Privacy policy

 

Privacy Policy

Last updated: 28 September 2026

1. Who We Are

Neuro-Stitch is operated by Heidi Smith, trading as Neuro-Stitch as a sole trader.

For the purposes of UK data protection law, Heidi Smith trading as Neuro-Stitch is the Data Controller for personal information processed in connection with Neuro-Stitch's services.

Data Controller: Heidi Smith
Trading as: Neuro-Stitch
Email: heidi.smith@neuro-stitch.com
Website: neuro-stitch.com

This Privacy Policy explains how Neuro-Stitch collects, uses, stores, shares and protects personal information when you:

  • visit or use the Neuro-Stitch website;

  • enquire about a service;

  • receive coaching, workplace strategy coaching, consultancy, training or support;

  • use The ADHD Admin Hub or another Neuro-Stitch service;

  • attend a workshop, webinar or event;

  • purchase a product or digital resource;

  • join the Neuro-Stitch mailing list;

  • communicate with Neuro-Stitch by email, telephone, social media or another communication channel; or

  • otherwise interact with Neuro-Stitch.

Neuro-Stitch processes personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), Data Protection Act 2018 and, where applicable, the Privacy and Electronic Communications Regulations 2003 (PECR).

2. Our Approach to Your Privacy

Your privacy and confidentiality are important to Neuro-Stitch.

We aim to make sure that personal information is:

  • collected fairly and transparently;

  • only collected where it is relevant and necessary;

  • used only for appropriate purposes;

  • kept accurate where reasonably possible;

  • stored securely;

  • only retained for as long as necessary; and

  • only shared where there is an appropriate reason for doing so.

Because some Neuro-Stitch services involve ADHD, neurodivergence, disability and workplace support, clients may choose to share particularly sensitive information. Additional care is taken when handling this information.

3. Personal Information We May Collect

The information collected depends on how you interact with Neuro-Stitch.

It may include:

Contact information

  • Name

  • Email address

  • Telephone number

  • Address

  • Emergency contact details, where appropriate

Client and service information

  • Enquiries and correspondence

  • Appointment and booking information

  • Coaching questionnaires

  • Coaching session notes

  • Action plans

  • Coaching goals and objectives

  • Information you voluntarily share during coaching or support

  • Workplace challenges and support requirements

  • Information relating to reasonable adjustments

  • Access to Work information or award details where relevant

  • Feedback about services

Transaction and financial information

  • Billing information

  • Invoices

  • Payment status and confirmation

  • Purchase history

  • Information necessary for accounting and tax purposes

Neuro-Stitch does not normally directly store full debit or credit card details where payment is processed through a third-party payment provider.

Website and technical information

Depending on your cookie choices and how you use the website, information may include:

  • IP address

  • Device and browser information

  • Website activity

  • Cookie identifiers

  • Pages viewed

  • Information relating to website purchases or accounts

4. Special Category Personal Data

Some information clients voluntarily share with Neuro-Stitch may be classed as special category personal data under UK data protection law.

This may include information relating to:

  • physical or mental health;

  • ADHD, autism or other neurodivergence;

  • disability;

  • health conditions affecting work or daily life;

  • workplace adjustments and disability-related support needs;

  • Access to Work support arrangements; and

  • other health or wellbeing information relevant to coaching or support.

Special category data receives additional protection under UK data protection law.

Neuro-Stitch will only process this information where:

  1. there is an appropriate lawful basis under Article 6 UK GDPR; and

  2. an appropriate condition under Article 9 UK GDPR applies.

For special category information voluntarily provided as part of coaching or related support, Neuro-Stitch may rely on explicit consent under Article 9(2)(a) UK GDPR, where appropriate.

Where explicit consent is relied upon, it will be requested separately and recorded. You can withdraw that consent at any time by contacting Neuro-Stitch.

Withdrawal of consent does not affect processing that was lawful before consent was withdrawn.

If withdrawing consent means Neuro-Stitch can no longer process information that is necessary to provide a particular service safely or appropriately, this may affect our ability to continue providing that service. We will explain this to you where applicable.

Other Article 9 conditions may apply in limited circumstances where permitted or required by law.

Neuro-Stitch aims to collect only special category information that is relevant to the service being provided.

5. Coaching and Support Services

Where you receive coaching, workplace strategy coaching, consultancy, training, Access to Work-related support, Virtual Admin support or another Neuro-Stitch service, information may include:

  • session notes;

  • coaching goals;

  • agreed actions;

  • information you voluntarily share;

  • correspondence;

  • workplace information;

  • reasonable adjustment information;

  • relevant disability or health information;

  • Access to Work information; and

  • emergency contact details where appropriate.

