Privacy notice

1. Information I may collect

I only collect information needed to assess suitability, deliver therapy safely and run the practice. This may include:

• Identity and contact details, including name, address, telephone number, email and date of birth.
• Health and therapy information, including assessments, clinical notes, outcome measures, formulations, treatment plans, risk and safeguarding information.
• GP and emergency-contact details where required for safe remote practice.
• Appointment, billing and transaction information, but not full bank-card details.
• Messages and correspondence with the practice.
• Limited technical and website-use data when analytics cookies are accepted.
• Anonymised or minimally identifying material used in clinical supervision.

2. Why I use it and the lawful bases

Information is used to respond to enquiries, assess suitability, provide and review CBT, arrange appointments and payment, manage risk, maintain professional records and meet legal or regulatory duties.

Depending on the purpose, the lawful bases under UK GDPR include performance of a contract or steps requested before a contract (Article 6(1)(b)), legitimate interests in safely administering and defending the practice (Article 6(1)(f)), legal obligation (Article 6(1)(c)) and consent for optional analytics (Article 6(1)(a)). Special-category health information is processed for the provision and management of health care under Article 9(2)(h), with relevant Data Protection Act 2018 safeguards.

3. Sharing information

I do not sell personal information. It may be shared only where necessary with:

• A clinical supervisor, anonymised or minimised wherever possible.
• Service providers supporting secure communication, video sessions, record keeping, banking or practice administration, under appropriate arrangements.
• A GP, emergency contact, safeguarding service or emergency service where needed to manage a serious safety concern.
• Professional bodies, insurers, accountants, HM Revenue & Customs, courts or law-enforcement bodies where required.

4. International processing

Some technology providers may process information outside the UK. Where this occurs, I take reasonable steps to use providers and safeguards recognised under UK data-protection law.

5. Retention and security

Clinical records are normally kept for eight years after the final session for adults. Records for clients who were under 18 are normally kept until their 25th birthday, or 26th birthday if they were 17 when therapy ended. Financial records are normally retained for at least six years. More detail is available in the data retention schedule.

Reasonable technical and organisational measures are used to protect information, including access controls, secure systems and confidentiality procedures. No online system can be guaranteed completely risk-free.

6. Your rights

Depending on the circumstances, you may have rights to access, correct or erase your information; restrict or object to processing; request portability; and withdraw consent where consent is relied on. Some rights may be limited by legal, clinical or professional record-keeping duties.

To make a request, email calmbreathingtherapies1@gmail.com. You may also complain to the Information Commissioner’s Office.

7. Website analytics, videos and changes

Google Analytics is not loaded unless you accept analytics cookies. You can change that choice through “Cookie settings” in the footer. My own videos and their previews are hosted directly with the site. The separate Mind CBT video connects to YouTube only when you press Play; YouTube then receives technical information such as your IP address and browser details. Analytics is not required to watch either kind of video. The website hosting service receives the technical information needed to deliver website files. Social links open their respective platforms only when followed. See the video privacy explanation. Please use the callback form, email or WhatsApp for therapy enquiries, and avoid sending personal health information in public social-media comments. This notice may be updated when the law, technology providers or practice arrangements change.

8. Callback requests

The callback form collects your first name, telephone number, optional email address and preferred times, voicemail permission, and any support options or short explanation you choose to provide. Support information is optional and may include health information. You can leave it blank and discuss your needs on the call.

With your consent, I use this information to respond to your enquiry and arrange a conversation. Consent is the basis for processing the callback request (Article 6(1)(a)) and any health information voluntarily included (Article 9(2)(a)). You can withdraw consent by contacting me; this does not affect processing already carried out. If therapy follows, the bases described above apply to clinical care and required records.

Netlify Forms processes and stores submissions for the practice, with notifications sent to the practice’s Gmail inbox. These providers may process information outside the UK. No clinical details are sent to website analytics; analytics is not loaded on the callback or confirmation page. Information is not used for marketing.

Callback enquiries follow the enquiries retention schedule, including relevant copies in Netlify and email. Please do not include detailed medical histories or information identifying other people. The form is not continuously monitored and is not suitable for emergencies.