Privacy Notice
The Esther Practice | Version 3.5 | Updated 24 October 2026
This Privacy Notice is easier to read on a larger screen.
On this page
Information The Esther Practice collects and why
a. Racialised Harm in Institutions: Anonymous Questionnaire
b. Racialised Harm in Organisations: Share Your Experience
c. Racialised Harm in Schools: Parent and Carer Account
d. Individual Pattern Reflections
f. Mailing list
g. Schools Intake Form for commissioned work
1. About The Esther Practice
The Esther Practice is an independent research and consultancy practice examining patterns of racialised harm in organisations and institutions. The Practice is operated by Dionne Wilson-Brown, who is the data controller responsible for the personal information covered by this notice.
Contact details
Email: info@theestherpractice.org
Postal address: The Esther Practice, Unit 166853, PO Box 6945, London W1A 6US
ICO registration number: ZC142845
2. Information The Esther Practice collects and why
The Esther Practice collects personal information through its research forms, commissioned services and website enquiries. Research forms, the Schools Intake Form and the Organisational Intake Form are hosted on Google Forms. The website Contact form is hosted on Squarespace. The sections below explain what information is collected and how it is used.
Racialised Harm in Institutions: Anonymous Questionnaire
What is collected
● Your answers to the questionnaire about experiences of racialised harm.
● Demographic information: age, gender, ethnic background, disability, neurodivergence, and religion or belief. You can answer “Prefer not to say” to any of these.
● The type of organisation or service and your connection to it. The questionnaire does not ask for the organisation's name.
● Any written answers you choose to give.
● A withdrawal code you create.
The questionnaire does not ask for your name, email address, contact details or the name of the organisation, and the form is set not to record your contact details. Please do not include names or other identifying details in your written answers. Any identifying details entered are removed or generalised before analysis. Responses may still be identifiable from a combination of demographic answers, organisation information and distinctive descriptions, particularly in small settings. The Practice checks this risk before using or publishing extracts.
Why it is collected
To build a wider picture of racialised harm across organisations and sectors.
Lawful basis
For information about you, the Practice relies on consent under Article 6(1)(a) UK GDPR. Where your answers reveal special category information, including racial or ethnic origin, religious or philosophical beliefs, or information concerning health (which may include disability or neurodivergence information), the Practice relies on your explicit consent under Article 9(2)(a) UK GDPR, given through the consent statement before you begin. You must be 18 or over to take part. Information about other people mentioned in accounts is processed under legitimate interests, Article 6(1)(f) UK GDPR; where it includes special category information, the Practice relies on the research condition under Article 9(2)(j) UK GDPR and Schedule 1 paragraph 4 of the Data Protection Act 2018, subject to the applicable safeguards.
Not collecting names or contact details reduces identification risk but does not make every response anonymous at collection. Combinations of answers or distinctive descriptions may identify the respondent or another person. The Practice therefore treats raw responses as potentially personal information and reviews contextual detail before analysis and publication.
Racialised Harm in Organisations: Share Your Experience
What is collected
● Your written account of racialised harm you experienced in an organisation or institution, whether as a member of staff, student, patient, client or service user.
● Demographic information: age, gender, ethnic background, disability, neurodivergence, and religion or belief. You can answer “Prefer not to say” to any of these.
● General information about the sector, the type of organisation and your relationship to it.
● Your contact details, only if you choose to give them.
● Information about other people named in your account, such as staff or others involved.
● A withdrawal code you create.
Why it is collected
To identify, name and document patterns of racialised harm in organisations and institutions. Your account contributes to a research base from which patterns are identified.
Lawful basis
For your information: your consent, under Article 6(1)(a) UK GDPR. For special category information (your ethnic background, religion or belief, and information concerning health, which may include disability or neurodivergence): your explicit consent, under Article 9(2)(a) UK GDPR, given through a separate consent statement on the form.
For information about other people named in your account: legitimate interests, under Article 6(1)(f) UK GDPR. The Practice's legitimate interest is research into systemic patterns of harm. Their details are removed at the same point as yours. Where that information is special category information, the Practice relies on the research condition under Article 9(2)(j) UK GDPR and Schedule 1 paragraph 4 of the Data Protection Act 2018.
