How I use and protect your information

I am committed to providing a safe, confidential and respectful service. This notice explains what information I collect, why I collect it, and how it is protected in line with UK GDPR, the Data Protection Act 2018, and the new requirements coming into force on 19 June 2026.

1. Who I am

I am an independent art psychotherapist and creative wellbeing practitioner based in the UK. I am the data controller for all personal information you share with me.

2. What information I collect

To provide therapy or wellbeing support, I may collect:

• Your name and contact details
• Emergency contact information
• Relevant health or wellbeing information
• Notes from sessions
• Artwork created during sessions
• Emails or messages you send me
• Payment and invoicing information

This may include special category data (e.g., mental health information).

3. Why I collect your information

I collect and use your information to:

• Provide therapy or wellbeing services
• Maintain safe, ethical practice
• Manage appointments and communication
• Keep clinical records
• Meet legal and professional obligations

My lawful bases for processing are Contract, Legitimate Interests, Legal Obligation, and Vital Interests. For special‑category data, I rely on Article 9(2)(h) (health and social care).

4. Confidentiality and when information may be shared

Everything you share is confidential. I will only share information if:

• You or someone else is at risk of serious harm
• I am legally required to (e.g., court order, coroner)
• You give clear consent
• Required for professional supervision (anonymised)
• Required for insurance or HMRC (administrative data only)

I never sell or share your information for marketing.

5. How your information is stored

I use secure, encrypted systems to protect your information:

• Encrypted digital storage
• Password‑protected devices
• Locked storage for any paper notes
• Secure email where possible

6. How long your information is kept

• Adults: 7 years after our final session
• Children/young people: until age 25 (or 26 if seen at 17)
• Financial records: 6 years
• Complaints: 6 years (new legal requirement from 19 June 2026)

7. Your rights

You have the right to:

• Access your information
• Correct inaccurate information
• Request deletion (where legally possible)
• Restrict or object to processing
• Receive a copy of your data in a portable format
• Make a complaint about how your data is handled

8. How to raise a concern or complaint

If you have concerns about how your information is used, you can contact me directly.

I will:

• Acknowledge your concern within 30 days
• Provide a full response within 3 months
• Keep a record of the complaint for 6 years

If you are not satisfied, you can contact the Information Commissioner’s Office (ICO): ico.org.uk

9. Updates to this notice

This notice is reviewed regularly and updated to reflect changes in law and best practice, including the Data (Use and Access) Act 2025 coming into force on 19 June 2026.