Introduction
I run a private psychotherapy practice, and in order to do that I need to collect and store some information about my clients. This privacy policy sets out what data I collect, how I use it, how I store it, and how long I keep it for. It also has information about your rights and how to complain. I adhere to all relevant data protection legislation, including but not limited to the UK General Data Protection Regulation, the Data Protection Act 2018, and the Privacy and Electronic Communications (EC Directive) Regulation 2003.
I aim to be as transparent as possible about how I use your personal information, so if you have any questions or concerns please contact me at rachelmcdonaldtherapy@imapmail.org or 07955 839570.
What personal data I collect
When you contact me to enquire about working with me, I will keep a note of your name, contact details, the date you contacted me, and the date of our initial phone call. If we go on to work together, I will keep this information, and the dates and times of your sessions while you are my client. This information will be kept securely in Google Drive.
I keep brief notes about each session, including our initial phone call. These cover the main themes of each session (e.g. family dynamics or current relationships) and brief information about you (e.g. if you have siblings). This information is kept on paper, which will be stored securely.
How I use your personal data
I use your personal information to facilitate the process of therapy only, and rely on a lawful basis of Legitimate Interest to do this.
Some transactional data regarding your payments to me are kept to meet HMRC requirements, and I rely on a lawful basis of Legal Obligation for this.
I do not use any personal data for marketing, or any other purposes.
Third parties & data sharing
For ethical and clinical reasons, I have regular supervision with another qualified therapist. I will share some basic details, such as your first name, with them, and they may record this in order to facilitate effective supervision.
In exceptional circumstances, if I believe you or someone else is at immediate risk of harm I may decide it is necessary to share some information about you with the emergency services or social services. I will always do my best to discuss this with you first.
If you are involved in a criminal trial I may be legally required to share information about our work together with official parties of the trial, such as the Crown Prosecution Service. I will do my best to inform you if this happens.
In the event of my death or incapacitation, names and contact details of my current clients will be shared with a trusted colleague who is a qualified therapist, in order for them to contact you to let you know about my circumstances.
Data retention periods
If you enquire but we do not go on to work together, I will keep your details for 6 months then securely delete them. If you ask to be added to my waiting list, I will keep your details for 1 year.
If we do work together, I will keep your contact details, sessions dates and times, and my brief notes for as long as you are my client, and for 7 years after you finish working with me, then they will be securely deleted.
Your rights
You have a number of rights under UK data protection law, including:
- Right to be informed: You have the right to be informed about the collection and use of your personal data, and I am required to ensure that I am transparent about how I use your information. I use this Privacy Policy and verbal communication to explain how I use your personal information.
- Right of access: You have the right to access and receive a copy of your personal data from me. I may require you to confirm your identity before providing you with your data.
- Right to rectification: You have the right to have inaccurate personal data rectified or completed if it is incomplete. You can also ask me to check the personal information I hold about you if you are unsure whether it is up to date.
- Right to erasure: You have the right to have personal data erased, otherwise known as the ‘right to be forgotten’. I may have an overriding legitimate reason to not delete all of your personal data, such as to comply with a legal obligation in the case of financial records.
You can find full details of all your rights on the ICO’s website: https://ico.org.uk/for-the-public/
How to complain
If you are unhappy with how I have stored or used your personal information, or with how I have responded to your questions or concerns regarding your data, please contact me so I resolve it with you:
rachelmcdonaldtherapy@imapmail.org
07955 839570
If you are still unhappy, you have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator. Details of how to complain, including their contact details, are on their website: https://ico.org.uk/make-a-complaint/.
Updates to this Data Privacy Policy Statement
This Data Privacy Policy Statement will be updated as and when necessary. Any changes to this Data Privacy Policy Statement will become effective as of the date it is published, or as otherwise required by law.
Last updated
21 April 2025
Cookies
What are cookies?
Cookies are simple text files that are stored on your computer or mobile device by a website’s server. Each cookie is unique to your web browser. It will contain some anonymous information such as a unique identifier, website’s domain name, and some digits and numbers.
What types of cookies do I use?
Analytical cookies
These cookies enable me and third-party services to collect aggregated data for statistical purposes on how my visitors use the website. These cookies do not contain personal information such as names and email addresses and are used to help me improve your user experience of the website.
How to delete cookies?
If you want to restrict or block the cookies that are set by my website, you can do so through your browser setting.
Contacting me
If you have any questions about this cookie policy or my use of cookies, please contact rachelmcdonaldtherapy@imapmail.org