Privacy and Data Protection
You can request my full list of Policies and Procedures at any appointment. Copies are available to view in my therapy room.
What is the General Data Protection Regulations, 2018 (GDPR) and how does it affect me?
The GDPR (UK) replaces the 1998 Data Protection Act to ensure your personal, sensitive, and confidential data is kept private and held securely, being processed in the way that you have agreed to. It is there to protect your rights as a consumer of a service or product that might involve your identifiable data, e.g. your name and address or whether you have a specific condition. It also covers any session records, text messages or emails we exchange. For more information you can read the policy documents accessible during your initial consultation or subsequent appointments.
I am registered with the Information Commissioner's Office (ICO). My registration number is ZA406997
Personal data I collect
I collect and process the following types of personal data:
How I collect your data
I collect your personal data directly from you:
Why I process your data — lawful basis
To process your personal data lawfully under UK GDPR, I rely on the following legal bases:
Article 6 basis (ordinary personal data): Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us. When you engage me as your therapist, we enter into a contract for therapeutic services. I need to process your personal data to deliver those services effectively.
Professional obligations and CPD
I am required by the NCH and the BACP to attend regular clinical supervision. This is an essential part of maintaining high standards of practice and ensuring I provide you with safe, effective therapy.
I may discuss our therapeutic work with my supervisor. When I do so:
What lengths are made to ensure my information is held securely?
Hardcopy documents – Are all stored in a locked cabinet in a locked room.
Text messages – My work phone is secured with a pin code.
Emails – My email account requires a user name and password.
Email attachments – Any attachments sent by email to you containing your personal information would be password protected and the password would be sent to you via text message.
Electronic documents – Any electronic document e.g. a letter to your GP, or an invoice, are password protected and stored on a password protected computer if they contain personal or sensitive information.
Is what we discuss kept confidential?
Everything we talk about during our sessions are strictly confidential between you and me. To ensure I am doing my job effectively and that I have the right support, I may discuss elements of our sessions with my supervisor who receives anonymised case material only (no names or identifying details).
Confidentiality exceptions
Everything you share with me in therapy is confidential. However, there are rare circumstances where I may need to share information without your consent:
What if I see you outside of the session?
If we see each other outside of a session I will smile but will not engage in any further conversation to ensure your confidentiality. You are welcome to share with other people about the therapy you are receiving, but I am obligated by GDPR law to ensure your confidentiality is protected. I would request that in order to ensure the success of your treatment, that you refrain from discussing your treatment with me outside of your sessions.
What about other Health and Social Care Professionals?
As I adhere to the GDPR any contact, relating to you, with other health care professionals would only be made with your signed consent. E.g. If I were to write to your GP to notify them of your treatment with me and then notify them of the treatment ending; I would only do this if you were to sign specific consent for this.
How long is data kept for?
I keep your personal data for as long as necessary to fulfil the purposes for which it was collected, and in line with legal and professional requirements:
Unless you are a child, in which case I must hold your data until your 25th birthday, unless you are 17 when treatment ends and then I must keep it until your 26th birthday. Therefore, all records will be deleted in the January after the above retention scales. This is in line with NHS regulations for holding data.
After the applicable retention period ends, I securely destroy your records. Paper records are shredded using a cross-cut shredder. Electronic records are permanently deleted using secure deletion software.
Your rights under UK GDPR
You have the following rights regarding your personal data:
Data protection complaints — your right under the Data (Use and Access) Act 2025
You have the right to make a data protection complaint directly to me. I take all complaints seriously and will investigate promptly.
To submit a complaint:
Contact: www.tracydanielstherapies.co.uk
Email: [email protected]
I will acknowledge your complaint within 7 days and aim to resolve it within 28 days.
If you are not satisfied with my response, you may escalate your complaint to the Information Commissioner's Office (ICO):
What is the General Data Protection Regulations, 2018 (GDPR) and how does it affect me?
The GDPR (UK) replaces the 1998 Data Protection Act to ensure your personal, sensitive, and confidential data is kept private and held securely, being processed in the way that you have agreed to. It is there to protect your rights as a consumer of a service or product that might involve your identifiable data, e.g. your name and address or whether you have a specific condition. It also covers any session records, text messages or emails we exchange. For more information you can read the policy documents accessible during your initial consultation or subsequent appointments.
I am registered with the Information Commissioner's Office (ICO). My registration number is ZA406997
Personal data I collect
I collect and process the following types of personal data:
- Contact details — your name, address, telephone number, and email address.
- Health and therapy-related information — presenting issues, relevant history.
- Session notes — records of our therapeutic work together, including my observations and any goals or progress discussed.
- Emergency contact details — name and contact information for someone I can reach in an emergency.
- Enquiry details — information you submit via the contact form on my website.
How I collect your data
I collect your personal data directly from you:
- When you first make contact with me (by phone, email, or through my website contact form).
- During our initial consultation and intake process.
- Throughout our therapeutic sessions together.
- Through any ongoing communication between sessions (email, telephone, or messaging).
