Privacy Policy

How we handle your personal information.

Privacy Policy – Quick read

The Counselling and Therapy Hub CIC (The CATH) takes your privacy seriously.

We collect only the personal information we need to provide our services, respond to enquiries and meet our legal and professional responsibilities.
If you become a client, we may process sensitive information about your health, wellbeing and circumstances as part of providing counselling or support.
We may receive information about you from an organisation or service that refers you to The CATH.
Zanda Health is our primary practice management system, and our client records are held in the UK.
We use Zanda's built-in BizzyAI tool after sessions to turn a therapist's dictated summary into a draft clinical note. Counselling sessions themselves are not recorded.
Some trusted providers may process limited information outside the UK. Where they do, appropriate legal safeguards are required.
We may communicate with you and provide services through different platforms, including telephone, video call and messaging services, where appropriate and agreed with you.
We do not sell personal data.
We keep personal information only for as long as necessary and in line with our legal, regulatory and professional obligations.
You have rights over your personal information under UK data protection law.
Our website uses cookies and similar technologies. Where consent is required, you can manage this through our website's cookie settings.

Full details are set out in our Privacy Policy.

Last updated: August 2026

PRIVACY POLICY – FULL

The Counselling and Therapy Hub CIC handles personal information in accordance with UK data protection law, including the UK GDPR and Data Protection Act 2018.

This policy applies to website visitors, people who contact us and people who use our services.

1. WHO WE ARE

The Counselling and Therapy Hub CIC is a neurodivergent-led counselling, support and training organisation working with adults in England and Wales.

We provide counselling, body doubling, neuro-inclusive training and access to Ana, our free ADHD-friendly Custom GPT available through ChatGPT.

2. INFORMATION WE COLLECT

Depending on how you interact with us, we may collect information including:

Your name and contact details.
Your date of birth and address where required.
Information you provide when making an enquiry.
Appointment and service information.
Emergency contact details.
Communications between you and The CATH.
Payment and invoice information.
Information required to provide and manage our services.
Clinical records and notes where you receive counselling.

If you receive counselling or other support services, we may also process sensitive personal information, including information about your physical or mental health, wellbeing and personal circumstances.

This is known as special category data and receives additional protection under data protection law.

We may also receive personal information about you from an organisation or service that refers you to The CATH. This may include your name, contact details, reason for referral and other information relevant to arranging or providing your service. We will tell you where your information came from where required by data protection law.

We only collect information that is relevant and necessary for the purposes for which it is being used.

3. HOW WE USE YOUR INFORMATION

We may use your personal information to:

Respond to enquiries.
Provide information about our services.
Arrange and manage appointments and assessments.
Provide counselling and other services.
Maintain appropriate clinical and service records.
Communicate with you about your care or our services.
Process payments and invoices.
Meet safeguarding responsibilities.
Meet legal, regulatory and professional obligations.
Manage and improve the operation of our services.

We only process personal information where we have a lawful basis to do so.

4. OUR LAWFUL BASIS FOR USING YOUR INFORMATION

Depending on why we are using your information, we may rely on:

Contract – where processing is necessary to provide a service you have requested or entered into with us.
Legal obligation – where we need to process information to comply with the law.
Legitimate interests – where processing is reasonably necessary to operate and manage our services and those interests do not override your rights.
Consent – where we have specifically asked for and received your consent.
Vital interests – in exceptional circumstances where processing is necessary to protect someone's life.

Health information and other special category data receive additional protection under UK data protection law. Where we process this information to provide counselling or related care, we rely on the health or social care condition (Article 9(2)(h) UK GDPR and the corresponding condition in Schedule 1 of the Data Protection Act 2018). We are able to rely on this because our services are delivered by practitioners who are bound by professional obligations of confidentiality.

In some circumstances, we may instead rely on your explicit consent or, in an emergency, on the protection of vital interests.

5. ZANDA HEALTH AND BIZZYAI

Zanda Health is our primary practice management system and is used to securely store and manage client information, records and communications.

This may include contact and emergency contact information, appointments, forms, clinical notes, communications, invoices and payment information. Initial assessment information may also be retained in paper format as a backup where appropriate.

BizzyAI is Zanda's built-in tool for preparing clinical notes. At The CATH, it is used only after a session: the therapist dictates a summary, such as the session theme, how the client presented and outcomes, which BizzyAI turns into a draft note. Counselling sessions themselves are not recorded.

