Privacy Policy

This policy explains what personal data The Emily Gray Practice collects, why, and how it is looked after.

The Emily Gray Practice is a sole-practitioner coaching business. The data controller for the purposes of UK GDPR is Emily Gray, The Emily Gray Practice, Malvern, Worcestershire.

What data is collected

  • Enquiries: if you send a message through the contact form, I hold your name, email address, and the content of your message.
  • Bookings: if you book a session, your name, email, phone number, and the type of session booked are held by Cal.com, the booking platform.
  • Payments: if you pay for a session, the payment is processed directly by Stripe. Card details never reach me or this website.
  • Session notes: if you become a client, notes from our sessions are kept separately from this website and its systems, securely and confidentially, and are never shared with any of the processors listed below.
  • Newsletter: if you subscribe, your email address is held by Formspree until a dedicated mailing list tool is in use.

Why this data is used

  • Contract: to provide the session or service you have booked.
  • Legitimate interests: to respond to enquiries and administer the practice.
  • Consent: for the occasional newsletter, which you can withdraw at any time by unsubscribing.

Who processes what

A small number of trusted services help run the practice. Each holds only what it needs to do its job.

  • Cal.com — the booking platform. Holds your name, email, phone, and the session type you chose. Hosted in the EU/US under standard contractual clauses.
  • Stripe — the payment processor. Holds the payment record. Card details never reach me. Hosted in the EU/UK/US under standard contractual clauses.
  • Google Calendar & Google Meet — the calendar reflection of your booking, and the video link for the session. Event titles are kept neutral; no clinical content is included. EU/US under standard contractual clauses.
  • Cloudflare — hosts this website and provides standard security and server logs. No personal data is stored beyond this.
  • Formspree — the contact form and newsletter sign-up. Holds messages and email addresses submitted through the forms. Hosted in the US under standard contractual clauses.

How long data is kept

  • Session notes are kept only for as long as is professionally appropriate, in line with recognised professional body guidance, and are then securely destroyed.
  • Payment and booking records are kept for the period required by UK tax law (currently up to seven years), after which they are deleted.
  • Contact form and newsletter data is kept only for as long as needed to respond to you, or for as long as you remain subscribed.

Cookies

This website does not use analytics, advertising, or tracking cookies. The booking and payment systems (Cal.com and Stripe) may set their own essential cookies when you use them, governed by their own privacy policies.

Your rights

Under UK GDPR, you have the right to:

  • ask what personal data is held about you, and request a copy (right of access);
  • ask for inaccurate data to be corrected (right to rectification);
  • ask for your data to be deleted, subject to legal retention requirements (right to erasure);
  • ask for how your data is used to be restricted (right to restriction);
  • receive your data in a portable format (right to data portability);
  • object to how your data is used (right to object);
  • complain to the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has not been handled properly.

Contact

To exercise any of these rights, or with any question about this policy, email hello@theemilygraypractice.com. I aim to respond within 30 days.

This policy may be updated from time to time. Last updated: 7 July 2026.