Privacy, in plain language.

Last updated 21 July 2026

Who we are

SessionBase is a practice-management tool for counsellors and therapists, made in Cornwall, United Kingdom. In this policy, "we" and "us" mean SessionBase; "you" means the therapist or practice using it, and "your clients" means the people you see.

The two kinds of data here

It helps to separate two things. First, your account data : the information you give us to use SessionBase, where we are the data controller. Second, your clients' data : the records you keep inside SessionBase, where you are the controller and we are your processor, acting only on your instructions.

What we collect about you

• Your name, email and practice details, so we can create and run your account.
• Billing information, processed securely by our payment provider. We never store full card numbers.
• Basic usage and device information, to keep the service secure and working well.
• Messages you send us, so we can support you and reply.

What you store about your clients

You decide what client information lives in SessionBase: typically contact details, appointments, invoices, signed documents and your private session notes. We store and protect it on your behalf. We do not use it for anything other than providing the service to you, and we never sell it or use it for advertising.

Why we're allowed to hold it

For your account data, our lawful bases are the contract between us (to provide the service) and our legitimate interest in keeping SessionBase secure. For your clients' data, the lawful basis sits with you as the controller; SessionBase gives you the tools to record consent and manage those bases.

How long we keep it

Account data is kept while you have an account and for a short period afterwards, then deleted. Your clients' records are kept for as long as you choose, guided by the retention tracking built into SessionBase and BACP guidance. When you delete a record, or close your account and confirm deletion, it is removed from active systems and then from backups in the normal backup cycle.

Who we share it with

Only the trusted providers that make the service run, meaning hosting, email and SMS delivery, and payment processing, each bound by their own data-protection obligations. We do not sell your data or your clients' data to anyone, for any reason.

Where it's held

Data is stored on secure infrastructure within the UK and EU. Where any provider processes data outside the UK, we ensure appropriate safeguards are in place as required by law.

Your rights

• Access a copy of the personal data we hold about you.
• Correct anything that's wrong, or ask us to complete what's incomplete.
• Ask us to delete your account data, subject to any legal obligations.
• Export your data, and your clients' data, whenever you like.
• Object to, or restrict, certain processing.

Your clients can exercise their rights directly with you as their therapist; SessionBase gives you export and erasure tools to help you respond.

Cookies

We use only the cookies needed to keep you signed in and the service secure, plus privacy-respecting analytics to understand how SessionBase is used. We don't use advertising or third-party tracking cookies.

Changes to this policy

If we make a material change, we'll let you know in the app or by email before it takes effect. The date at the top always shows the current version.

Getting in touch

For anything about your privacy or this policy, email privacy@sessionbase.co.uk. You also have the right to complain to the Information Commissioner's Office (ICO), though we'd always hope to put things right first.