Privacy policy

The short version

This site has no contact form, no accounts and no logins. I never ask for your email address, and there is nowhere on this site to type one.

Google Analytics runs on every page and tells me which pages people read. The two self-assessments record select information when you finish one.

The contact page also has a map embedded from Google.

The purpose of the analytics on this site is to understand what people come here looking for, so I can improve what I offer. I don't sell information from this site, and I don't share it for advertising. What is collected goes to the services that run the site — described below — and nowhere else. Everything below is the detail.

SimplePractice and Health Information

This website is not where your health information lives. There is no form here to type it into the website. When you book a consultation or send a message, those links take you to SimplePractice, the scheduling and client portal service this practice uses. SimplePractice is built for healthcare, and I have a signed agreement with them covering the handling of sensitive client information. Anything you type there goes to them, not to this website.

When you read the site

Every page loads Google Analytics. It starts as soon as the page opens, before you click on anything.

Google receives the address of the page you are on, its title, the page you came from, your IP address, an approximate location worked out from that address, and your browser, device type, screen size and language. The location is city-level, not a street address.

Google also places a cookie on your device holding a random number. That number lets Google recognize the same browser if it comes back later. It lasts about two years.

Google records: which page you opened, how far down it you scrolled, which blog post you read, when you pressed a button and which button it was, and when an assessment was started or finished.

Google is deliberately never told: what you answered. Not your symptoms, not your scores, not the pattern an assessment suggested, not which symptom button you pressed.

Separately, the site is hosted by Vercel. Like any web host, Vercel's servers record each request they handle — your IP address, the time, which page was asked for, and your browser type. That is ordinary server logging and it happens for every visitor.

The self-assessments

The neurofeedback and IFS self-assessments run entirely inside your browser. Your individual answers are never sent anywhere. If you download a summary or copy one to paste somewhere else, that file is built on your own device, and this site never sees it.

When you reach the end of an assessment, a summary of the result is recorded. This happens automatically when you finish. You are not asked first, and nothing on the screen tells you it happened.

For the neurofeedback assessment, the record holds: how many symptoms you selected in total, how many fell into each of the ten categories, how many pointed toward each of the three arousal patterns, which specific symptoms you selected, the overall pattern the result suggested, and the training approach it pointed to.

For the IFS assessment, it holds: which parts the result surfaced, how far through you went, whether you described yourself as struggling or as wanting to grow, and how many relationships between parts were mapped.

If you reached the IFS assessment through a link that already named a topic — e.g. “anxiety” or “depression” — that topic is recorded as well.

The IFS record also carries a session number. It is a random value, generated fresh each time someone starts the assessment. Its only job is to link the two records from one sitting: one is saved when you first reach your results, and another if you go on to the deeper section. It is not saved on your device, it does not survive you closing the page, and it is not connected to anything else.

Both records also include the month they were created. Not the day, and not the time.

Here is what the record does not hold: your name, your email address, your phone number, your IP address, or anything you typed.

These records are stored in a database run by Supabase. The server writes the record rather than your browser, which means Supabase never sees your IP address.

I keep them for two reasons: to understand what people come to this site looking for, and to improve the assessments themselves.

The records contain nothing that identifies you, and there is no reliable way to connect one to a particular person. There is no name attached to it, no contact details, no IP address, and no time more precise than a month.

The symptom buttons on the home page

The home page has a row of buttons — “Anxiety / stress”, “Trauma / PTSD” and so on. Pressing one opens a panel of information about it.

Two things are recorded when you press one, and they are deliberately kept apart.

Google Analytics is told that a button was pressed. It is not told which one.

My own database is told which specific button was pressed, and nothing else. The record is the topic and the month — for example, anxiety / stress, July 2026.

The reason for splitting it is to prevent Google from acquiring this information.

Booking and sending a message

There is no contact form on this site. The “Book a free 15-minute consultation” and “Send a message” buttons are ordinary links. They take you to SimplePractice, the scheduling and client portal service this practice uses.

SimplePractice's pages are not built into this site. Anything you type there — your name, your message, your contact details — goes to SimplePractice and is covered by their privacy practices and by my agreement with them. It does not pass through this website, and this website does not receive it, log it or store it.

Google Analytics records that you pressed a booking or message button, and which one. It cannot see anything you do after you arrive at SimplePractice.

The map on the contact page

The contact page shows a map of my office locations, embedded from Google Maps.

That map is not a picture. It is a live piece of Google's website sitting inside mine, and it loads by itself once you scroll far enough down the page. You do not have to click it.

When it loads, Google receives your IP address, your browser type, and any Google cookies your browser is already carrying.

It is the only third-party content embedded anywhere on this site.

Children and young people

This site is written for adults. Some of it is written for parents — one of the buttons on the home page is “Help for my child” — but the reader I have in mind throughout is an adult, whether you are looking for yourself or for someone you care about.

The site is not directed to children under 13, and I do not knowingly collect information from them. The two self-assessments are intended to be taken by adults. Neither one asks your age.

How long this is kept

Google Analytics data is kept for 14 months.

The assessment records and symptom-button records in the Supabase database are kept indefinitely. There is no expiry set on them at present.

Server logs held by Vercel are kept for a period the hosting provider determines.

Your choices, and what I cannot do

This site sets no cookies of its own. Every cookie here belongs to Google Analytics. The main one is named _ga, holds a random number, and lasts about two years.

There is no opt-out control on this site. No cookie banner, no toggle, no setting.

What does work:

• Blocking or clearing cookies in your browser, or using a private window.
• Google's own Analytics Opt-out Browser Add-on.
• Any tracker-blocking browser or extension.

Clearing the cookie means Google issues your browser a new random number, so later visits are not tied to earlier ones.

This site does not currently respond to Do Not Track or Global Privacy Control signals. If your browser sends one, it will not change anything described on this page.

One thing I cannot do: if you asked me to delete your assessment record, I could not. The records hold nothing that identifies you, so I have no way to find out which one is yours. That is the same property that protects you, and it is the reason the request cannot be honored. I would rather tell you that than offer a right I am not able to deliver.

Changes to this policy

I will update this page when the site changes. The date at the bottom is the date of the last change.

If something changes that I think you would want to know about — a new service receiving information, or something new being collected — I will say so here rather than quietly editing a sentence.

Questions

If anything here is unclear, or you want to know more about how a particular part of the site works, email me at jmorrow@renewpsy.com and I will explain it.