Privacy Policy -The Private Therapy Practice

Hannah | NCPS Accredited Therapist | BA Hons Counselling & Psychotherapy

Rochford, Rayleigh, Southend & Online | privatetherapypractice.co.uk

Privacy Policy & Complaints Procedure

Last reviewed: June 2026 | Next review due: June 2027

Part 1: Privacy Policy

This privacy policy explains how I collect, use, store, and protect your personal information in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025. I take your privacy seriously and will only use your data to provide you with a safe and effective therapy service.

1. Who is responsible for your data?

Data Controller: Hannah Campbell

Trading as: The Private Therapy Practice

Address: Rochford, Essex

Email: hannah@privatetherapypractice.co.uk

Website: privatetherapypractice.co.uk

As a sole practitioner, I am the data controller for all personal information you share with me. I am registered with the Information Commissioner’s Office (ICO). Registration number: ZB655157

2. What information I collect

I may collect and hold the following types of information:

Contact and identification information:

• Your name, address, telephone number, and email address
• Emergency contact details
• Date of birth (where relevant)

Health and therapy-related information:

• Details of your physical and mental health are shared during sessions or on intake forms
• Session notes and records of our therapeutic work (Brief and non-identifying)
• Information about your GP or other healthcare providers (where relevant)
• Any risk-related information shared in the course of therapy

Administrative information:

• Payment records and invoices
• Appointment and cancellation records
• Communication records (email, voicemail, text message)

3. Why I collect this information and the lawful basis

Under UK GDPR, I need a lawful basis for processing your personal data. Here is how that applies to the information I hold:

Contract (Article 6(1)(b)):

Contact details, appointment records, and payment information are collected because they are necessary to provide you with the therapy service you have requested.

Legitimate interests (Article 6(1)(f)):

General case notes are kept in my legitimate interests as a practitioner, to ensure continuity and quality of care. This is balanced against your right to privacy.

Legal obligation (Article 6(1)(c)):

In some cases, I may be required by law to process or disclose your data, for example, where there is a serious risk of harm to you or others, or if required by a court order.

Special category data (Article 9(2)):

Health-related information is classified as special category data under UK GDPR. I process this under Article 9(2)(h) (health and social care purposes) and Article 9(2)(a) (your explicit consent, given via your therapy agreement).

4. How your information is stored and kept secure

I take the security of your data seriously. Here is how I keep your information safe:

• Written notes are stored in a locked filing cabinet or secure location, accessible only to me
• Digital records are kept on password-protected devices and encrypted where possible
• Email is used only for non-sensitive administrative communication; I do not send session content via unencrypted email
• Booking and scheduling is managed via SimplyBook.me, which uses secure encrypted servers
• I do not use your personal data for marketing purposes unless given permission (e.g. newsletter members)
• I will never sell your data to third parties

5. Who I might share your information with

Your information is kept confidential. In the ordinary course of therapy, I do not share your personal information with anyone outside of our work together. However, there are limited circumstances where I may need to:

• Clinical supervision: I discuss my casework with a qualified clinical supervisor as required by my professional code of ethics. This is done without using your full name or identifying details wherever possible.
• Safeguarding: If I have serious concerns about your safety or the safety of another person, I may be required to contact relevant agencies (such as emergency services or a GP). I will always aim to discuss this with you first unless doing so would put someone at risk.
• Legal obligations: If I am required to share information by a court order or law, I will comply.
• Third-party service providers: I use SimplyBook.me (booking) and MailerLite (email communication, where you have opted in). These providers are contractually obligated to keep your data secure and only use it as I direct.

I do not transfer your data outside of the UK or EEA unless appropriate safeguards are in place.

6. How long I keep your information

I retain your personal data only as long as necessary. In line with professional guidance from the NCPS:

• Adult therapy records are generally retained for 7 years after the end of therapy
• If you are under 18, records are retained until you reach the age of 25, or for 7 years after the end of therapy if that is later
• Contact details and payment records are held for the same period for administrative and legal purposes

After the retention period, records are securely destroyed (paper records shredded; digital files permanently deleted).