Coaching notes are used to support continuity and quality of the coaching relationship.

Sessions are not routinely recorded but are transcribed. If a session is to be recorded or transcribed, this will be explained in advance and an appropriate lawful basis will be identified.

Neuro-Stitch will not routinely disclose the content of coaching sessions to an employer, funder, family member or other third party simply because they are paying for the service.

Where coaching is funded by an employer, Access to Work or another organisation, any reporting or information-sharing requirements will be explained and, where appropriate, agreed before information is shared.

Information may also be disclosed where required by law or where there is an appropriate safeguarding, legal or vital-interest reason to do so.

6. Emergency Contact Information

Where Neuro-Stitch collects emergency contact information, it will only be used where reasonably necessary in connection with a serious safeguarding, welfare or safety concern or another appropriate emergency.

Emergency contact details will not be used for marketing.

7. How We Collect Personal Information

We may collect information directly from you when you:

  • complete an enquiry or contact form;

  • contact Neuro-Stitch by email, telephone or social media;

  • book or purchase a service;

  • complete a coaching questionnaire or onboarding document;

  • participate in a coaching or support session;

  • purchase from the Neuro-Stitch website;

  • join the mailing list;

  • attend a workshop, webinar or event;

  • provide feedback; or

  • otherwise communicate with Neuro-Stitch.

Information may also be received from another organisation where appropriate, for example an employer, Access to Work, referral organisation or service provider.

Where personal information is obtained from someone other than you, Neuro-Stitch will provide appropriate privacy information where required by UK data protection law.

8. How and Why We Use Personal Information

Neuro-Stitch may use personal information to:

  • respond to enquiries;

  • assess whether a service is suitable;

  • enter into and administer contracts;

  • deliver coaching and other services;

  • arrange appointments;

  • maintain appropriate client records;

  • communicate about sessions and services;

  • process payments and invoices;

  • fulfil orders;

  • provide customer support;

  • meet accounting and tax obligations;

  • manage Access to Work-related administration;

  • maintain business records;

  • protect the security of systems and services;

  • deal with complaints or disputes;

  • establish, exercise or defend legal claims;

  • meet legal or regulatory obligations;

  • send marketing where legally permitted; and

  • improve and administer Neuro-Stitch services.

9. Lawful Bases for Processing

Under UK GDPR, Neuro-Stitch must have a lawful basis for processing personal information.

Depending on the purpose, this may be:

Contract

Where processing is necessary to enter into or perform a contract with you.

For example:

  • providing coaching or other services you have purchased;

  • arranging appointments;

  • communicating about your service;

  • processing payments; or

  • supplying products.

Legitimate Interests

Where processing is reasonably necessary for Neuro-Stitch's legitimate business interests and those interests are not overridden by your rights and freedoms.

This may include:

  • responding to enquiries;

  • maintaining appropriate business and client records;

  • administering the business;

  • maintaining security;

  • preventing fraud;

  • managing complaints;

  • improving services; and

  • protecting Neuro-Stitch's legal rights.

Where Neuro-Stitch relies on legitimate interests, the impact on the individual will be considered.

Legal Obligation

Where information must be processed to comply with a legal obligation, including relevant tax, accounting or regulatory requirements.

Consent

Where you have actively agreed to a particular use of your information, such as certain marketing activities.

Consent can be withdrawn at any time.

Special Category Data

Processing special category information requires both an Article 6 lawful basis and an Article 9 condition, as explained in Section 4.

10. Confidentiality and Coaching

Information shared during coaching is treated as confidential.

There may, however, be limited circumstances where information needs to be disclosed, including:

  • where you have requested or authorised disclosure;

  • where disclosure is required by law;

  • where necessary to establish, exercise or defend legal claims;

  • where there is an appropriate safeguarding or serious safety concern; or

  • where another lawful basis for disclosure applies.

Where appropriate and lawful, Neuro-Stitch will aim to discuss disclosure with you before information is shared.

11. Professional Supervision

Neuro-Stitch may participate in professional coaching supervision, mentoring or professional development to support safe, ethical and effective practice.

Where client situations are discussed for professional supervision or development, Neuro-Stitch will aim to minimise the personal information disclosed and, where reasonably possible, anonymise or pseudonymise information so that the client is not identifiable.

Supervision arrangements will be subject to appropriate professional confidentiality.

12. Service Providers and Data Processors

Neuro-Stitch uses third-party services to operate the business and deliver services.

