Privacy Policy

This policy explains how we collect, use, and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who we are

We are a UK-based psychotherapy practice (“the Practice”). We are the data controller for personal data collected through this booking system. If you have any questions about this policy or your data, please contact us directly.

What data we collect

We collect the following personal data when you register and book sessions:

• Full name and email address
• Date of birth and phone number
• Appointment history and session notes
• Your consent record (date and time you gave consent)

Session notes and other health-related information are special category data under UK GDPR and receive the highest level of protection. Sensitive fields are encrypted at rest.

Why we collect it

We process your data on the lawful basis of explicit consent (Article 9(2)(a) UK GDPR) for special category health data, and contract performance (Article 6(1)(b)) for booking and appointment management.

How we protect your data

• All data is stored within the UK/EU region.
• Sensitive fields (notes, date of birth, phone) are encrypted at rest.
• Access is restricted by role — therapists can only see their own clients.
• No personal data appears in system logs.
• We do not sell or share your data with third parties for marketing.

How long we keep your data

We retain your records for as long as necessary to provide therapy services and meet our legal obligations. After the retention period, data is anonymised or securely deleted.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase your data (“right to be forgotten”)
• Restrict or object to processing
• Data portability — receive your data in a machine-readable format
• Withdraw consent at any time without affecting prior processing

To exercise any of these rights, please contact the Practice directly. We will respond within one calendar month.

Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Last updated: 2 September 2026