Privacy Policy

Last updated: October 2026

Bloom Practice Ltd ("Bloom", "we", "us", "our") is committed to protecting your privacy. This policy explains how we collect, use, store, and protect your personal data when you use our practice management platform at trybloom.co.uk.

We are registered in England and Wales under company number 17092851, with our registered office at 128 City Road, London, EC1V 2NX. Bloom acts as Controller for Personal Data it processes for its own purposes, including account administration, billing, security, support and operation of its business. Where Bloom processes client records on behalf of a Practitioner, the Practitioner acts as Controller and Bloom acts as Processor.

Who this policy applies to

This policy applies to two types of users:

• Practitioners - therapists, counsellors, practices, organisations and other professionals who create a Bloom account or use the Services. In this policy, we refer to them collectively as “Practitioners”.
• Clients and prospective clients - individuals whose Personal Data is entered into or collected through Bloom by a Practitioner. For this data, the Practitioner normally acts as Controller and Bloom acts as Processor.

What data we collect

From practitioners

When you sign up and use Bloom, we collect:

• Your name, email address, and phone number
• Your practice name, address, and website
• Your professional details (session types, fees, availability)
• Payment account identifiers and transaction information received from Stripe. Bloom does not receive full payment-card details
• Your profile photo and practice logo (if uploaded)
• Billing records, subscription details and payment status
• Support requests and communications with Bloom
• Account authentication, audit logs and security events
• Technical data: IP address, browser type and device information
• Usage data: pages visited, features used and session duration
• Information received from connected services where you enable an integration

From clients

When a Practitioner uses Bloom, Bloom may process the following information on the Practitioner’s documented instructions:

• Your name, email address, and phone number
• Appointment dates, times, and session types
• Payment records and amounts
• Your signed counselling agreement
• Any information provided through booking forms or enquiries. If your therapist asks for a card when you book, the details you enter are held for up to 35 minutes while you save the card, then attached to your client record or deleted.
• Communications and documents uploaded or exchanged through the Services
• Health, therapy and other Special Category Data entered by the Practitioner
• Safeguarding-related information where entered by the Practitioner
• Information relating to children and young people where the Practitioner provides services to them

Session notes

A Practitioner may create session notes within Bloom. Session notes are encrypted in transit and at rest. Access is restricted according to the technical design of the relevant feature and the permissions configured by the Practitioner. Bloom personnel may access Personal Data only where authorised and reasonably necessary for security, support, legal compliance or operation of the Services.

How we use your data

We use practitioner data to:

• Provide, secure and maintain the Bloom platform
• Process account registration, authentication and access management
• Administer subscriptions, billing and transactions
• Send account, billing, security and service communications to Practitioners
• Respond to support requests and service communications
• Prevent fraud, investigate misuse and protect the security of the Services
• Analyse service usage and improve the platform, using aggregated or minimised data where reasonably practicable
• Comply with legal and regulatory obligations and establish, exercise or defend legal claims

Bloom processes Client Data only to:

• Provide, secure and support the Services on the Practitioner’s behalf
• Follow the Practitioner’s documented instructions
• Facilitate appointments, booking confirmations, reminders, communications, payments, agreements and other practice administration
• Comply with legal obligations applying to Bloom and exercise Bloom’s rights and obligations under the Terms and DPA

We do not use your data to:

• Use Client Data, therapy records or identifiable Practitioner Content to train general-purpose artificial intelligence or machine-learning models
• Sell to third parties
• Target advertising
• Profile you for marketing purposes

Legal basis for processing

Where Bloom acts as Controller, we process Personal Data on the following legal bases under UK GDPR:

• Contract - to create and manage Practitioner accounts, provide the subscribed Services and administer billing
• Legitimate interests - to secure and improve the Services, provide support, prevent fraud, administer our business and communicate about accounts, where those interests are not overridden by individual rights
• Legal obligation - to comply with tax, accounting, regulatory and other legal requirements
• Consent - where Bloom specifically asks for consent, such as for optional non-essential cookies or marketing preferences. Consent may be withdrawn at any time

For Client Data processed on behalf of a Practitioner, Bloom acts as Processor and processes the data under the Practitioner’s documented instructions. The Practitioner is responsible for identifying the applicable Article 6 lawful basis and, where relevant, the Article 9 condition for Special Category Data.

Bloom does not currently use Personal Data to make solely automated decisions that produce legal or similarly significant effects.

Data storage and security

Bloom’s primary hosting infrastructure is located in the European Economic Area. Some suppliers may process limited Personal Data in other countries. Where Personal Data is transferred outside the UK, Bloom uses an applicable adequacy regulation or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum, together with any required transfer risk assessment.

Bloom uses appropriate technical and organisational measures to protect Personal Data. These measures include, where appropriate:

• Encryption in transit and at rest
• Access controls and secure authentication
• Logging, monitoring and backups
• Security updates and vulnerability management
• Measures to prevent unauthorised access, misuse or loss
• Regular security review and testing

Bloom uses third-party providers to support hosting, communications, analytics, security, payments and optional integrations:

Where a provider processes Client Data on Bloom’s behalf, Bloom appoints it as a Sub-processor in accordance with the DPA. Some providers, such as payment processors, may act as separate Controllers for parts of their processing. Optional integrations selected by a Practitioner may also be subject to separate terms and privacy notices between the Practitioner and the relevant provider.

