Privacy Policy
Your privacy is important, and you can be confident that any personal information you share will be kept safe and secure, and used only for the purpose for which it was provided. I comply with current data protection law, including the General Data Protection Regulation (EU/2016/679), the Data Protection Act 2018, and the Privacy and Electronic Communications (EC Directive) Regulations 2003.
This notice explains what happens to your personal information from your first point of contact with me through to after therapy has ended, including:
The legal basis I rely on for processing your information, and why
Whether you're required to provide it
How long I keep it
Whether it's shared with anyone else
Whether it's transferred outside the UK
Whether any automated decision-making or profiling takes place
Your rights regarding your data
If you have any questions about how I handle your data, please contact me.
A "data controller" is the person or organisation responsible for collecting, storing, and managing personal data. For this website and my therapy practice, I am the data controller..
THE LEGAL BASIS FOR HOLDING YOUR INFORMATION
Under the GDPR, I must have a lawful basis for processing your personal data, and this varies depending on the stage of our contact.
If therapy has ended, I rely on legitimate interest as the basis for continuing to hold your information for a period afterwards.
If you're currently in therapy with me, or considering it, I process your data as necessary to deliver our agreed service.
Because therapy involves sensitive personal information (known as "special category data" under the GDPR), I rely on a specific lawful basis for this: that it is necessary for the provision of health treatment, and for fulfilling a contract with a health professional.
HOW YOUR INFORMATION IS USED
Initial enquiry
When you first get in touch, I'll collect basic details to help me respond — typically your name, contact details, and phone number if you provide it.
If you choose not to proceed with therapy, I will delete this information within a year, or sooner if you ask me to.
Everything discussed in sessions remains confidential, except in the following situations:
You give your consent for confidentiality to be broken
I am legally required to disclose information by a court
There is a serious risk to your safety or someone else's, or the matter involves fraud or crime
Wherever possible, I will discuss this with you first, unless doing so would compromise someone's safety.
If we go ahead with therapy, I'll keep a record of key details — your name, date of birth, contact information, address, and GP details. This helps sessions run smoothly and supports your safety if needed. This information is stored securely, either in a locked cabinet or via an encrypted, password-protected system, and is not shared with third parties except as outlined above.
If there's a serious risk to your safety, I may contact a relevant professional (such as your GP), ideally with your consent.
I keep brief notes after each session. These are stored digitally on an encrypted device with secure backup, kept separately from your personal details, and identified only by a client code rather than your name — so the data is "pseudonymised." Any therapy-related questionnaires or measures are stored the same way.
I attend regular clinical supervision and may discuss aspects of our work together with my supervisor, while taking care to protect your anonymity.
For security purposes, text and messaging app conversations are not retained beyond a year; anything important is added to your session notes instead. The same applies to email correspondence.
After therapy ends
Your personal details are retained for seven years after our work together ends, then securely destroyed. If you'd prefer this happens sooner, let me know.
Anonymised session notes may be kept indefinitely, as I sometimes draw on anonymised examples from practice for professional writing or training purposes. In any such case, identifying details are always changed, and examples are usually drawn from a blend of different clients' experiences rather than any one person. If you'd rather I didn't use our work in this way, or want these notes deleted, just let me know.
YOUR RIGHTS
You have the right to request access to, correction of, or deletion of your personal data, and to ask me to restrict or stop processing it in certain circumstances. More information on your rights is available at ico.org.uk/your-data-matters.
If you request information I hold about you, I will:
Explain what it is and where it came from
Explain why I'm holding it and how long I'll keep it
Tell you who else, if anyone, it's shared with
Provide a copy in a clear, accessible format
You can also ask me to correct any inaccuracies in the information I hold.
To request your information, please contact me in writing.
If you have concerns about how your data has been handled, please contact me directly — I welcome feedback on how I can improve my data practices. You can also raise a formal complaint with the ICO, the UK's data protection regulator, at ico.org.uk/make-a-complaint.
DATA SECURITY
I take data security seriously. Paper records are kept in a locked cabinet, and digital records are stored securely in encrypted form.
WEBSITE VISITORS
This website uses a third-party platform to collect standard analytics, such as visitor numbers and browsing patterns, to help me understand how the site is used. This data is anonymised, and no attempt is made — by me or the platform — to identify individual visitors.
I rely on legitimate interest as the lawful basis for this website analytics data.
You can read more about the cookies used on this site here.
No personally identifying data is collected through general site browsing. If you complete a contact form, that information is temporarily processed by the website host before being sent to me.