Practitioner Online With Device Archiving Hero

Compliance Confidence Assessment

Fifteen minutes to see exactly where your practice keeps client data it can no longer explain, and why that costs you sleep.

Step 1 of 2

Your Compliance Competence Diagnostic

Seven statements about how your practice understands, lives, and uses its compliance obligations. Score each one honestly; high for agreement, low for disagreement or uncertainty. The shape that emerges is rarely what practitioners expect - and that's usually the point.

Neutral
Neutral
Neutral
Neutral
Neutral
Neutral
Neutral
Step 1Step 2

Running on assumption, not paperwork Your consent forms say the right things. Your notebooks, your Google Form, and your old assistant's spreadsheet say something else entirely, and nobody's checked which version wins.

Practitioner reading carefully through content on a laptop
Trust breaks when compliance feels disconnected from care

The phrase 'as long as necessary' is doing a lot of work you haven't checked

Your consent form promises to keep enquiry details for as long as necessary.

Necessary for what, exactly, and until when. Nobody in the building could tell you. Not even you, and you wrote the form.

A client asks what happened to her intake notes from 2019.

You know the notes exist somewhere in the house, the way you know the good scissors exist. Nobody has seen either since spring.

Talk it through: simple quick connection:

The assessment gives every piece of client data a retention date with a reason attached to it, so 'as long as necessary' stops being a promise and starts being a written answer waiting for the question.

Deeper Dive Light Bubbles

compliance confidenceA Deeper Dive

bacpfhtgmcgcmtreputationappealtrustratingsreferalitecukcpyapbcytcnhcinlptagdprethicsconfidentialityicfac

The question you dread isn't a fine, it's a straight question

Nobody imagines the ICO knocking at half past eight some random morning.

What you do imagine, at three in the morning, is a client asking plainly what data you hold on her.

And you, scrolling through three notebooks and a Google Form, trying to build an answer out of scraps nobody meant to keep.

The fear was never the fine. It was not knowing the answer to a question you should be able to answer standing up, holding a cup of tea.

The assessment hands you, in advance, exactly what you'd say if she asked you today, plus a written record to back it up.

The steps explained

If you were to run this as a professional marketer inside your practice, this kind of process would naturally smooth the path for you.

GDPR Compliance Confidence Assessment

Here's the whole thing laid bare: a walk through what you actually collect, why you keep it, and whether your paperwork matches what happens in real life. No jargon, no fear tactics, just a clear-eyed look so you can practise the way you always meant to.

  1. List everything you hold Write down every place client data lives, that includes your booking system, your notes app, that spreadsheet you forgot about, and the WhatsApp thread from 2021. This step takes longer than you think because most practitioners genuinely don't remember every place they've put things.
  2. Check your lawful basis For each type of data, name why you're allowed to have it, consent, contract, or legitimate interest. Be honest rather than hopeful. If you can't say why in one sentence, that's your answer already.
  3. Read your own privacy notice Open it and read it as if you were a stranger booking a first session. Does it match what you actually do with data, not what you meant to do eighteen months ago when you copied a template.
  4. Test your consent trail Pick three clients and trace how their consent was given and stored, this is fiddly and often reveals gaps nobody meant to leave. Fix what you find rather than explaining it away.
  5. Check retention and deletion Look at how long you keep records after a client leaves and whether you ever actually delete anything. Most practitioners keep everything forever out of nervousness, which is its own kind of risk.
  6. Get a second pair of eyes Once you've done your own honest pass, bring in someone outside your practice to check it properly, you're too close to it now to see the gaps clearly. A proper external review is the sensible next step for any practitioner ready to trust their own systems again.

Good to know: Every practice has its own quirks - history, team, specialisms, triumphs, reputation, ambition and more - that offer unique marketing strengths. Happy to help you work out your steps, if it'd be useful.

Abstract shadow of a practitioner in contemplative pose
The conversation that maps what’s possible from exactly where you are

More posting, tighter grid, better lighting, same booking dip

Bookings have slowed, and you've decided it's the content, so you've posted more of it.

Better lighting. A tighter grid. A caption you agonised over on a Sunday you'd meant to have off.

Meanwhile your booking system holds health details on a server whose terms nobody has opened since you signed up, back when the sofa was new.

The assessment checks what your booking software does with client health data, against what the sign-up email promised, and gives you a plain answer about where that information lives.

Somewhere between the form, the WhatsApp group and the spreadsheet, a client list goes missing

The intake form feeds one list.

The WhatsApp group holds another version, in a client's replies from March.

The spreadsheet your old assistant built sits on a laptop she took with her when she left for the coast.

None of this is carelessness. It's what happens when a practice grows faster than its own paperwork can keep up with it.

The assessment maps every place your client list lives, and closes the ones that shouldn't be open.

Coats at a party, and the question of who's watching them

Client data behaves like coats piled on a bed at a party.

Everyone assumes a client is keeping an eye on the pile.

Nobody volunteered for the job. Nobody checks whose coat has gone until the owner comes looking for it.

The assessment names, in plain terms, who is responsible for which pile, so 'who's watching this' stops being a shrug and starts being a name on a list.

Knowing where everything sits is the whole of the relief

Once you know where every piece of client information sits, and why it's allowed to sit there, the worry in the back of your head goes still.

What takes its place is smaller than relief and more useful: the ability to answer a question plainly, the first time you're asked it.

No scrolling, no notebooks, no lying awake reconstructing 2019.

You don't need to feel calm about your data. You need to be able to answer for it, in one breath, standing up.

The assessment gets you to that one breath, with a clear record behind every answer you give.

Get the fifteen-minute assessment and know exactly what you'd say if a client asked today. start your assessment

Therapy Space

You Found This Page For A Reason.

Most practitioners who do are carrying something they haven't quite named yet. The discovery call is good at that - finding the name for it, over a coffee, without any pressure to do anything about it immediately. Milk and sugar?

Find your Sunlight  ▶