Privacy & Data Protection

Effective Date: 19 June 2026

1. Introduction

Your privacy is of great importance to me, and I am committed to complying with the terms of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025) regarding the responsible and secure use of your data.

I have a legitimate interest in processing your personal data in order to provide you with effective therapy. This means I collect and use only the information necessary to deliver your care, and I do so in a way that you would reasonably expect and which has minimal privacy impact.

The purpose of this statement is to let you know what personal information I collect and hold, why this data is collected, how long it is kept, and what your rights are with regards to this personal data.

I am registered with the Information Commissioner's Office (ICO).

When we agree to work together, your signature on the Therapy Contract confirms your acceptance of the terms outlined in this Privacy Statement.

2. What Information Do I Collect?

I collect personal data such as:

CategoryDetailsPersonal DetailsName, address, date of birth, genderMedical InformationGP and/or medical practitioner detailsEmploymentEmployment details and employer's contact information (if relevant)Contact InformationTelephone numbers, email address, and Zoom address (if applicable)BackgroundPersonal and family background informationSensitive DataPotentially sensitive data relating to medical and mental health conditions

3. What Do I Use Your Information For?

  • To provide you with therapy services as requested

  • To notify you about changes to your appointments

  • To fulfil any administrative, legal, ethical, and contractual obligations

  • For safeguarding purposes or where there is a risk of serious harm (as a recognised legitimate interest under the Data (Use and Access) Act 2025)

  • For clinical supervision, as required by my professional bodies (see Section 5 below)

4. What Information Do I Share?

Consent

I may share information with relevant medical professionals or others whom you have requested or agreed I need to contact.

Serious Harm

I may share your information with the relevant authorities if I have reason to believe this may prevent serious harm being caused to you or another person. This is supported by the recognised legitimate interests provisions of the Data (Use and Access) Act 2025.

Compliance with Law

I may share information when the law requires me to do so - for example, in relation to safeguarding, terrorism, drug trafficking, or serious crime.

Clinical Will

In the event of my sudden death or a serious accident or illness, a named colleague (bound by confidentiality) will be able to access your contact details so they can notify you.

Supervision

It is an ethical requirement for clinicians to have regular supervision. Any supervisor used is an accredited member of the relevant accrediting body and works within their ethical framework. They are also bound by confidentiality.

5. How Do I Keep Your Information Safe?

  • All information provided is stored as securely as possible. I take all reasonable precautions to prevent the loss, misuse, or alteration of information given.

  • All paper forms and correspondence are kept in locked filing cabinets.

  • All electronic files are kept on password-protected devices with up-to-date virus protection software.

  • Formal reports are password protected and/or sent through a secure encrypted service such as Protonmail.

  • If any process notes are taken during sessions, they are kept separate from any identifiable personal information.

  • For live chat or audio-webcam appointments, I use Zoom which features end-to-end encryption for added security.

  • Client notes and other documentation are destroyed seven years after the end of our work together (or as required by my professional indemnity insurer).

  • Any known data breaches will be reported to the ICO within 72 hours.

  • Any requests for personal data need to be made through a Subject Access Request (SAR). Under the Data (Use and Access) Act 2025, I will conduct a reasonable and proportionate search for the information requested and will respond within one month. If I need clarification from you, the timeframe may be paused until that clarification is received.

  • My website is maintained by Squarespace. Your details are not stored on their systems for any contact requests made through the website. Any Subject Access Requests (SARs) should be directed to me directly.

  • If you choose to contact me by text or mobile phone, numbers are stored under a reference system and/or initials only, as opposed to full names.

6. Your Rights

Under UK data protection law, you have the following rights:

RightWhat This MeansAccessAccess your personal data (Subject Access Request)RectificationRectify, erase, or restrict your dataObjectObject to the processing of your dataPortabilityRequest transfer of your data (data portability)

Withdrawal of Consent

You may withdraw your consent for me to hold and process your data at any time. However, if you do this while we are working together, we may need to bring therapy to an end, as I would no longer be able to keep the necessary records required for safe and ethical practice.

7. Data Protection Complaints Process

Updated in accordance with the Data (Use and Access) Act 2025

You have the right to make a complaint about how I handle your personal data. If you have a concern about my data protection practices, please contact me directly in the first instance.

  1. Acknowledgement: I will acknowledge receipt of your complaint within 30 days of receiving it.

  2. Investigation: I will investigate your concern without undue delay and will keep you informed of progress throughout the process.

  3. Outcome: You will be informed of the outcome of the investigation and any actions taken in response to your complaint.

If You Remain Dissatisfied

If you are not satisfied with how your data protection complaint has been handled, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) :

Contact MethodDetailsWebsitewww.ico.org.ukHelpline0303 123 1113PostInformation Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

8. Changes to This Policy

This document is a work in progress and may be modified from time to time. Any significant changes will be communicated to you.

Last Updated: 19 June 2026

💬 Questions or Concerns?

If you have any questions about this Privacy Statement or how your data is handled, please contact me directly:

📧 Email: info@cbttherapy.org
📞 Phone: 07984 943669