Privacy Policy
Why this matters
As a therapist, confidentiality and trust are at the heart of everything I do. That includes how I handle your personal data. This privacy policy explains what information I collect from you, why I collect it, how I store it, and what your rights are. It's here to give you clarity.
What data do I collect?
When you get in touch, I may collect:
- Your name, contact details and date of birth
- Background about why you’re seeking therapy
- Emergency contact information
- GP details (if you choose to share them)
- Any written communication we exchange (texts, emails)
- Session notes (see below)
What do I write down?
After each session, I write short, anonymised notes. These help me reflect and keep track of the work we're doing together. I do not record sensitive information beyond what's relevant for our therapeutic work.
How is your data stored?
All personal data and session notes are stored securely and electronically in a password-protected, encrypted system that only I have access to.
What’s the legal basis for holding your data?
Under UK GDPR, the lawful basis for processing your data is:
- Contractual: so I can provide you with therapeutic services
- Legitimate interest: to maintain secure and ethical clinical records
- Vital interests: in the rare case of a serious risk to your life or someone else’s
- Legal obligation: where I’m required to report safeguarding or criminal concerns
Who do I share your information with?
- Supervision: I discuss client work anonymously with a clinical supervisor, as ethically required, to support good practice.
- Safeguarding / risk: If I believe you or someone else is at serious risk, I may need to break confidentiality - ideally with your knowledge and consent.
- Legal obligation: If compelled by a court of law or relevant authority.
Website contact form
When you use the contact form on this website, the information you provide - including your name, email address and message - is processed by Formspree so that your enquiry can be delivered to me. Formspree acts as a service provider for the contact form and may process and store submission data on its systems. Please avoid including highly sensitive or urgent medical information in the contact form. If you prefer, you can contact me directly by telephone or email.
How long do I keep your information?
In line with current guidance, I retain client records for 7 years after our work ends (or until a child client turns 25, whichever is longer). After that, your data will be securely deleted or destroyed.
Your rights
You have the right to:
- Request to see the data I hold about you
- Ask for any inaccuracies to be corrected
- Request your data to be deleted (in some cases)
- Withdraw your consent at any time (where applicable)
To request access or raise concerns, please contact me directly at tom@tommortimer.co.uk.
Working with children and young people
When working with clients under 18, I may hold limited information about the parent/carer as well as the child. Consent is usually obtained from both where appropriate. All safeguarding responsibilities are upheld in line with legal and ethical standards.
Updates to this policy
This policy may be updated from time to time to stay in line with regulations or changes to my practice. The most recent version will always be available upon request or on my website.