Privacy notice

1. Information I may collect

I only collect information needed to assess suitability, deliver therapy safely and run the practice. This may include:

• Identity and contact details, including name, address, telephone number, email and date of birth.
• Health and therapy information, including assessments, clinical notes, outcome measures, formulations, treatment plans, risk and safeguarding information.
• GP and emergency-contact details where required for safe remote practice.
• Appointment, billing and transaction information, but not full bank-card details.
• Messages and correspondence with the practice.
• Limited technical and website-use data when analytics cookies are accepted.
• Anonymised or minimally identifying material used in clinical supervision.

2. Why I use it and the lawful bases

Information is used to respond to enquiries, assess suitability, provide and review CBT, arrange appointments and payment, manage risk, maintain professional records and meet legal or regulatory duties.

Depending on the purpose, the lawful bases under UK GDPR include performance of a contract or steps requested before a contract (Article 6(1)(b)), legitimate interests in safely administering and defending the practice (Article 6(1)(f)), legal obligation (Article 6(1)(c)) and consent for optional analytics (Article 6(1)(a)). Special-category health information is processed for the provision and management of health care under Article 9(2)(h), with relevant Data Protection Act 2018 safeguards.

3. Sharing information

I do not sell personal information. It may be shared only where necessary with:

• A clinical supervisor, anonymised or minimised wherever possible.
• Service providers supporting secure communication, video sessions, record keeping, banking or practice administration, under appropriate arrangements.
• A GP, emergency contact, safeguarding service or emergency service where needed to manage a serious safety concern.
• Professional bodies, insurers, accountants, HM Revenue & Customs, courts or law-enforcement bodies where required.

4. International processing

Some technology providers may process information outside the UK. Where this occurs, I take reasonable steps to use providers and safeguards recognised under UK data-protection law.

5. Retention and security

Clinical records are normally kept for eight years after the final session for adults. Records for clients who were under 18 are normally kept until their 25th birthday, or 26th birthday if they were 17 when therapy ended. Financial records are normally retained for at least six years. More detail is available in the data retention schedule.

Reasonable technical and organisational measures are used to protect information, including access controls, secure systems and confidentiality procedures. No online system can be guaranteed completely risk-free.

6. Your rights

Depending on the circumstances, you may have rights to access, correct or erase your information; restrict or object to processing; request portability; and withdraw consent where consent is relied on. Some rights may be limited by legal, clinical or professional record-keeping duties.

To make a request, email calmbreathingtherapies1@gmail.com. You may also complain to the Information Commissioner’s Office.

7. Website analytics and changes

Google Analytics is not loaded unless you accept analytics cookies. You can change that choice through “Cookie settings” in the footer. This notice may be updated when the law, technology providers or practice arrangements change.