Data export and privacy

Download a complete copy of all your personal data at any time from your profile page (Account tab). Click "Export my data" to download a JSON file containing:

• Account details (name, email, phone)
• Profile information (biography, specialty, registration number, pension details)
• All bookings with organisation details
• All invoices with line items and payment status
• All expenses with categories and receipts
• Subscription history
• Availability calendar entries
• Professional documents metadata
• Referral records
• Audit log of account actions

This satisfies your UK GDPR right to data access and portability.

Individual datasets can be downloaded as CSV files for use in spreadsheets or accounting software. The Export CSV button is on the page for each one:

• Bookings (every plan): date, organisation, times, rate, rate type, gross amount, status, notes. Follows the date range only
• Invoices (every plan): invoice number, organisation, issued and due dates, subtotal, total, status, and the sent, settled and payment-recorded dates
• Expenses (Plus and Pro): date, category, description, amount, miles, notes. Follows the date range, category and search
• Earnings (Plus and Pro): date, organisation, session type, notes, times, rate, gross amount, status. Follows the period, organisation and search on the page

Each CSV file holds up to 500 rows and says so when it has been cut short; export a shorter date range at a time to get everything. The full JSON export above has no such limit and is available on every plan, so on Basic it is the way to take your expenses and earnings data with you.

Under UK GDPR you have the right to:

• Access: download all your data via self-service export
• Rectification: correct any inaccurate data in your profile settings
• Erasure: request account deletion
• Portability: receive your data in a machine-readable format (JSON)
• Object: opt out of processing based on legitimate interests
• Withdraw consent: unsubscribe from emails via one-click link or notification preferences

For erasure or objection requests, contact support@email.sessional.co.uk.

• All account data is deleted within 30 days of account deletion (grace period for recovery)
• Invoices, pension records, bookings, and expenses are deleted with your account
• Uploaded documents and receipts are permanently deleted from storage
• Audit log entries are stripped of anything that identifies you when your account is erased. What remains is a de-identified security record with no personal data in it, and it is kept indefinitely

Sessional protects your data with:

• TLS encryption on all connections (HTTPS everywhere)
• AES-256-GCM field encryption for sensitive data (NI number, bank details, registration number, phone)
• Passwords hashed with bcrypt (12 rounds, per-user salt)
• HTTP-only session cookies with SameSite=Lax (not accessible to JavaScript)
• CSRF protection on all form submissions
• Payment data handled entirely by Stripe (we never see card numbers)
• File uploads validated by magic bytes (not client-supplied type)
• Rate limiting on public endpoints

Read our full privacy policy and cookie policy for complete details.