I am registered with the ICO (Information Commissioners Office) which means I need to tell you what data I am collecting from you and what I intend to do with it.
Practicalities and General Data Protection Regulation: May 2026
What data do I keep and why do I need it?
Will I share your data and if I do who will I share it with and for what purpose?
It is very unlikely that I will share your data. I will not sell it on or use it for unethical reasons. I may have to share if my notes are requested by court, if you or anyone you tell me about is at harm or risk of harm, I may have to pass this information on to your GP or the police.
I use a bookkeeper who may see information such as emails, payment information and contact details when doing other administrative activities. They will not see your client notes and are all registered with the ICO.
I have also appointed a Clinical Executor. In the unfortunate event I can no longer work with you they will have access to your details and will get in touch with you.
How will I store your data?
The form you fill in when you start working with me will be kept on my Cliniko account until we finish working together and then I will delete it.
I keep brief electronic notes that are stored on Cliniko which is password protected and not accessible by others.
The data on paper is kept in a locked filing cabinet. I transfer your name and a code to my password protected laptop and your phone numbers may be kept in my business mobile phone which is code protected.
I record all sessions as part of ongoing training and assessment, in preparation for a 5 minute piece that will be used in UKCP registration. The recording will be anonymised and remain safe and be coded. The recordings will be destroyed or wiped over as soon as the assessment is complete.
Group Work notes are stored under the group name not under each individual.
How long will I store your data for and how will I dispose of it?
I'll keep your session notes, your name and your unique code for 5 years which is the time frame my insurance company requests.
I'll shred or delete the document with your personal information on 1 month after our work finishes.
I'll delete your phone number out of my mobile phone 1 month after our work finishes.
You may decide to sign up to my newsletter and if you do that, I will keep your information through the sign-up form but that is separate to this agreement.
Is this different for EAP/Insurance clients?
Your EAP may have given me more information than I would normally collect for example where you work and registration numbers. Each EAP is different, so it depends on your EAP. I usually need this information when I am sending my invoice to your EAP as a way of recognising your case. This information is usually in the format of an email, and I will delete this extra data once your EAP has reimbursed me for our work together.
If you are not happy with the way I use your data, you can complain to ICO at www.ico.org.uk or phone them on 0303 123 1113.
