Lawful Basis for Processing

I process personal data under the lawful basis of:

• Contract – to provide therapy services

• Legitimate interest – to maintain records and ensure safe practice

• Legal obligation – in cases of safeguarding or legal reporting

As part of our work together, I may also collect and process sensitive personal information (known as “special category data”), such as health-related details, identity, or background. This is done in accordance with UK GDPR, under the additional condition of health care provision (Article 9(2)(h)).

How Your Information Is Stored

Client information is stored securely in password-protected, encrypted digital files. I do not store paper records. Devices used to access client data are encrypted and protected by secure passwords.

I retain client records for seven years after therapy ends, in line with professional guidance. After this period, records are securely deleted.

Sharing of Information

I do not sell or share your personal information. I may share information if required by law, or if I have serious concerns about your safety — in which case I may contact your GP or other relevant services, as outlined in our therapy agreement. I may also consult my professional supervisor for guidance, without identifying details.