Updated 24 September 2026
Who we are
This privacy policy explains how Transformative Coaching Ltd, trading as Chris Finn Coaching, collects and uses personal information through chris-finn.com and in connection with Chris Finn’s private therapy and coaching practice.
Transformative Coaching Ltd is the data controller for the activities described here. This means it is responsible for deciding how and why your information is used. Its company number is 15088460.
For privacy questions or to exercise your data protection rights, contact Chris Finn at chris@chris-finn.com.
Where services are arranged through another clinic, employer, insurer or referring organisation, that organisation may also have responsibilities for your information. Its own privacy notice may apply to the information it handles. We will explain the arrangements relevant to your care.
Information we collect
We collect only the information relevant to your enquiry, the service you receive or the operation of the website. Depending on your contact with us, this can include:
- Your name, email address, telephone number and other contact details.
- Messages you send, appointment details and correspondence about your sessions.
- Information relevant to therapy or coaching, including your goals, personal circumstances, relevant history, assessments and session notes.
- Health information you share, including information about your mental health, treatment and wellbeing. This is given additional protection under data protection law.
- Information needed to arrange payment and maintain financial records, such as invoices, payment amounts and transaction references.
- Your newsletter preferences and records of consent or requests to unsubscribe.
- Website information, such as your IP address, browser and device information, pages viewed, interactions and cookie preferences, depending on the technologies enabled and your choices.
Please do not send payment-card details by email or put detailed clinical information into an appointment-booking form. We can discuss how to share sensitive information appropriately.
How we receive your information
Most information comes directly from you when you contact us, book an appointment, attend sessions or subscribe to updates. Some website information is collected automatically through the technologies described below.
Where relevant to your service, information may also come from a referring professional, clinic, insurer or another person involved in your care. We will explain the source and purpose where this applies, unless an applicable legal exception prevents us from doing so.
Why we use your information
We use personal information to:
- Respond to enquiries and discuss whether a service is suitable.
- Arrange and provide therapy or coaching and communicate about appointments.
- Maintain appropriate records of the work we do together.
- Manage payments, accounts and business administration.
- Support safe practice, consider concerns about someone’s safety and respond to complaints or legal claims.
- Send newsletters and updates where you have chosen to receive them.
- Operate and protect the website, understand its use and measure advertising where permitted.
Providing information for therapy or coaching does not automatically subscribe you to marketing. If you choose not to provide information needed to arrange or safely deliver a service, we may be unable to provide that service; we will explain this to you.
Our lawful bases
The basis depends on why information is being used:
| Purpose | Lawful basis |
| Responding to your request about a service, arranging appointments and providing the service you agree to receive | Taking steps at your request before entering a contract, or performing that contract — Article 6(1)(b). |
| General correspondence, proportionate record keeping, professional administration, website security, and handling complaints or legal claims | Legitimate interests — Article 6(1)(f). These interests are running a responsible practice, maintaining appropriate records, protecting information and establishing or defending our rights. We consider your rights and expectations when relying on this basis. |
| Keeping records or making disclosures required by law, including applicable accounting and tax requirements | Legal obligation — Article 6(1)(c). |
| Email newsletters and optional analytics or advertising processing operated on a consent basis | Consent — Article 6(1)(a). You can withdraw consent at any time. |
Health and other special-category information requires an additional legal condition; the bases above are not sufficient on their own.
Confidentiality and sharing information
Therapy and coaching information is treated as confidential. Confidentiality is not absolute: relevant information may need to be disclosed where required by law or where there is a serious safety concern and disclosure is lawful and necessary. We will discuss this with you where it is appropriate and safe to do so, and limit any disclosure to what is needed.
Where clinical supervision is used, identifying information is minimised and the work is discussed within appropriate confidentiality arrangements.
Information may also be shared, where necessary and lawful, with:
- Professionals involved in an agreed referral or your care.
- Insurers or organisations funding or arranging your sessions, within the arrangements explained to you.
- Professional advisers, accountants, insurers or legal representatives dealing with a relevant matter.
- Service providers supporting booking, communication, video sessions, website hosting, secure record storage, payments or newsletter delivery.
The services used in this practice include:
| Provider or system | Purpose and relevant information |
| Microsoft Word on Chris’s Mac, with Apple iCloud storage/synchronisation | Creating and storing client notes and related documents. Documents are stored on the Mac and also synced to iCloud. Using Word does not necessarily mean documents are stored in Microsoft OneDrive. |
| 123 Reg | Hosting the practice’s email account and processing email correspondence and attachments. |
| Calendly | Arranging appointments using booking details and information entered into the booking form. |
| Zoom | Providing online sessions and processing the information needed to connect participants. |
| Stripe | Processing card payments and related transaction information. |
| Banking providers | Processing bank transfers and providing payment records. |
| Mailchimp | Managing newsletter subscriptions, mailing-list information and email delivery. |
| Google and Meta | Website measurement and advertising technologies, as described in the cookies section below. |
A provider’s role depends on the service and the information involved. Some act on our instructions; some also use information for their own purposes, such as payment security or account administration. Their own privacy notices explain those activities. Including a provider here does not mean that all providers receive client notes.
Payments
You can pay by bank transfer or by card through Stripe. Stripe processes the payment information required for card transactions, and we use the associated payment records for administration and accounts. Bank transfers generate records such as the payer’s name, amount and payment reference. Please avoid including details of your health or treatment in a payment reference.
