Privacy Statement
I am committed to comply with the terms of the General Data Protection Regulation (GDPR) regarding the responsible and secure use of your personal data. I will need to process personal data in order to provide therapy and group classes and am therefore registered with the Information Commissioner's Office (ICO). The purpose of this statement is to let you know how I collect, use and manage your data. When you undertake psychological therapy with me or join group classes, you will be asked to consent to the processing of your data under the terms of this policy.
Administrative support and Cliniko
I use authorised administrative support to assist with initial enquiries, appointment management, forms, invoices, payments and routine administrative correspondence. My virtual assistant, Saffron Rush of Saffron Rush VA, processes personal information only on my instructions and under contractual confidentiality and data-processing obligations.
I also use Cliniko, a secure practice-management system, to manage client details, appointments, forms, invoices, payments and related administrative records. Administrative access is restricted according to the person's role. My virtual assistant does not provide clinical advice or make clinical decisions. Any clinical, safeguarding or crisis-related correspondence received through the administrative account will be referred to me.
What information do I collect?
I collect personal data such as your name, date of birth, GP/medical practitioner details, telephone number, email address. During the course of our work together, I will also learn about your personal and family background, alongside potentially sensitive data relating to medical and mental health conditions.
I may also collect information provided during an initial enquiry, appointment and cancellation details, completed forms, correspondence, and relevant invoicing, payment, insurance or third-party funding information. This information may be stored in Cliniko and, where necessary, processed through the dedicated administrative email account.
What do I use your information for?
To provide you with psychological therapy or teaching that is most appropriate for your needs.
To notify you about changes to your appointments or other services that I provide.
To fulfil any administrative, legal, ethical and contractual obligations.
To respond to initial enquiries and arrange complimentary 20-minute consultations.
To manage appointments, forms, confirmations, reminders, cancellations, invoices, payments and receipts through Cliniko.
Who may access or receive your information?
I will not share any information about you with other organisations or people, except in the following situations:
Consent: I will share information with relevant medical professionals or others whom you have requested or agreed I need to contact.
Serious harm: I may share your information with the relevant authorities if I have reason to believe that this may prevent serious harm being caused to you or another person.
Compliance with law: I may share information when the law requires me to - i.e. in case of safeguarding, terrorism, drug trafficking or serious crime.
Clinical Will: I have a clinical will which means in the event of sudden death or a serious accident or illness, a named colleague will be able to access the contact details of current clients to notify them.
Supervision: It is an ethical requirement for registered clinicians to have regular supervision to discuss their work. All my supervisors are registered clinicians bound by the same ethical framework.
Authorised administrative support: My virtual assistant may access and process the limited personal information necessary to manage enquiries, appointments, forms, invoices, payments and other routine administrative correspondence. They act only on my instructions and are bound by contractual confidentiality and data-protection obligations.
Service providers: I use trusted service providers, including Cliniko for practice management, Google Workspace for administrative email and Stripe for payment processing. When you pay through a Stripe payment link, your payment information is processed securely by Stripe. I do not receive or store your full payment-card details. These providers process information to support the operation of my practice and are subject to their own security and data-protection obligations.
How do I keep your information safe?
All information that you provide to me is stored as securely as possible. I take all reasonable precautions to prevent the loss, misuse or alteration of information given.
My process notes of our sessions are kept separate from your identifiable personal information.
All paper forms and correspondence are kept in locked filing cabinets. All electronic files are kept on password-protected devices with virus protection software.
Whilst I endeavour to keep my systems and communications protected against viruses and other harmful effects, I cannot bear responsibility for all communications being virus free.
Client and prospective-client information may be stored within Cliniko and the dedicated administrative Gmail account. Access is limited to authorised users, with permissions set according to their responsibilities. Password protection and two-factor authentication are used where available.
Administrative correspondence relating to unsuccessful enquiries is retained for 12 months and then securely deleted. Where an enquiry becomes an ongoing client relationship, relevant details are transferred to Cliniko and the related correspondence deleted once no longer needed.
Client notes and other documentation are securely destroyed seven years after the conclusion of an adult's therapy. For minors, documentation is retained until the individual reaches the age of 25.
Any known data breaches will be reported to the Information Commissioner's Office (ICO) within 72 hours.
My website is hosted on the Wix.com platform. For their Privacy Policy go to: https://www.wix.com/about/privacy.
Under the GDPR, you have the right to:
Access your personal data, rectify or restrict your data, object to the processing of your data, and/or request transfer of your data. Requests for personal data need to be made directly to me and will be supplied within one month.
You may withdraw consent for me to hold and process your data at any time by sending me an email. However, if you do this while actively receiving therapy, we will need to discuss whether it is possible to continue treatment.
If you have any concerns about the way that I handle your data please contact me through the contact page or email. If you feel after this that your issue has not been resolved effectively, you have the right to contact the Information Commissioners Office (www.ico.org.uk).
Changes to this policy
This document is a work in progress and may be modified from time to time.
August 2026
