Privacy Notice
Last updated 28 October 2026.
Therapy on the Hill is committed to data minimisation, confidentiality and compliance with the UK General Data Protection Regulation and Data Protection Act 2018.
Who is responsible for your data
Dr Richard Pomfret, trading as Therapy on the Hill, is the controller for personal data collected through this website. Privacy questions and rights requests can be sent to richard@therapyonthehill.com.
What the website collects
The enquiry form prepares an email in your own email app containing your name, optional phone number, preferred contact method, enquiry type and a brief message. The website does not receive or store what you type; the practice receives it only when you send the email, together with your email address. The separate newsletter form collects an email address, optional first name, audience preference, consent source and consent time. Please do not include detailed clinical histories, diagnoses or other sensitive information in either form.
Why it is used and the lawful basis
Requested therapy enquiries and assessments use the contract or pre-contract basis in Article 6(1)(b). Necessary security and proportionate practice administration use legitimate interests under Article 6(1)(f). Where health information is necessary for providing or arranging care, the practice also relies on Article 9(2)(h), with the applicable UK safeguards and professional confidentiality. Optional newsletters and browser analytics use separate consent, which you can withdraw without affecting an enquiry or access to the website. A privacy acknowledgement is not consent to marketing or analytics.
Downloads and email choice
The free resources in the Resource Hub download directly and do not require an email address. Joining the occasional email list is a separate, optional choice and is not a condition of access. Every email includes a link to a confirmation page where you can unsubscribe.
Service providers and transfers
Vercel hosts the website, Neon Postgres holds subscription records, Resend delivers website email and Cloudflare Turnstile helps protect the newsletter form. Enquiry emails pass through your own email provider and are received in the practice's Microsoft 365 mailbox. Resend documents US storage and normally retains email content and delivery logs for 30 days, with separate backups. Other provider and mailbox copies have their own retention arrangements. Relevant processing can occur outside the UK and requires applicable UK transfer safeguards. Ordinary email delivery is not a promise of end-to-end encryption.
Retention and deletion
Unsuccessful or abandoned form entries are not intentionally stored. Enquiries that do not become clients are reviewed for earlier deletion and kept for no more than 12 months in active website records. Subscriber data is kept until unsubscribe or retirement of the list. After unsubscribe, sending stops and the stored name is cleared. The email address and a limited subscription and consent record remain to honour the opt-out. If a clinical relationship begins, necessary material belongs in the separate clinical record. Clinical records use encrypted local/cloud storage and are normally kept for seven years after therapy ends, with justified longer retention for professional, insurance or legal reasons. Provider, mailbox and backup deletion is handled separately; deletion from an active website record is not immediate erasure of every copy.
Security and analytics
The site uses encrypted connections, restricted production credentials, anti-abuse checks and security headers. Optional Vercel Analytics and Speed Insights load only after you allow analytics and only on eligible public pages. Private routes, detailed clinical pages and identifying URL information are excluded. Advertising tracking, session replay and visitor-IP/history reports are not used. You can change your choice in the cookie notice and choices. Necessary hosting and security processing is separate. No internet system can be guaranteed completely secure.
Clinical forms
Questionnaires, the starter form and therapy agreement are not currently available for online submission. Their planned encrypted delivery and clinical review arrangements require separate verification before activation. They must not be used for emergency support.
Your rights and complaints
Depending on the circumstances, you may ask for access, correction, deletion, restriction or transfer of your personal data, object to processing or withdraw consent. Contact the practice first so the request can be considered promptly. You can also complain to the UK Information Commissioner's Office at ico.org.uk.