1. Introduction
This Privacy Policy explains how personal data is collected, used, stored, and protected within this psychotherapy practice. Your privacy is taken seriously and handled with care, respect, and professionalism. This practice complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and relevant professional and ethical standards, including those of the UK Council for Psychotherapy (UKCP). This practice works with adults aged 18 and over only.

2. Data Protection Principles
Personal data is processed lawfully, fairly, and transparently. Only data that is necessary for the provision of psychotherapy services is collected, and it is used solely for legitimate professional purposes.

3. Personal Data Collected
The practice may collect and store personal data including contact details, relevant background information, clinical notes, session records, correspondence, and any information shared during therapy. Some of this information is classed as special category data relating to health and is given additional protection under data protection law.

4. How Personal Data Is Used
Personal data is used to provide psychotherapy services, manage appointments, maintain appropriate professional records, meet legal and ethical obligations, and safeguard clients or others where there is a serious risk of harm. Personal data is never sold or used for marketing purposes.

5. Lawful Basis for Processing
Personal data is processed on the basis of contract, consent where required, legal obligation, vital interests, and legitimate professional interests. Special category health data is processed for the provision of health care and in accordance with professional confidentiality obligations.

6. Confidentiality and Its Limits
Information shared in therapy is treated as confidential. Confidentiality may be breached only where there is a serious risk of harm to the client or others, where safeguarding concerns arise, where disclosure is required by law, or where the client has given explicit consent. Wherever possible, any necessary disclosure will be discussed with the client in advance.

7. Online and International Therapy
Therapy may take place online, face-to-face, or in a hybrid format. Where therapy is provided online or to clients outside the United Kingdom, personal data may be transferred electronically across borders. Regardless of location, data is handled securely and in line with UK data protection standards.

8. Data Storage and Security
Appropriate technical and organisational measures are in place to protect personal data from unauthorised access, loss, misuse, or disclosure. Data is stored securely using password-protected and encrypted systems where appropriate. While every effort is made to protect data, no system can be guaranteed to be completely secure.

9. Data Retention
Personal data and clinical records are retained in line with legal, ethical, and professional guidance and are securely deleted or destroyed when no longer required.

10. Individual Rights
Under UK GDPR, individuals have the right to access their personal data, request correction of inaccurate information, request erasure where applicable, restrict or object to processing, and lodge a complaint with the Information Commissioner’s Office (ICO).

11. Complaints
Concerns about the handling of personal data are encouraged to be raised directly within the practice in the first instance. Complaints may also be made to the Information Commissioner’s Office (ICO) at www.ico.org.uk.

12. Changes to This Policy
This Privacy Policy may be reviewed and updated from time to time. The most current version will be made available via the practice website or on request.