You must be 18 or over to take part.
Racialised Harm in Schools: Parent and Carer Account
What is collected
● Your account of what your child experienced in a school or other educational setting.
● The phase of education and the type of school or setting. The school's name is not requested.
● Information about you: age, gender, ethnic background, disability, neurodivergence, and religion or belief. You can answer "Prefer not to say" to any of these.
● Information about your child: age, year group, ethnic background, additional needs or EHCP status, disability and neurodivergence. You can answer "Prefer not to say" to any of these.
● Information about staff or other children described in your account.
● Your email address, only if you ask for an Individual Pattern Reflection or a research interview.
● A withdrawal code you create.
Why it is collected
To identify, name and document patterns of racialised harm in educational settings.
Lawful basis
Taking part is voluntary, and contributors are asked to agree before they begin. That agreement is part of how the research is run ethically. It is not the lawful basis for processing. Contributors must be 18 or over.
For all information in the research, including the contributor's own and information about children and other people described in accounts, The Esther Practice relies on legitimate interests under Article 6(1)(f) UK GDPR. The legitimate interest is conducting independent research to identify patterns of racialised harm and institutional responses in schools. You have the right to object, as explained in section 6.
Where research contributions contain special category information, including racial or ethnic origin, religious or philosophical beliefs, or information concerning health (which may include disability, neurodivergence, additional needs or EHCP information), the Practice relies on the research condition under Article 9(2)(j) UK GDPR and Schedule 1 paragraph 4 of the Data Protection Act 2018, subject to the applicable safeguards.
Contributors must be a parent or carer of the child whose experience they describe, but do not need to hold parental responsibility for that child or have any connection to other children mentioned in the account. An Individual Pattern Reflection about a child is prepared only for a contributor who confirms they have parental responsibility for that child. Contributors are instructed not to include children's names or unnecessary identifying information.
Identifying details are removed or generalised before coding. Only anonymised material enters the research base. Findings are published as a written report and are not used to make decisions about particular individuals.
The Practice has assessed whether this research is necessary, and how it affects the people described in accounts, including children, in a legitimate interests assessment and a data protection impact assessment. The safeguards are set out in sections 3 and 4.
Individual Pattern Reflections
If you ask for one, the Practice prepares a written reflection naming the patterns present in your account and sends it to the email address you give. A reflection is not an investigation, a finding about any person or school, or evidence for a complaint.
Lawful basis
Legitimate interests, under Article 6(1)(f) UK GDPR. For special category information, your explicit consent, under Article 9(2)(a) UK GDPR, given through a separate consent statement when you ask for a reflection. Where the account concerns a child, a reflection is prepared only for a contributor who confirms they have parental responsibility for that child, and information about the child is used only to prepare that reflection. If you do not give this consent, no reflection is prepared, and your account still contributes to the research. You can withdraw consent before the reflection is sent.
Make an Enquiry
What is collected
• Your name and email address.
• Any information you choose to include in your message.
Why it is collected
To respond to enquiries about The Esther Practice, its services, research collaborations and other professional matters.
Lawful basis
Legitimate interests, under Article 6(1)(f) UK GDPR, in responding to enquiries and managing the Practice's professional activities.
Mailing list
What is collected
Your email address and, if you choose to give it, your name.
Why it is collected
To send you updates about The Esther Practice's work, publications and events.
Lawful basis
Your consent, under Article 6(1)(a) UK GDPR. You can unsubscribe at any time using the link in every email, or by contacting the Practice.
Sign-up is through the website and is separate from the research forms. Joining the mailing list is not linked to any account you have shared.
Schools Intake Form for commissioned work
What is collected
• Contact details of the person making the enquiry.
• Information about the school or educational organisation.
• Information provided about the school's circumstances, concerns and reasons for seeking support.
Why it is collected
To understand the school's enquiry, assess the suitability and scope of the Schools Gap Diagnostic, and inform discussions about potential commissioned work.
Lawful basis
The Esther Practice relies on legitimate interests under Article 6(1)(f) UK GDPR to process the contact information and professional details provided through the Schools Intake Form.
This information is used to assess enquiries about commissioned work, understand the school's circumstances and requirements, and determine whether the Practice's services are appropriate.