These may include providers of:

  • website and ecommerce services;

  • email and office software;

  • cloud storage;

  • appointment scheduling;

  • video conferencing;

  • accounting and invoicing;

  • payment processing;

  • mailing lists and email marketing;

  • electronic document/signature services;

  • transcription or meeting-support tools;

  • website hosting and domain services; and

  • other administrative and business software.

Current providers may include services such as Shopify, Microsoft 365, OneDrive, Calendly, MailerLite, Tactiq, Canva, DocHub, GoDaddy and accounting/payment providers used by Neuro-Stitch.

This list may change as Neuro-Stitch's systems change. Neuro-Stitch reviews services that process personal information and aims to ensure appropriate contractual, confidentiality, security and data-protection arrangements are in place.

Where a service provider acts as a data processor on behalf of Neuro-Stitch, they may only process personal information in accordance with the applicable arrangements and instructions.

13. Artificial Intelligence and Technology

Neuro-Stitch may use AI-assisted and other digital tools for appropriate business purposes such as administration, planning, drafting, organisation and productivity.

Neuro-Stitch remains responsible for considering confidentiality and data protection when using these tools.

Personally identifiable client information, confidential coaching information or special category information will not be entered into an AI service unless Neuro-Stitch has assessed that there is an appropriate lawful basis, purpose, contractual arrangement and level of data protection and security for that use.

Where possible, information will be anonymised or minimised before technology is used.

AI will not be used by Neuro-Stitch to make solely automated decisions about individuals which produce legal or similarly significant effects.

14. Marketing

Neuro-Stitch may send marketing communications about services, resources, events or other relevant Neuro-Stitch activity where permitted by UK data protection law and PECR.

Where consent is required, you will be asked to actively opt in.

In limited circumstances, Neuro-Stitch may rely on the soft opt-in permitted by PECR for existing customers where all applicable requirements are met.

You can unsubscribe from marketing at any time using the unsubscribe option in marketing emails or by contacting Neuro-Stitch.

Opting out of marketing will not prevent Neuro-Stitch from sending necessary service-related communications, such as appointment, contract, invoice or purchase information.

Neuro-Stitch does not sell personal information to third parties.

15. Cookies and Website Technologies

The Neuro-Stitch website uses cookies and similar technologies.

Some cookies are strictly necessary for the website to function and do not require consent.

Other cookies, including certain analytics, advertising or tracking technologies, will only be used where appropriate consent has been obtained.

Where consent is required, non-essential cookies should not be placed before you have made your choice.

You can manage your preferences through the website's cookie settings.

Further information about cookies used by the website may be provided through Neuro-Stitch's cookie settings or cookie notice.

16. Sharing Personal Information

Neuro-Stitch does not sell personal information.

Personal information may be shared where necessary with:

  • service providers processing information on Neuro-Stitch's behalf;

  • payment providers;

  • accountants or other professional advisers;

  • technology and cloud-service providers;

  • delivery or fulfilment providers where physical products are purchased;

  • employers, funders or organisations where an appropriate information-sharing arrangement applies;

  • regulators, courts, law enforcement or public authorities where legally required; or

  • another party where you have specifically requested or authorised disclosure.

Only information reasonably necessary for the relevant purpose will be shared.

17. International Transfers

Some technology providers used by Neuro-Stitch may store or process personal information outside the UK.

Where this results in a restricted international transfer under UK data protection law, Neuro-Stitch will take appropriate steps to ensure that a lawful transfer mechanism applies.

Depending on the circumstances, this may include:

  • UK adequacy regulations;

  • the UK International Data Transfer Agreement (IDTA);

  • the UK Addendum to approved contractual clauses; or

  • another lawful transfer mechanism available under UK data protection law.

18. Security

Neuro-Stitch takes reasonable and appropriate technical and organisational measures to protect personal information.

Depending on the system, measures may include:

  • password protection;

  • multi-factor authentication;

  • device security;

  • access controls;

  • encrypted services;

  • secure cloud storage;

  • software updates; and

  • limiting access to information to those who need it.

No electronic system can be guaranteed to be completely secure, but Neuro-Stitch aims to use safeguards appropriate to the nature and sensitivity of the information being processed.

19. How Long We Keep Personal Information

Neuro-Stitch will not keep personal information for longer than reasonably necessary.

Retention depends on the type of information, why it is held and any relevant legal, insurance, contractual or professional requirements.

As a general guide:

  • Coaching, consultancy and support records: up to 7 years following the end of services, subject to review and any applicable insurance/professional requirements.