Further information about Stripe’s processing is available in its Privacy Policy.
Any proposal to record a session or use automated transcription will be discussed separately before it takes place, including its purpose, access, retention and the relevant permissions.
Storage and security
Client notes are written in Microsoft Word, held digitally on Chris’s Mac and also stored or synchronised through Apple iCloud. We use appropriate measures to protect information against unauthorised access, loss or misuse and limit access to people who need it for an authorised purpose.
No internet communication or storage system can be guaranteed completely secure. Please contact us if you have concerns about sharing information, so we can discuss an appropriate method.
International processing
Some technology providers may process information outside the UK. Any restricted international transfer must have an appropriate legal safeguard, such as applicable UK adequacy regulations or approved contractual safeguards with any necessary additional protections.
Stripe, Mailchimp and Apple publish information about their international processing arrangements. Stripe’s privacy information describes processing in countries including the United States and India. Mailchimp’s transfer guidance discusses transfers to the United States and the safeguards in its data-processing terms. Apple’s privacy policy describes its international processing arrangements. These general provider statements do not establish the location of every record held by this practice.
You can read more in Stripe’s Privacy Policy, Mailchimp’s data-transfer information and Apple’s Privacy Policy. Contact chris@chris-finn.com to ask about the transfer arrangements relevant to your information and how to obtain information about the applicable safeguards.
How long we keep information
We retain information only for as long as it is needed for its purpose, taking account of professional, insurance, legal and contractual requirements.
- Adult therapy and coaching records: our proposed retention period is seven years after the final session. Before publishing, confirm this period against the practice’s insurer and contractual requirements and adopt it in the record-deletion process. Replace this draft instruction with the confirmed period.
- Enquiries that do not lead to sessions: records are reviewed when the enquiry is resolved and retained only while needed for follow-up or a specific complaint, safety or legal reason. They are not automatically kept for the full client-record period.
- Financial records: retained for the period required by applicable accounting and tax law, which depends on the record and accounting period concerned.
- Newsletter information: retained while you remain subscribed. After you unsubscribe, we may retain a minimal suppression record to prevent further marketing, together with consent evidence where needed to demonstrate compliance.
- Website and tracking information: retention depends on the particular technology and its configuration. The cookie information described below must give the applicable durations.
If a complaint, claim or other specific obligation requires longer retention, we keep the necessary information for that purpose and review the need to retain it. Information is securely deleted or anonymised when it is no longer required, with backup copies managed through the applicable backup lifecycle.
Newsletters and updates
We use Mailchimp to manage newsletter subscriptions and send updates. If you opt in, we may email you news, resources and information about Chris Finn’s work, book and services. Your subscription details are processed through Mailchimp for this purpose. See Mailchimp’s privacy information for more information about its processing. You can unsubscribe using the link in a marketing email or by contacting chris@chris-finn.com.
Unsubscribing from marketing does not prevent necessary communication about appointments or services you have requested. Withdrawal of consent does not affect processing that was lawful before withdrawal.
Cookies, Google and Meta
The website uses cookies and similar technologies. Some support essential website functions and security. Others can help measure website use or advertising performance.
Google and Meta technologies can process device identifiers, browsing activity and interactions. Depending on the service and settings, this can involve information being linked with information those providers already hold and used for advertising purposes.
Your data protection rights
Depending on the circumstances and the legal basis for processing, you may have the right to:
- Ask for access to your personal information and a copy of it.
- Ask for inaccurate information to be corrected or incomplete information completed.
- Request deletion of information or restriction of its use.
- Object to processing based on legitimate interests.
- Receive certain information in a portable format or request its transfer.
- Withdraw consent where we rely on it.
You can object to direct marketing at any time. Other rights are subject to conditions and exceptions; for example, a request to delete information may not override a valid need to retain clinical records.
To make a request, email chris@chris-finn.com. Requests are normally handled free of charge and without undue delay, usually within one month. We may need information to verify your identity or clarify your request. If a lawful extension or exception applies, we will explain it.
Questions and complaints
Please contact chris@chris-finn.com if you have a concern about how your information is handled.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator. You do not have to complete our complaints process before contacting it.
Website: ico.org.uk
Changes to this policy
We may update this policy to reflect changes to our services, systems or legal obligations. The published version will show the date it was last updated. Where a significant change affects how your information is used, we will provide appropriate notice.
Preparation notes — remove before publishing
This is a complete replacement draft, not a verification of current technical or legal arrangements. Resolve the marked sections and retention instruction before publishing. Do not delete the existing page until the replacement is ready.
Retention evidence: BABCP’s Clinical Wills Policy reports its legal advisers’ suggestion of seven years after the last session and notes that contractual obligations may specify a period. Its Data Protection guidance also advises independent therapists to set and explain a retention period and check relevant obligations. Seven years is therefore a proposed practice policy, not a universal statutory deadline, and it should not automatically be applied to every kind of enquiry or record.
- https://babcp.com/about/who-are-babcp/our-policies/clinical-wills-policy/
- https://babcp.com/therapists/data-protection/
- https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-are-the-conditions-for-processing/
- https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/
- https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/
Mailchimp configuration: Check whether email open and click tracking is enabled. If it is, describe the information collected, its purpose, retention and applicable consent arrangements before resuming newsletters. Do not assume an old mailing list contains current, valid marketing permissions.