Where an enquiry includes personal information about other individuals, it will be handled only to the extent necessary for assessing the enquiry. The form is not intended for submitting identifiable case histories or sensitive information about individual children.
The Schools Intake Form is hosted on Google Forms.
Organisational Intake Form for commissioned work
What is collected
• Contact details of the person making the enquiry.
• Information about the organisation.
• Information provided about the organisation's circumstances, concerns and reasons for seeking support.
Why it is collected
To understand the organisation's enquiry, assess the suitability and scope of the Gap Diagnostic, and inform discussions about potential commissioned work.
Lawful basis
The Esther Practice relies on legitimate interests under Article 6(1)(f) UK GDPR to process the contact information and professional details provided through the Organisational Intake Form.
This information is used to assess enquiries about commissioned work, understand the organisation's circumstances and requirements, and determine whether the Practice's services are appropriate.
Where an enquiry includes personal information about other individuals, it will be handled only to the extent necessary for assessing the enquiry. The form is not intended for submitting identifiable case histories or sensitive information about individual members of staff.
The Organisational Intake Form is hosted on Google Forms.
Feedback forms
After any engagement, you may be invited to give feedback. Feedback can be given anonymously. Any contact details you choose to give are processed with your consent, under Article 6(1)(a) UK GDPR, and used only to improve the Practice's work.
Research interviews
Adults who have shared an account may be invited to a one-to-one research interview. Participation is voluntary.
Before a research interview, participants receive full information and give separate written consent, including explicit consent under Article 9(2)(a) UK GDPR for special category information. Recordings are deleted within 14 days of transcription, and transcripts are anonymised before analysis. Research interviews inform the research and its written report. Individual case studies are not published. Short anonymised extracts may be quoted, and each is checked so that no one can be identified from it.
People who complete the Anonymous Questionnaire can ask about a research interview by email. The email is used only to respond about the research interview and cannot be linked to a questionnaire response. If you do not go ahead, your email is deleted within 30 days.
If you are described in someone else's account
Research accounts may describe children, school staff and other people who have not contributed. The Practice does not contact them, because it does not seek to identify anyone and contacting them would itself reveal information about the contributor. This notice is published so that anyone described can understand how information is used. Names are removed when accounts are coded, and nothing is published that could identify a person. You can contact the Practice, and you have the right to object.
3. How information is used and protected
● Research responses are held within the Practice's Google Workspace account. Website contact submissions are collected through Squarespace and routed to the Practice's business email. Access is restricted to the practitioner.
● Before analysis, names of people, organisations, schools and places, and other identifying details, are removed or generalised. Combinations of details are also checked because removing names alone may not prevent identification. Only material assessed as sufficiently anonymised is added to the research base.
● Findings are published as a written report describing patterns of harm and how they operate. Short extracts may be quoted only where the contributor has agreed and a separate disclosure-risk check indicates that the wording and context will not identify a person. Where an extract cannot be safely anonymised, it will be paraphrased or omitted. Individual case studies and account-level data are not published.
● The anonymised research base also informs The Esther Practice's commissioned diagnostic work with organisations. Only anonymised patterns are used in this way. No account and no identifying information is shared with any client.
● AI tools may be used to help organise and analyse information once identifying details have been removed. Identifying information is not entered into AI tools.
● The Practice does not use personal information to make automated decisions about individuals.
● If you are signed in to a Google account while completing a form, Google may save your progress as a draft in your own account for up to 30 days. The Practice cannot see drafts. Only submitted responses reach the Practice.
Limits of confidentiality
The Esther Practice treats information shared through its research and professional activities as confidential. However, confidentiality cannot be guaranteed in every circumstance.
Where information raises a safeguarding concern involving a child or an adult at risk, the Practice may need to share relevant information with an appropriate safeguarding authority or statutory agency. Information may also be disclosed where required by law.
Any disclosure will be considered on a case-by-case basis and limited to what is necessary and proportionate. Where appropriate and safe, the person concerned will be informed.
4. How long information is kept
● Identifying information, including contact details and names in accounts: deleted within 30 days of the account being coded into the anonymised research base.
