How we handle your information
Privacy Policy
Last updated: 8 June 2026
This document explains how eastkenttherapy.co.uk collects, stores, and protects your personal data in line with UK GDPR and the Data (Use and Access) Act 2025.
Who we are
This privacy policy explains how eastkenttherapy.co.uk collects, uses, and protects your personal data. I am John W Taylor, a qualified counsellor/psychotherapist in private practice, and I am the data controller for the personal information you provide to me. Contact: [email protected]
What personal data we collect
I collect and process the following categories of personal data: contact details (your name, email address, telephone number, and postal address); health and therapy-related information (details about your mental health, emotional wellbeing, presenting issues, and relevant medical history); session notes (records of our therapeutic work together, including observations, themes discussed, and progress); background information (relevant personal, family, or relationship history that you share with me); and enquiry details (information you submit via the website contact form). Health and therapy-related information is classified as special category data under Article 9(1) of the UK GDPR and receives enhanced legal protection.
How we collect your data
I collect your personal data directly from you: when you first contact me to enquire about therapy; during our initial consultation and intake process; throughout our therapy sessions together; via email, telephone, or the contact form on my website; and when you provide updates or additional information relevant to your therapy. I do not collect personal data about you from third parties without your knowledge and consent.
Why we process your data — lawful basis
UK GDPR requires me to have a valid legal reason for processing your personal data. Article 6 basis (general personal data): Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us. Article 9 basis (special category health data): Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional. The additional condition required by UK law is found in DPA 2018 Schedule 1, Part 1, paragraph 2. Processing is carried out by a qualified counsellor/psychotherapist bound by the BACP Ethical Framework.
Professional obligations and CPD
I am required by BACP to attend regular clinical supervision. I may discuss our therapeutic work with my supervisor using anonymised or pseudonymised case material only. My supervisor is a qualified professional bound by the same confidentiality obligations and their own professional body's ethical framework. Supervision discussions focus on the therapeutic process and my professional development, not on identifying you personally.
Who we share your data with
I use the following third-party services which may process your data: WordPress (my website platform); WebHealer (my website provider); and Zoom (for online therapy sessions). Each is bound by a data processing agreement. The only person with access to information about our work is my clinical supervisor, who receives anonymised case material only. I never sell your personal data or share your identifiable information with third parties for marketing purposes.
International data transfers
Some third-party services may transfer personal data outside the United Kingdom. WordPress (Automattic Inc, USA) and Zoom (Zoom Video Communications Inc, USA) may transfer data to the USA. WebHealer (UK) makes no international transfer. Where data is transferred to the USA, I rely on Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs) as safeguards under UK GDPR Chapter V and the Data (Use and Access) Act 2025. You can request a copy of the relevant transfer safeguards by contacting me.
How long we keep your data
Therapy records are retained for 7 years after our last session, in line with the Limitation Act 1980 and professional indemnity insurance requirements. Financial records are kept for 6 years as required by HMRC. Website enquiries where you do not become a client are held for 12 months. After the applicable retention period expires, your records are securely destroyed using secure deletion methods.
Your rights under UK GDPR
You have the following rights: Right to be informed — this privacy policy fulfils that right. Right of access — you can request a copy of the personal data I hold about you; I will respond within one month under the Data (Use and Access) Act 2025. Right to rectification — you can ask me to correct inaccurate data. Right to erasure — in some circumstances, subject to professional and legal obligations. Right to restrict processing — you can ask me to limit how I use your data. Right to data portability — where technically feasible. Right to object — to certain types of processing. Rights relating to automated decision-making — I do not use automated decision-making. To exercise any of these rights, contact me at [email protected]
Data protection complaints
You have the right to make a data protection complaint directly to me. To submit a complaint, visit https://eastkenttherapycouk.policydiary.co.uk and select the Make a complaint tab, or contact me at [email protected]. If you are not satisfied with my response, you may escalate to the Information Commissioner's Office (ICO): website ico.org.uk, telephone 0303 123 1113, post: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF.
Confidentiality exceptions
Everything you share with me in therapy is confidential. However, there are rare circumstances where I may need to share information without your consent: if I believe you or someone else is at serious risk of harm; safeguarding concerns relating to a child or vulnerable adult; a court order requiring disclosure; or where the law specifically requires it. I will always try to discuss this with you first, unless doing so would itself put someone at risk.
Changes to this policy
I review this privacy policy annually and whenever my practices change. If I make significant changes that affect how your personal data is handled, I will inform you directly. The last updated date at the top of this policy shows when it was most recently revised.
Questions about your data?
If you have any questions or concerns about how I handle your personal information, please contact me directly.