The transcription is carried out within Zanda's systems, and the draft note is produced using trusted AI processing services. Audio is not stored; it is used only momentarily to create the transcript and is then discarded. Any temporary transcript is retained only in line with our configured retention settings and is deleted when no longer required.

The therapist reviews every note and remains responsible for the accuracy and content of the final clinical record, which is kept as part of the client's clinical record (see Section 11).

6. INTERNATIONAL PROCESSING

Our primary client records are hosted in the United Kingdom.

Some of the trusted providers we use to run specific parts of our service – for example, AI-assisted preparation of clinical notes, payment processing or technical support – may process limited personal information outside the UK.

Where this happens, we ensure that an appropriate safeguard recognised under UK data protection law is in place, such as a UK adequacy or data bridge decision or an International Data Transfer Agreement, so that your information continues to receive appropriate protection.

We do not sell personal information or transfer it internationally for marketing purposes.

7. SOCIAL MEDIA, EMAIL AND MESSAGING

If you contact us through email, telephone, social media or messaging services such as Facebook, Instagram or WhatsApp, we will process the information you provide in order to respond to you.

We may communicate with you and provide services through different platforms, including telephone, video call and messaging services, where appropriate and agreed with you.

If you go on to use our services, relevant information may be transferred into our practice management system as part of onboarding and service delivery.

Third-party social media and messaging services operate under their own privacy policies.

8. ANA

Ana is a free ADHD-friendly Custom GPT available through ChatGPT.

The CATH does not receive or have access to conversations users have with Ana, and information shared within those conversations is not provided to counsellors at The CATH.

Ana is a reflection tool and is not counselling, a crisis service or a replacement for professional support.

A ChatGPT account is required to use Ana. Information entered into ChatGPT is handled by OpenAI under its own privacy policy, and we direct users to read that policy before accessing Ana.

9. SHARING YOUR INFORMATION

We do not sell personal information.

We may share personal information where necessary:

With service providers that process information on our behalf.
To provide or administer our services.
For safeguarding purposes.
Where required by law.
With emergency services, GPs or other relevant professionals where appropriate in relation to safety or safeguarding.
To meet professional, regulatory, insurance or legal requirements.

We only share information that is necessary and appropriate for the relevant purpose.

10. HOW WE KEEP INFORMATION SECURE

We use appropriate technical and organisational measures to protect personal information.

We use approved business systems for managing records, communications and service delivery and take reasonable steps to ensure that people who process personal information on our behalf handle it appropriately.

11. HOW LONG WE KEEP INFORMATION

Enquiry information is kept only for as long as reasonably necessary to respond to and manage the enquiry.

Clinical records are normally retained for seven years after our last contact, in line with our legal, regulatory and professional obligations.

Any temporary transcript used to help prepare a clinical note is retained only in accordance with our configured retention settings and is deleted when no longer required. The final clinical note forms part of the clinical record described above.

Other information is retained only for as long as necessary for the purpose for which it was collected and to meet applicable legal, regulatory or professional requirements.

12. YOUR DATA PROTECTION RIGHTS

Depending on the circumstances, you may have the right to:

Ask for a copy of the personal information we hold about you.
Ask us to correct inaccurate or incomplete information.
Ask us to delete your personal information in certain circumstances.
Ask us to restrict how your information is used.
Object to certain processing.
Request data portability where applicable.
Withdraw consent where processing is based on consent.

Some rights are subject to legal limitations. For example, your right to request deletion may be limited where we are required or entitled to retain clinical records.

To exercise your rights, contact: info@the-cath.org.uk

13. COOKIES AND WEBSITE USE

Our website uses cookies and similar technologies to help it function and to understand how visitors use the site. This may include analytics provided through our website platform and cookies or similar technologies used by embedded third-party content, such as Google Maps.

Where consent is required, you can choose whether to allow non-essential cookies through our website's cookie settings.

14. CHANGES TO THIS POLICY

We may update this Privacy Policy where our services, systems or legal obligations change.

The latest version will be published on our website with the date it was last updated.

15. CONTACT AND COMPLAINTS

If you have questions or concerns about how The CATH handles your personal information, contact:

The Counselling and Therapy Hub CIC
The Circle, 33 Rockingham Lane, Sheffield, S1 4FW
Email: info@the-cath.org.uk

You also have the right to raise a concern with the Information Commissioner's Office (ICO).

ICO website: ico.org.uk/make-a-complaint
ICO helpline: 0303 123 1113

The Counselling and Therapy Hub CIC | Company Number: 12729248 | ICO Registration: ZB312579