Why I process your data — lawful basis
To process your personal data lawfully under UK GDPR, I rely on the following legal bases:
Article 6 basis (ordinary personal data): Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us. When you engage me as your therapist, we enter into a contract for therapeutic services. I need to process your personal data to deliver those services effectively.
Professional obligations and CPD
I am required by the NCH and the BACP to attend regular clinical supervision. This is an essential part of maintaining high standards of practice and ensuring I provide you with safe, effective therapy.
I may discuss our therapeutic work with my supervisor. When I do so:
- Your name and any identifying details are not shared with my supervisor.
- I use anonymised or pseudonymised case material only.
- My supervisor is a qualified professional bound by the same confidentiality obligations as me.
- My supervisor is bound by their own professional body's ethical framework.
What lengths are made to ensure my information is held securely?
Hardcopy documents – Are all stored in a locked cabinet in a locked room.
Text messages – My work phone is secured with a pin code.
Emails – My email account requires a user name and password.
Email attachments – Any attachments sent by email to you containing your personal information would be password protected and the password would be sent to you via text message.
Electronic documents – Any electronic document e.g. a letter to your GP, or an invoice, are password protected and stored on a password protected computer if they contain personal or sensitive information.
Is what we discuss kept confidential?
Everything we talk about during our sessions are strictly confidential between you and me. To ensure I am doing my job effectively and that I have the right support, I may discuss elements of our sessions with my supervisor who receives anonymised case material only (no names or identifying details).
Confidentiality exceptions
Everything you share with me in therapy is confidential. However, there are rare circumstances where I may need to share information without your consent:
- Risk of serious harm — If I believe you or someone else is at immediate risk of serious harm, I may need to contact emergency services or other appropriate authorities.
- Safeguarding concerns — If I become aware of concerns about a child or vulnerable adult being harmed or at risk of harm, I have a legal and ethical duty to report this to the relevant authorities.
- Court order — If a court orders me to disclose information, I am legally required to comply.
What if I see you outside of the session?
If we see each other outside of a session I will smile but will not engage in any further conversation to ensure your confidentiality. You are welcome to share with other people about the therapy you are receiving, but I am obligated by GDPR law to ensure your confidentiality is protected. I would request that in order to ensure the success of your treatment, that you refrain from discussing your treatment with me outside of your sessions.
What about other Health and Social Care Professionals?
As I adhere to the GDPR any contact, relating to you, with other health care professionals would only be made with your signed consent. E.g. If I were to write to your GP to notify them of your treatment with me and then notify them of the treatment ending; I would only do this if you were to sign specific consent for this.
How long is data kept for?
I keep your personal data for as long as necessary to fulfil the purposes for which it was collected, and in line with legal and professional requirements:
- Therapy records (including session notes, assessments, and correspondence) are kept for 7 years after our last session in line with the Limitation Act 1980 and standard professional indemnity insurance requirements.
- Financial records (invoices, payment records) are kept for 6 years - Legal requirement under HMRC rules.
- Website enquiries (where you did not become a client) are kept for 12 months - To respond to your enquiry and follow up, if needed.
Unless you are a child, in which case I must hold your data until your 25th birthday, unless you are 17 when treatment ends and then I must keep it until your 26th birthday. Therefore, all records will be deleted in the January after the above retention scales. This is in line with NHS regulations for holding data.
After the applicable retention period ends, I securely destroy your records. Paper records are shredded using a cross-cut shredder. Electronic records are permanently deleted using secure deletion software.
Your rights under UK GDPR
You have the following rights regarding your personal data:
- Right to be informed — You have the right to know how I collect and use your personal data. This privacy policy fulfils that right.
- Right of access — You can request a copy of the personal data I hold about you. This is known as a Subject Access Request (SAR). Under the Data (Use and Access) Act 2025, I will conduct a reasonable and proportionate search to locate your data and respond within one month.
- Right to rectification — If any personal data I hold about you is inaccurate or incomplete, you can ask me to correct it.
- Right to erasure — In certain circumstances, you can ask me to delete your personal data. However, this right does not apply where I need to keep records for professional indemnity insurance purposes or to comply with legal obligations.
- Right to restrict processing — You can ask me to limit how I use your data in certain circumstances, for example while I verify its accuracy.
- Right to data portability — Where technically feasible, you can request that I transfer your data to another service provider in a structured, commonly used format.
- Right to object — You can object to certain types of processing, though this is unlikely to apply to therapy records processed under contract and health purposes.
- Rights related to automated decision-making — I do not use automated decision-making or profiling in my practice.
Data protection complaints — your right under the Data (Use and Access) Act 2025
You have the right to make a data protection complaint directly to me. I take all complaints seriously and will investigate promptly.
To submit a complaint:
Contact: www.tracydanielstherapies.co.uk
Email: [email protected]
I will acknowledge your complaint within 7 days and aim to resolve it within 28 days.
If you are not satisfied with my response, you may escalate your complaint to the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Telephone: 0303 123 1113
- Address: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF