I am committed to protecting your privacy and handling your personal information fairly, lawfully, and transparently.

This Privacy Policy explains how I collect, use, store, protect, and share your personal information when you visit my website, contact me, or receive therapy services from me.

I comply with:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Privacy and Electronic Communications Regulations (PECR), where applicable 

Definitions

I've included these definitions to help explain some of the terms used throughout this Privacy Policy. My aim is to make the information as clear and easy to understand as possible.

Personal Data

Personal data is any information that can identify you, either directly or indirectly. This may include your name, email address, telephone number, home address, or any other information that relates to you.

Processing

Processing simply means anything I do with your personal information. This includes collecting it, storing it, organising it, updating it, using it, sharing it when necessary, and securely deleting it when it is no longer required.

Data Controller

A Data Controller is the person or organisation responsible for deciding why and how personal information is collected and used. For the purposes of this website and my therapy practice, I am the Data Controller.

UK GDPR

The UK General Data Protection Regulation (UK GDPR) is the law that sets out how I must collect, use, store, and protect your personal information.

Consent

Consent means that you have freely given your permission for me to use your personal information for a specific purpose. If I rely on your consent to process your information, you can withdraw that consent at any time.

Legitimate Interests

Legitimate interests are lawful reasons that allow me to process personal information where it is necessary to run my practice or provide my services, provided that your rights and freedoms are not overridden.

Cookies

Cookies are small text files that are stored on your computer, tablet, or mobile device when you visit my website. They help the website work properly and may also remember your preferences or help me understand how visitors use the site.

Third Parties

Third parties are organisations or individuals who provide services that help me run my practice. This may include website hosting providers, secure email providers, payment processors, accountants, or IT support providers. Where I use third parties, I take reasonable steps to ensure they also protect your personal information.

ICO (Information Commissioner's Office)

The Information Commissioner's Office (ICO) is the UK's independent authority responsible for upholding information rights and enforcing data protection laws. If you have concerns about how I handle your personal information, you have the right to contact the ICO.

Data Subject

A Data Subject is the individual whose personal information is being collected or processed. Throughout this Privacy Policy, this simply means you.

Data Breach

A data breach is a security incident that results in personal information being accidentally or unlawfully lost, accessed, altered, disclosed, or destroyed. If a serious breach occurs, I have legal obligations to respond appropriately and, where required, report it to the relevant authorities.

Retention Period

A retention period is the length of time I keep your personal information before it is securely deleted or destroyed in line with legal, professional, and regulatory requirements.

Who I Am

Data Controller

I am the Data Controller for the personal information collected through this website and my therapy practice.

Name: SDR Talking Therapies

Email: sammy@sdrtalkingtherapies.co.uk

Telephone: 07931799063

Website: www.sdrtalkingtherapies.co.uk

Being the Data Controller means I decide how and why your personal information is collected and used.

The Information I Collect

Depending on how you interact with me, I may collect the following information.

Information You Provide

I may collect:

• Your name
• Email address
• Telephone number
• Postal address
• Date of birth (where appropriate)
• GP details (if you choose to provide them)
• Emergency contact details
• Information you include in my contact form or emails
• Information shared during therapy sessions
• Appointment records
• Payment information (excluding full payment card details where payments are processed securely by a third party)

Information Collected Automatically

When you visit my website, I may automatically collect information such as:

• IP address
• Browser type
• Device information
• Operating system
• Pages viewed
• Date and time of your visit
• Cookie information (where applicable)

Why I Collect Your Information

I use your personal information to:

• Respond to your enquiries
• Arrange appointments
• Provide counselling or psychotherapy
• Maintain confidential client records
• Process payments and issue invoices
• Meet my professional and legal obligations
• Improve my website
• Protect clients where safeguarding concerns arise
• Prevent fraud or misuse of my services

My Lawful Basis for Processing

Under UK GDPR, I rely on the following lawful bases.

