1 · Who we are
Human Labb is a practice run by Dr. Derrick Siu. There is no corporate parent: Derrick personally receives and reads what you send. Under the GDPR and equivalent global privacy laws, Dr. Derrick Siu acts as the data controller for all information collected on this site.
2 · What we collect, and when
Browsing this site is completely anonymous. We do not require accounts, set tracking cookies, or log visitor identities. We only process data when you choose to submit it:
| Data collected | Event / context | Purpose | Lawful basis |
|---|---|---|---|
| Name, email, message | General Enquiry Form | To read and respond to your enquiry | Consent |
| Private Session responses | Private Session Form | To evaluate if Derrick can help and check for urgent support needs | Explicit consent |
| Name, email, city | Waiting List Signup | To notify you when openings or programmes launch | Consent |
| Session reflections | Post-session "Field Notes" | To improve session design; published only with separate opt-in | Explicit consent |
| Attribution preference | Feedback Form | To credit your testimonials according to your preferences | Consent |
| Booking details | Team / Event Enquiry | To organise and deliver workshops or organisational bookings | Contract |
Upcoming payments notice Not yet live
We do not take payments on this site today. When online booking launches, card details will be handled entirely by Stripe. We will never see or store your full card numbers; only transaction metadata (amount, date, description) for tax compliance.
What we never collect or do
- No account creation required.
- No third-party data broker purchases.
- No AI model training on your submissions.
- No unnecessary personal questions. We intentionally do not ask for age, budget, diagnosis, or medications in initial forms.
4 · The Private Sessions enquiry (sensitive data)
Because health disclosures require higher standards, we handle these submissions under strict conditions:
- Scope & optionality: The form asks about your current situation, history, urgency, and ongoing care. Under GDPR Article 9, this is health data. Only 5 of 14 questions are required: Name, Email, Current Situation, Urgency, Location. You may leave all optional fields blank without penalty.
- Storage & transmission: Your submission is stored in an encrypted database accessible only via restricted admin keys. A copy is also routed directly to Derrick's secure mailbox so he can respond personally.
- Usage: Derrick reads your response to determine if Human Labb is appropriate for you or if urgent support is needed. Entries flagging urgent needs are prioritised.
- Non-clinical status: Submissions do not constitute formal clinical records or medical intake forms.
- Emergency support: This form is not monitored 24/7. If you are in crisis, please use the emergency resources listed on our Disclaimer page or directly within the form.
5 · Testimonials & limited AI usage
If you submit post-session feedback via Field Notes, you can choose how your words are shared (Full Name, First Name Only, or Anonymous) and specify optional demographic credits (gender, age range, location).
- No consent, no publication: Unconsented feedback is never published or paraphrased.
- AI assistance: We use an AI model strictly to review consented feedback to suggest length edits or pull-quotes. The AI is forbidden from altering your intent, inventing details, or processing unconsented text, enquiries, or waiting-list entries.
- Human oversight: Derrick manually reviews and approves every testimonial before it goes live. You may revoke testimonial consent at any time.
6 · Practice improvement
To evaluate overall practice effectiveness, we may analyse fully anonymised, aggregated trend data (with all names and emails stripped out). Individual data is never published. Formal research projects using identifiable data would require a separate, explicit opt-in. You may opt out of aggregate analysis at any time.
7 · Data retention
We keep the information you send us indefinitely so we have an ongoing record of your practice history and reflections over time.
You do not have to wait for any arbitrary expiry date to remove your data: ask at any time, and it goes.
| Data | Retention period |
|---|---|
| Enquiries & messages | Kept indefinitely, or deleted upon your request. |
| Private Sessions enquiry answers | Kept indefinitely to maintain your practice history, or deleted upon your request. |
| Waiting-list entries | Kept indefinitely, or deleted upon your request / list closure. |
| Field Notes feedback | Kept indefinitely to support practice reflection, or deleted upon your request. |
| Published testimonials | Published indefinitely until you withdraw consent. |
| Records of payment Once booking opens | Kept for 5–7 years, strictly as required by tax law (cannot be deleted early). |
When you request deletion, your data is permanently removed or irreversibly anonymised across our database and mailboxes within 30 days.
8 · Third-party service processors
We share data only with infrastructure providers necessary to run the service:
- Supabase (USA): Core Database & Storage
- Vercel (Global CDN): Website Hosting
- Resend (USA): Email Transmission
- Tally (EU): Specialised Form Engine
- Luma (USA): Event Registration
- Stripe (Global, future): Payment Processing
International transfers: Where data is transferred outside the UK or EEA, we rely on Standard Contractual Clauses (SCCs) embedded in our processor agreements.
9 · Your rights & data requests
Regardless of your location, you hold the right to:
- Access, correct, or delete your data ("Right to be Forgotten").
- Export your data in a portable format.
- Restrict processing or opt out of aggregate analysis.
- Withdraw consent at any time.
To exercise these rights, submit your request using the form below or contact Derrick directly. Requests are processed within 30 days free of charge.
Ask about your data
Tell us what you'd like and we'll do it. If you're asking for a copy or a deletion, use the same email address you contacted us from: it is how we find your records without asking you for anything more.
Request received.
Derrick will come back to you by email. If it's a deletion, you'll get confirmation once it's done.
UK/EU residents may also lodge complaints with their regional Data Protection Authority. California residents hold equivalent rights under CCPA/CPRA.
10 · Security practices
- All connections use HTTPS, and data is encrypted at rest.
- Database keys are protected and isolated from client-side web code.
- Admin access is restricted via single-identity authentication and rate-limited endpoints.
- Incident protocol: While no digital system is completely immune to breaches, if a security incident affecting your rights occurs, we will notify you and relevant data authorities within 72 hours of discovery.
11 · Minors
Human Labb is designed exclusively for adults (18+). We do not knowingly collect information from minors. If you believe a minor has submitted personal data, contact us for immediate deletion.
12 · Policy changes
Updates to this policy will be posted here with a revised date. Material updates (such as additions to data processors or changes to intake procedures) will be highlighted prominently on the site or sent via email where applicable.
13 · Contact
Dr. Derrick Siu · Human Labb
For data requests, use the form in Section 9. For general questions, submit an enquiry via our main contact form.
Human Labb is a practice space, not therapy. See the Disclaimer.