Privacy Notice

To provide therapy safely and effectively, I need to collect and store some personal information, including your contact details and records of our sessions. This Privacy Notice explains how your information is collected, used, stored and protected from your initial enquiry until after therapy has ended.

Your privacy is important to me. I will keep your personal information secure, confidential and only use it for the purposes for which it was collected. I comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018.  I am a member of the British Association for Counselling and Psychotherapy (BACP) and work in accordance with their ethical framework  I am registered with the Information Commissioner’s Office.

My lawful basis for using your personal information

Under UK data protection law, I must have a lawful reason for collecting and using your personal information.  If you contact me about therapy or become a client, I will use your information to arrange and provide therapy. This includes any sensitive information you choose to share that is relevant to your care. I only collect information that is necessary to provide a safe and effective therapy service.  After therapy has ended, I will retain your clinical notes for the period of 7 years, as required by my professional and legal obligations before they are securely destroyed.

How I use your information

I will only use your personal information to provide and manage your therapy, such as contacting you about appointments or responding to your enquiries. Your information will be kept securely and only for as long as is necessary in line with guidance from the Information Commissioner’s Office.

Initial contact

When you contact me to enquire about therapy, I will collect some basic information, such as your name, contact details and a brief outline of the support you are looking for. This information is only used to respond to your enquiry and to determine whether I am the right therapist for your needs.  If you are referred by a healthcare professional or someone contacts me on your behalf, I will use the information they provide for the same purpose.  If you decide not to proceed with therapy, your personal information will be securely deleted within 1 month, unless you ask me to delete it sooner.

While you are accessing therapy

If you become a client, I will collect some personal information, including your name, address, date of birth, contact details.  This information is stored securely via a GDPR compliant digital platform and is only used to provide you with a safe and effective therapy service.  With your permission, I may use your email address or telephone number to contact you about appointments or to send information that is relevant to your therapy.  Your attendance and everything discussed in our sessions will remain confidential. There are some situations where confidentiality may need to be broken, for example if there is a serious risk of harm to you or someone else, or if I am required to disclose information by law. Wherever possible, I will discuss this with you first.  As part of good professional practice, I attend regular clinical supervision. I may discuss aspects of our work with my supervisor, but your identity will not be disclosed. My supervisor is also bound by professional standards of confidentiality.  I keep brief clinical notes to support our work together. These are intentionally minimal and don’t include personal details that would directly identify you. Instead, each client is given a unique reference number, and your notes are recorded and stored under this number only. This means your therapy notes are kept separate from your personal contact details and cannot be directly linked to you, and only I have access to them.  Any digital information is stored securely via a GDPR compliant digital device, and any paper notes or information is kept in a locked device that only I have access to. To protect your privacy further, you won’t be stored in my phone under your name. Instead, I use your reference number. Text messages are kept for no longer than 1 week before being securely deleted. If anything, clinically relevant comes up in a text, I’ll transfer that information into your anonymised clinical notes before deleting the message.  Email correspondence is kept for up to 2 weeks and then deleted. If an email contains clinically relevant information, I will add this to your anonymised clinical record and then delete the original email.

Emergency contact details

I will ask you to provide the details of an emergency contact when you begin therapy. These details will only be used if you become unwell or are injured during a session, or if there is a serious concern about your immediate safety.  Your emergency contact information will be stored securely and will not be used for any other purpose.

After Therapy has ended

Once therapy has ended, your records will be kept securely for 7 years to meet my legal, insurance and professional responsibilities. After this time, they will be securely destroyed.

Data Security

I take the security of the data that I hold about you very seriously. My email account is password protected and mobile phones and laptops used to respond to your emails are password protected and have anti-virus software.  

Your Rights

Under UK data protection law, you have the right to access the personal information I hold about you and to request that any inaccurate information is corrected. In some circumstances, you may also ask for your information to be deleted, for the way it is used to be restricted, or object to how it is processed.  If you would like to make a request regarding your personal information, please contact me in writing by email. I will always do my best to respond to your request in accordance with UK data protection law. However, there may be occasions where I am unable to comply, for example where I have a legal, professional or insurance obligation to retain records.  You can read more about your rights at ico.org.uk/your-data-matters 

Complaints

If you have any complaints about how I collect, use or store your personal information, please feel free to contact me on my email at lightpathcbt@gmail.com.  I will do my best to answer your questions and resolve any concerns promptly.  If you remain unhappy with how your personal information has been handled, you have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's independent authority for data protection. . For more information go to ico.org.uk/make-a-complaint.