Google Maps practice address suggestions

Google Maps and Places provide UK address suggestions in Settings, Practice, Details. Google Maps loads when you use the practice address field. Address searches go directly from your browser to Google, which receives the search text you type and technical request information such as your IP address and browser details.

This address lookup does not send client records or session notes to Google. You can edit a suggested address or enter your address manually. Bloom saves the address in your practice record when you select Save changes.

Google's Privacy Policy applies to its processing of address searches and technical information, including its use and retention of that information and processing outside the UK or EU. Use of Google Maps features and content is also subject to the Google Maps End User Additional Terms of Service. Google Maps processes data as an independent controller under Google's Controller-Controller Data Protection Terms.

Data retention

Bloom retains Personal Data only for as long as reasonably necessary for the relevant purpose, subject to the Terms, DPA and applicable law.

Practitioner Content is available for export for 60 days after the Subscription ends, unless a different period is agreed in writing or access must be restricted for security or legal reasons.

After the export period, Bloom will, at the Practitioner’s choice and where technically and legally practicable, return or securely delete Personal Data processed on the Practitioner’s behalf. For these purposes, deletion may be completed through permanent erasure or irreversible anonymisation, provided that no individual remains identified or identifiable and re-identification is not reasonably possible.

The Practitioner determines the appropriate retention period for client and clinical records, including session notes and signed agreements. Bloom does not independently determine clinical retention periods.

Personal Data may remain in protected backups until expiry through Bloom’s normal backup cycle. Backup data is not used for ordinary business purposes and remains subject to appropriate safeguards.

Bloom retains its own billing, security, support and legal records only for as long as reasonably necessary for the relevant purpose, including applicable tax, accounting, fraud-prevention and legal-claim periods.

Your rights

Depending on the circumstances and legal basis, you may have the right to:

• Access - request a copy of your personal data
• Rectification - ask us to correct inaccurate data
• Erasure - ask us to delete your data (subject to legal retention requirements)
• Restriction - ask us to restrict processing of your data
• Portability - receive your data in a machine-readable format
• Object - object to processing based on legitimate interests

For Personal Data Bloom controls, email hello@trybloom.co.uk. Bloom will respond without undue delay and normally within one month. This period may be extended where permitted by law, for example where a request is complex or numerous, and Bloom will explain any extension.

For Client Data, the Practitioner is normally the Controller. Clients should contact the relevant Practitioner about access, correction, restriction, objection, portability or deletion of their records. If Bloom receives the request, Bloom may acknowledge it, refer it to the Practitioner and provide reasonable assistance under the DPA. The Practitioner remains responsible for verifying the requester, determining the response and meeting applicable statutory time limits.

Cookies

Bloom uses essential cookies and similar technologies where necessary to provide and secure the Services.

Essential cookies - used for authentication, security, session management and core platform functions.

PostHog analytics - used to understand how the platform is used and improve the Services. Depending on configuration, analytics data may include online identifiers, device information and usage events.

Google Analytics - used on Bloom’s marketing pages to measure visits and conversion activity. Google Analytics may collect online identifiers, device and usage information and may set cookies such as _ga. Bloom does not intentionally send Client Data or therapy records from within the Bloom platform to Google Analytics.

Bloom may run advertising campaigns based on generic search terms. Bloom does not use Client Data or therapy records for advertising, retargeting or audience building.

Children

Bloom Accounts are intended for Practitioners aged 18 or over. Practitioners may use Bloom to process Personal Data relating to children and young people. In those circumstances, the Practitioner acts as Controller and is responsible for determining the lawful basis, any applicable Article 9 condition, the appropriate transparency information, and any consent or parental-authority requirements. Bloom processes that data as Processor under the DPA.

Changes to this policy

We may update this policy from time to time. Where changes are material, we may notify Practitioners by email or through the Services. The “last updated” date at the top of this policy identifies the current version.

Data breaches

Where Bloom acts as Processor and becomes aware of a Personal Data Breach affecting Client Data, Bloom will notify the relevant Practitioner without undue delay and provide reasonable assistance in accordance with the DPA. The Practitioner, as Controller, is responsible for deciding whether notification to the ICO or affected individuals is required.

Where Bloom acts as Controller, Bloom will notify the ICO without undue delay and, where feasible, within 72 hours after becoming aware of a breach where notification is required by law. Bloom will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms, subject to applicable legal exceptions.

Contact us

If you have questions about this policy or Personal Data controlled by Bloom, contact us using the details below. For questions or requests about Client Data, clients should normally contact the relevant Practitioner first.

Email: hello@trybloom.co.uk

Address: Bloom Practice Ltd, 128 City Road, London, EC1V 2NX

You have the right to complain to the Information Commissioner’s Office if you believe your Personal Data has been handled unlawfully. You may contact Bloom or the relevant Practitioner first so the issue can be investigated, but you are not required to do so before contacting the ICO.