  • Financial and tax records: generally retained in accordance with applicable UK tax and accounting requirements.

  • Enquiries that do not become clients/customers: generally up to 12 months unless there is a reason to retain them for longer.

  • Marketing records: while you remain subscribed and/or for as long as necessary to maintain appropriate records of consent and opt-out preferences.

  • Website/order information: retained for as long as reasonably necessary for the transaction and applicable legal/business requirements.

Information may need to be retained for longer where necessary for legal proceedings, regulatory requirements, insurance matters or the establishment, exercise or defence of legal claims.

Neuro-Stitch periodically reviews retained information and securely deletes or anonymises information that is no longer required.

20. Personal Data Breaches

A personal data breach may include personal information being accidentally or unlawfully lost, destroyed, altered, disclosed or accessed without authorisation.

If Neuro-Stitch becomes aware of a suspected personal data breach, it will assess and document the incident and take appropriate steps to limit potential harm.

Where a breach is required to be reported to the Information Commissioner's Office, Neuro-Stitch will do so without undue delay and, where feasible, within 72 hours of becoming aware of it.

Where a breach is likely to result in a high risk to the rights and freedoms of affected individuals, Neuro-Stitch will also inform those individuals without undue delay where required by law.

Neuro-Stitch will maintain appropriate records of personal data breaches, including those that do not require notification to the ICO.

21. Your UK Data Protection Rights

Under UK data protection law, you may have the following rights depending on the circumstances:

Right to be informed

You have the right to clear information about how your personal information is collected and used.

Right of access

You can ask whether Neuro-Stitch holds personal information about you and request a copy of that information. This is commonly called a Subject Access Request (SAR).

Right to rectification

You can ask Neuro-Stitch to correct inaccurate or incomplete personal information.

Right to erasure

In certain circumstances, you can ask for personal information to be deleted.

This right is not absolute. Information may need to be retained where there is a lawful reason for doing so.

Right to restrict processing

In certain circumstances, you can ask Neuro-Stitch to restrict how your information is used.

Right to data portability

In certain circumstances, you may have the right to receive personal information you provided in a structured, commonly used and machine-readable format or request its transfer to another organisation.

Right to object

In certain circumstances, you may object to processing based on legitimate interests.

You have an absolute right to object to your personal information being used for direct marketing.

Rights relating to automated decision-making

You have rights relating to certain solely automated decisions that have legal or similarly significant effects.

Neuro-Stitch does not currently carry out this type of solely automated decision-making.

Right to withdraw consent

Where processing relies on consent, you may withdraw that consent at any time.

22. Making a Data Protection Request

To exercise your data protection rights, contact:

heidi.smith@neuro-stitch.com

You do not need to use particular wording or complete a particular form to make a request.

Neuro-Stitch may ask for reasonable information to confirm your identity where necessary before disclosing personal information.

Requests will be handled without undue delay and within the timescales required by UK data protection law.

23. Complaints

If you are concerned about how Neuro-Stitch has used your personal information, please contact:

Heidi Smith
Email: heidi.smith@neuro-stitch.com

Neuro-Stitch will investigate the concern and respond appropriately.

You also have the right to complain to the UK's data protection regulator:

Information Commissioner's Office (ICO)
Website: ico.org.uk
Telephone: 0303 123 1113

24. Children's Information

Neuro-Stitch's services and website are not generally intended for children and Neuro-Stitch does not knowingly collect children's personal information through its general website services.

If Neuro-Stitch becomes aware that personal information relating to a child has been collected inappropriately, appropriate steps will be taken.

If Neuro-Stitch offers a service involving a person under 18 in the future, the relevant privacy, consent and safeguarding arrangements will be considered separately.

25. Third-Party Websites

The Neuro-Stitch website may contain links to third-party websites or services.

Neuro-Stitch is not responsible for how independent third parties process information when you use their websites or services. You should review their privacy information where appropriate.

26. Changes to This Privacy Policy

Neuro-Stitch may update this Privacy Policy to reflect changes to services, technology, business practices or legal and regulatory requirements.

The latest version will be published on the Neuro-Stitch website and the Last updated date will be amended.

Where a change materially affects how existing personal information is processed, additional steps will be taken where required by law.

27. Contact

If you have questions about this Privacy Policy, the information Neuro-Stitch holds about you or your data protection rights, please contact:

Heidi Smith
Trading as: Neuro-Stitch
Email: heidi.smith@neuro-stitch.com

For UK data protection purposes:

Data Controller: Heidi Smith trading as Neuro-Stitch