Your Information & Me

Privacy Policy – Zac Fine

For clients referred via laurahow.com

1. About This Notice

Zac Fine (“I”, “me”) is committed to protecting your privacy and handling your personal data responsibly. I comply with the UK General Data Protection Regulation (UK GDPR) and other relevant privacy and data protection laws.

This notice explains what information I collect about clients referred to me through laurahow.com, how I use it, how I keep it secure, and what rights you have.

This notice should be read alongside the main Laura How Counselling & Coaching Privacy Policy at laurahow.com/privacy-policy/, which explains how laurahow.com handles your data before your referral reaches me.

2. Data Controller

I, Zac Fine, am the independent data controller for all personal data I collect about you during our therapeutic work together, via email, in session recordings and transcripts, and in my clinical records.

Laura How Counselling & Coaching is a separate data controller for data collected through the laurahow.com website, booking forms, and payment systems. Once your referral reaches me, I become the data controller for your clinical information.

ICO registration number: ZB892313

3. Information I Collect

I collect personal information in the following ways:

Intake forms and questionnaires (personal history, goals for counselling, relationship information, health details where relevant)
Session content and notes
Emails, phone calls, and text messages between us
Session recordings (audio only, with your explicit written consent)

4. Session Recordings

With your explicit written consent, I may record sessions (audio only) to support the quality of your therapy. These recordings are used exclusively to:

Review the session in detail after it has taken place
Identify patterns and insights that may have been missed in the moment
Create comprehensive and accurate session notes
Ensure nothing important is overlooked

How Recordings Are Processed

When a session is recorded, the following steps take place:

The session is captured as audio only. No video is taken at any point.
The audio is uploaded to Vomo, a paid AI transcription service, for transcription. Vomo operates under encryption in transit and at rest, complies with GDPR, and stores recordings and transcripts on its secure servers.
The transcript is then processed using Claude, an AI tool provided by Anthropic, to assist in preparing session notes. Anthropic operates under a data processing agreement and does not use input data to train its AI models on the paid tier I use. Data is encrypted in transit and at rest.
The completed session notes are stored securely on encrypted, password-protected systems.

Recording Storage and Deletion

Audio recordings are held by Vomo only for as long as needed to produce the transcript, and are deleted thereafter in line with Vomo’s retention policy.
Transcripts and session notes contain client information necessary for clinical record-keeping, and are stored in encrypted, password-protected systems.
Access to recordings, transcripts, and notes is limited to me.
Recordings and transcripts are never shared with third parties or used for any purpose other than producing your session notes.

You will be asked to provide explicit written consent before any session is recorded. You have the right to decline recording, in which case I will use detailed note-taking instead. Your session quality will not be affected by this choice.

You can withdraw consent and request immediate deletion at any time by contacting zac@laurahow.com.

5. Legal Basis for Processing

For UK and EU clients, my legal bases under GDPR include:

Contract: to provide therapy services under our client agreement
Legitimate interest: to manage my practice and communicate with you
Legal obligation: to comply with safeguarding, tax, and legal reporting duties
Vital interests: to prevent serious harm
Explicit consent: for processing health data (special category data under Article 9) and for session recordings

For clients outside the UK/EU: I process personal data on the basis of your consent to receive my services and in accordance with this notice. While I cannot guarantee compliance with every country’s specific data protection laws, I apply the same standards of data security and privacy to all clients regardless of location.

6. How I Use Your Information

I use personal data to:

Provide counselling services
Communicate with you regarding bookings, sessions, and support
Meet legal and safeguarding obligations
Create session notes where recording consent has been provided

7. How I Store Your Information

Personal data is stored securely in password-protected, encrypted digital systems. I do not store paper records.

I use the following third-party services to deliver my work: Vomo (transcription), Anthropic/Claude (session note assistance), and Google Workspace (document storage and email). These providers may store data outside the UK or EU (including in the United States). Where this occurs, I rely on standard contractual clauses or equivalent safeguards to protect your data.

I may share personal information with:

Statutory bodies where legally required (e.g., safeguarding, court orders)
Emergency contacts in the event of serious risk
Professional advisers (e.g., legal, insurance) if required
My clinical supervisor, in anonymised form, to ensure ethical, safe, and effective practice. Your anonymity is maintained.

Where session recordings are used, audio is processed by Vomo and transcripts are processed by Anthropic/Claude as described above. Both act as data processors under their respective agreements. Audio recordings are never shared with any other third party.

Payments for sessions are processed by Stripe under their own privacy terms.

9. International Transfers

Your data may be transferred outside the UK/EU (for example, when using Vomo, Anthropic, Stripe, or Google Workspace). I use reputable service providers and safeguard such transfers through appropriate legal mechanisms (such as standard contractual clauses).

10. How Long I Keep Information

I retain personal data for as long as necessary to deliver services, comply with legal and professional obligations, or resolve disputes. Session notes are retained in line with my professional body’s requirements.

Session audio recordings held by Vomo are deleted in line with Vomo’s retention policy once transcription is complete.

11. Your Rights

UK and EU clients have rights under GDPR, including:

Access to your personal data
Correction of inaccurate information
Erasure of data in some circumstances
Restriction or objection to processing
Data portability (in some cases)
Right to withdraw consent (for session recordings and other consent-based processing)
Right to lodge a complaint with the Information Commissioner’s Office (ICO)

International clients may have equivalent rights under their local laws.

For session recordings, you may withdraw consent and request immediate deletion at any time by contacting zac@laurahow.com.

Raising a Concern with the Information Commissioner’s Office

If you have a concern about how your personal data has been handled, I would prefer to hear about it directly so I can put things right. Please contact me at zac@laurahow.com in the first instance. If you are not satisfied with my response, or you would prefer not to raise the concern with me directly, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF

Helpline: 0303 123 1113 Website: ico.org.uk

12. Marketing

I will not use your personal information for marketing purposes without your explicit consent. You can withdraw consent at any time.

13. Changes to This Notice

If I make changes that affect how your data is processed, I will notify you in advance where possible.

14. Contact

If you have questions or concerns about this notice or your data, please contact: zac@laurahow.com