Article 6

I process your personal information where necessary for:

• Your consent
• Performing my contract with you
• Meeting legal obligations
• My legitimate interests in running my practice responsibly

Article 9 (Special Category Data)

Where I process health-related information, I rely on:

• Your explicit consent where appropriate
• The provision of health or social care
• The establishment, exercise, or defence of legal claims

How I Store Your Information

I take appropriate technical and organisational measures to keep your personal information secure.

These measures may include:

• Password-protected devices
• Encrypted digital storage
• Secure cloud storage
• Secure email services where possible
• Locked storage for paper records
• Up-to-date security software
• Restricted access to client information

Only I, and any trusted service providers who need access to support my practice, can access your personal information.

How Long I Keep Your Information

I only keep your information for as long as necessary.

Typical retention periods are:

• Website enquiries – up to 12 months
• Client therapy records – generally 7 years after therapy ends
• Children's records – until the client's 25th birthday where applicable
• Financial records – 6 years to comply with HMRC requirements

I may retain information for longer where required by law, my insurer, or my professional membership body.

Who I May Share Your Information With

I never sell your personal information.

I may share information only where necessary with:

• Your GP (with your consent unless safeguarding or legal obligations apply)
• My clinical supervisor (using anonymised information wherever possible)
• My professional indemnity insurer
• My accountant
• My legal advisers
• Secure IT providers
• Secure payment providers
• Regulatory or law enforcement authorities where legally required

Where I use third-party providers, I take reasonable steps to ensure they protect your information appropriately.

International Transfers

If any of the organisations I use store or process personal information outside the United Kingdom, I will ensure that appropriate safeguards are in place, such as approved international transfer agreements or countries recognised as providing an adequate level of protection.

Cookies

My website may use cookies to:

• Make the website function correctly
• Remember your preferences
• Help me understand how visitors use my website
• Improve the performance of my website

Where required by law, I will ask for your consent before placing non-essential cookies on your device.

Website Analytics

I may use website analytics tools, such as Google Analytics, to understand how visitors use my website.

These tools collect information anonymously wherever possible and help me improve the website. Analytics cookies will only be used where you have given your consent.

Your Rights

Under UK GDPR, you have the right to:

• Be informed about how I use your information
• Request access to your personal information
• Ask me to correct inaccurate information
• Request that I erase your information where appropriate
• Restrict how I process your information
• Object to certain types of processing
• Receive a copy of your information in a portable format where applicable
• Withdraw your consent where I rely on it
• Not be subject to decisions based solely on automated processing

If you wish to exercise any of these rights, please contact me using the details above.

I aim to respond within one calendar month.

Data Security

I take data security seriously and use appropriate measures to protect your personal information.

Although I work hard to protect your information, no method of transmitting information over the internet or storing information electronically can ever be completely secure. For this reason, I cannot guarantee absolute security, but I continually review my security measures to minimise risks.

Children's Privacy

I do not knowingly collect personal information from children through my website without appropriate consent.

Where I provide therapy to children or young people, I will do so in accordance with applicable legal, ethical, and professional requirements.

Links to Other Websites

My website may contain links to other websites.

I am not responsible for the privacy practices of those websites and encourage you to read their privacy policies before providing any personal information.

Complaints

If you have any concerns about how I handle your personal information, I encourage you to contact me first so I have the opportunity to address your concerns.

You also have the right to complain to the Information Commissioner's Office (ICO) if you believe I have not handled your personal information in accordance with data protection law.

Information Commissioner's Office

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

Website: https://ico.org.uk

Changes to This Privacy Policy

I may update this Privacy Policy from time to time to reflect changes in my practice, legal requirements, or how I process personal information.

The latest version will always be available on my website, and the "Last Updated" date at the top of this policy will show when changes were made.

Contact Me

If you have any questions about this Privacy Policy or how I use your personal information, please contact me.

SDR Talking Therapies

sammy@sdrtalkingtherapies.co.uk

07931799063