What we write down, and who can see it.

Clinical notes

• Short and factual: date, who attended, themes, anything agreed, anything of concern. Not a transcript, and not a character assessment.
• Stored encrypted on a UK-based practice management system with two-factor authentication. Paper notes, where they exist, are in a locked cabinet in a locked room.
• Only your therapist and, where necessary, the clinical lead can see them.
• Kept until seven years after the young person’s eighteenth birthday, which is what our insurers require, and then securely deleted.

Who else sees anything

• Supervisors. Every therapist discusses their work in supervision. Names and identifying details are not used.
• Schools, GPs and other services. Only with your written consent, and only what is needed for the purpose you agreed to.
• Nobody else, unless the safeguarding duty described on the safeguarding page applies, or we are required to disclose by a court order.
• We do not sell, share or trade any information about you, ever, and there is no circumstance in which we would.

Asking to see the notes

You have a right to ask for a copy of what we hold. For younger children, we will normally go through the notes with the parents. For young people from about thirteen, we ask them first — their consent matters, and disclosing their notes without it damages the work and their trust. We respond within one month.

You can also ask us to correct something that is wrong, and you can ask us to delete what we hold once our insurance retention period no longer applies.

This website

• No analytics. We do not use Google Analytics or any other tracking tool. We do not know how many people visit this site and we are content not to.
• No advertising, no third-party scripts, no social media pixels.
• No cookies. The only thing stored on your device is your reading preference — text size, spacing and calm mode — which is kept in your own browser, never sent anywhere, and cleared when you clear your browser data. Because it is not used to track you, no cookie banner is needed.
• Typefaces are hosted by us, not loaded from Google or Adobe, so no third party is told which pages you read.
• Forms. The two enquiry interfaces on this site are demonstrations. They validate what you type and show their confirmation state, and they transmit nothing — there is no form submission, no endpoint and no mailbox. Whatever you type stays in the browser tab until you close it.
• In the real version, this is where the practice would explain that email is not a secure channel and ask you to telephone instead.

Legal basis and your rights

Under UK GDPR we process health-related data on the basis of Article 9(2)(h) — the provision of health and social care — and ordinary contact details on the basis of legitimate interest in replying to you. You have the right to access, correct, restrict, object to, or request deletion of your data, and to complain to the Information Commissioner’s Office if you believe we have handled it badly.

Contact

In the real version of this practice, this is where the data controller would be named, with a postal address, an email address and a telephone number.

Harbour is a fictional practice built as a design concept by Alexander Watson Studio. The policies described here are written the way a good one would be, but there is no organisation, no practice management system, no mailbox and no records — because there are no clients.