it is separate from clinical records. Relevant technical or usage information may be processed by the provider.

Google Maps and the website translation service are optional external services. Loading them may share technical information with the relevant provider, including your IP address. The website asks for consent before loading these services.

You can review the services shown and change optional choices through Privacy Settings. Necessary services support the website's operation and security. External services have their own privacy notices, and may involve international processing. Changing website preferences does not change any separate consent you have given for therapy transcription.

The Know My Wiring app

This companion app is for my Know My Wiring programme clients. Access requires a signed app consent form and personal access code.

Everything you enter stays on your phone. I cannot see it; nothing is sent to me or anyone else. It has no accounts, logins, cloud storage, advertising, analytics or tracking cookies.

app.zc-therapy.co.uk is hosted by US-based Cloudflare, which may keep basic technical logs, such as IP addresses and browser types, to deliver and secure the app. These exclude your entries. Cloudflare is certified under the UK Extension to the EU-US Data Privacy Framework (“UK-US data bridge”), safeguarding this technical information.

App privacy information: [link to the app privacy page]

Your rights and questions

Depending on the circumstances and legal basis, you can ask to access your information, correct inaccuracies, delete information, restrict processing, object to processing based on legitimate interests or receive eligible information in a portable format. These rights have limits; for example, some clinical records may need to be retained. Where processing relies on consent, you can withdraw it at any time.

Contact me at zach@zc-therapy.co.uk to ask a question or exercise a right. I may need to confirm your identity. I will usually respond within one month, and explain if a lawful extension applies.

You can also complain to the Information Commissioner's Office (ICO), the UK's data-protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to raise a complaint with me first.

For a brief explanation of confidentiality and safeguarding, see About Me. My therapy agreement explains our working arrangements. This notice will be updated when relevant practice or service arrangements change.