● Contact details given for an Individual Pattern Reflection or research interview: kept until that is complete, then deleted within 30 days.
● Research interview recordings: deleted within 14 days of transcription.
● Safeguarding records: where a safeguarding concern is recorded, a minimal record of the concern and the action taken is kept securely for 6 years, or longer only while it is needed for legal proceedings or an investigation.
● Anonymised research data: retained as part of the research base. It can no longer identify anyone.
● Enquiries and engagement records: for the length of the contact or engagement, plus 12 months.
● Mailing list: until you unsubscribe. After that, your email address is kept on a suppression list only, so that you are not contacted again.
● Business and tax records: 6 years, as HMRC requires.
● Feedback: any identifying details are deleted within 30 days. Anonymised feedback is retained.
5. Who information is shared with
Google provides the Practice's research forms, Schools Intake Form, Organisational Intake Form, storage and spreadsheets through Google Workspace. Squarespace provides the website, its Contact form and the mailing list. AI tools may be used to help analyse accounts after identifying details have been removed. These tools are used under settings or terms that stop them using the material to improve their products.
These providers process personal information in connection with the services they provide. Where personal information is transferred outside the United Kingdom, appropriate safeguards are used in accordance with UK data protection law.
The Practice does not sell personal information and does not share it with any employer, school or organisation named in an account. Information is shared with others only where the law requires it or where the limits of confidentiality in section 3 apply.
Where a safeguarding concern arises, relevant information may be shared with local authority children's services, the Local Authority Designated Officer or the police, as set out under Limits of confidentiality.
6. Your Rights
Under UK data protection law you have the right to:
● be told how your information is used (this notice);
● ask for a copy of the information held about you;
● ask for inaccurate information to be corrected;
● ask for your information to be deleted;
● ask for the use of your information to be restricted;
● object to processing based on legitimate interests;
● ask for your information in a portable format, where it is processed with your consent;
● withdraw your consent at any time.
Withdrawing consent does not affect processing that took place before you withdrew. Once information has been anonymised it can no longer be linked to you, so these rights no longer apply to it.
Withdrawing from the Racialised Harm in Institutions: Anonymous Questionnaire
When you complete the questionnaire, you are asked to create your own withdrawal code. To request withdrawal, contact the Practice within 14 days of submitting and give your code. The Practice uses the code to locate the response. If more than one response has the same code, the Practice will not delete a response on the basis of the code alone; it will seek sufficient additional non-identifying details to distinguish the relevant response, where possible. Responses are not coded before the 14-day withdrawal period has passed.
Choose a code that does not include your name, date of birth or anything else that could identify you, and keep a note of it. Because the questionnaire does not collect your name, the Practice normally cannot locate your response without the code. If duplicate codes cannot be distinguished safely, the Practice may be unable to identify the particular response for withdrawal.
Withdrawing from Share Your Experience or the Parent and Carer Account
When you complete the form, you are asked to create your own withdrawal code. To withdraw your response, contact the Practice within 14 days of submitting and give your code. Responses are not coded before then.
Children's rights
Children described in accounts have the same rights over their own information. Where a child is not able to exercise these rights themselves, a person with parental responsibility may be able to act on their behalf, depending on the child's understanding and the circumstances.
How to make a request
Contact the Practice using the details in section 1. Requests are answered within one month. You may be asked for proof of identity before information is released.
7. Website and Cookies
The Esther Practice website is hosted on Squarespace. When you visit the website, certain technical information may be processed to support its operation, security and performance.
The website may use cookies and similar technologies. Some are necessary for the website to function. Other cookies, including those used for analytics or marketing, are subject to applicable consent requirements.
Where consent is required, these cookies will not be used unless you have provided consent through the website's cookie settings. You can manage your preferences using the cookie controls provided on the website.
Further information about cookies and their purposes will be provided through the website's cookie settings.
8. Complaints and changes to this notice
If you have a concern about how your information is handled, please contact the Practice first. You also have the right to complain to the Information Commissioner's Office (ICO).
Website: https://ico.org.uk/make-a-complaint/
Helpline: 0303 123 1113
Postal address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
This notice is updated whenever the way the Practice handles information changes. The version number and date at the top show the latest version.