7. Your rights under UK GDPR

You have the following rights in relation to your personal data:

• Right to access: You can request a copy of the personal data I hold about you (a Subject Access Request, or SAR). I will respond within one calendar month.
• Right to rectification: You can ask me to correct any inaccurate or incomplete information.
• Right to erasure: In certain circumstances, you can ask me to delete your data. Note that professional and legal obligations may mean I need to retain some records.
• Right to restrict processing: You can ask me to limit how I use your data while a concern is being resolved.
• Right to data portability: Where data is processed by automated means, you can request it in a portable format.
• Right to object: You can object to processing carried out on the basis of legitimate interests.

To exercise any of these rights, please contact me at hannah@privatetherapypractice.co.uk. I will respond within one calendar month. There is no charge for reasonable requests.

If you are not satisfied with how I handle your request, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Website: ico.org.uk | Helpline: 0303 123 1113

8. Cookies and website data

My website (privatetherapypractice.co.uk) may use cookies to improve your browsing experience and to track visitor analytics. Where cookies are used, you will be given the option to accept or decline non-essential cookies. I do not use your website data to identify you personally.

If you sign up to receive my newsletter or lead magnet via MailerLite, your email address will be held by MailerLite. You can unsubscribe at any time using the link at the bottom of any email I send.

9. Changes to this policy

I review this privacy policy annually or whenever there are significant changes to the law or my practice. The current version will always be available on my website. If I make significant changes, I will notify existing clients by email.

Part 2: Complaints Procedure

I hope that your experience of working with me is a positive one. However, if something goes wrong or you feel unhappy with any aspect of the service I provide, I want you to feel able to say so. Feedback – including complaints – helps me to improve my practice and address any problems promptly.

This procedure applies to any complaint about the therapy service, my professional conduct, or how your personal data has been handled.

Step 1: Talk to me directly

In the first instance, I would encourage you to raise any concern with me directly – either during a session, or by contacting me by email or phone. Many concerns can be resolved quickly and informally through an open conversation.

I will always take your concerns seriously and aim to respond within 5 working days. I will listen without defensiveness and work with you to find a resolution.

Step 2: Making a formal complaint

If you feel your concern has not been resolved through informal discussion, or if you would prefer not to raise it with me directly, you can make a formal written complaint.

Please send your complaint to:

Email: hannah@privatetherapypractice.co.uk

Or use the contact form here.

Your complaint should include:

• Your name and contact details
• A clear description of the concern or complaint
• What has already been done to try to resolve it (if applicable)
• What outcome you are hoping for

I will acknowledge your complaint in writing within 5 working days and aim to provide a full response within 28 days. If I need more time, I will let you know why and keep you updated throughout.

Step 3: Escalating your complaint

If you are not satisfied with my response, or if your complaint relates to serious professional or ethical concerns, you have the right to escalate your complaint to my professional body:

National Counselling and Psychotherapy Society (NCPS)

Address: 19 Grafton Street, London, W1S 4EW

Website: ncps.com

Email: complaints@ncps.com

The NCPS has a formal Professional Conduct Procedure and can investigate complaints about registered therapists. Before contacting them, I would encourage you to attempt to resolve the matter directly with me first, as this is part of their process.

If your complaint specifically relates to how your personal data has been handled, you also have the right to contact the ICO (see Part 1, Section 7 above).

Confidentiality and records

Any formal complaint will be kept on file securely and confidentially. Records of complaints will be retained for 7 years and may be taken into account if a similar concern arises in the future. Information will only be shared where necessary to investigate or resolve the complaint.

My commitment to you

I am committed to handling all complaints fairly, promptly, and without prejudice. Making a complaint will not affect your right to continue with therapy if you choose to do so, nor will it affect the quality of care you receive.

This document was prepared for The Private Therapy Practice | privatetherapypractice.co.uk | June 2026