Data Protection, Confidentiality & Online Therapy (UK GDPR / DUAA 2026)
- Use of your information
I collect personal and sensitive information in order to provide safe, ethical, and effective therapy. This may include contact details, relevant personal history, and information relating to your mental health and wellbeing.
In line with trauma-informed practice, I aim to collect only what is necessary, and you are free to choose what you share within sessions.
Your information is used to:
- provide therapeutic support
- maintain brief clinical records
- communicate regarding appointments and care
- meet professional, ethical, and legal responsibilities
- Lawful basis
I process your information under the following lawful bases:
- Contract – to deliver the therapy you have requested
- Legal obligation – for record-keeping and safeguarding duties
- Legitimate interests – to ensure safe and effective practice
As I process sensitive health-related data, I also rely on the provision of health care under UK data protection law.
- Trauma-informed confidentiality & safeguarding
Confidentiality is a core part of therapy. I will treat what you share with respect, care, and discretion.
However, in order to work safely and ethically, confidentiality may need to be limited in specific circumstances. These include:
- if there is a risk of serious harm to you or another person
- if there are safeguarding concerns involving a child or vulnerable adult
- if disclosure is required by law
Where possible, I will aim to discuss this with you first and proceed in a way that is transparent and proportionate.
In trauma work, this balance is handled with particular care, recognising the importance of trust, safety, and avoiding unnecessary re-traumatisation.
- Professional support and supervision
As part of ethical practice in line with the Association for Solution Focused Hypnotherapy, I engage in regular professional supervision.
- Client work may be discussed in supervision
- Identifying details are minimised or removed wherever possible
- Supervisors are bound by confidentiality and data protection obligations
- Online therapy and digital security
If sessions are conducted online:
- I use secure, reputable platforms (e.g. Zoom or similar)
- While every effort is made to ensure privacy, no online system can be guaranteed 100% secure
- You are responsible for attending sessions in a private space where you feel safe to speak
I do not routinely record sessions. If recording is ever considered, this would only be done with your explicit consent.
Email, text, or online communication is used for administrative purposes. Please be aware these methods carry some inherent privacy risks.
- Storage and security
Your information is stored securely using password-protected and/or encrypted systems, or locked physical storage.
I take appropriate technical and organisational measures to protect your data from unauthorised access, loss, or misuse.
- Retention of records
Records are kept in line with professional and insurance requirements (typically a minimum of 7 years after the end of therapy, or longer where clinically or legally appropriate).
- Your rights
You have the right to:
- access the information I hold about you
- request corrections to inaccurate data
- request erasure where appropriate
- restrict or object to certain processing
Requests will be handled within one month. I may need to verify your identity. Searches will be reasonable and proportionate.
Please note: in rare cases, access may be limited where releasing information could cause serious harm to your wellbeing or that of others.
- Data protection complaints
If you have concerns about how your data is handled, you are encouraged to raise this directly with me.
Contact: Charlotte King
thepebbleridgepractice@hotmail.com
I will:
- acknowledge your complaint within 30 days
- investigate and respond without undue delay
If you are not satisfied, you may escalate your complaint to the Information Commissioner’s Office (ICO).
- Automated decision-making
I do not use automated decision-making or profiling in your care.
- Ongoing review
This policy is reviewed regularly to reflect legal, ethical, and professional developments, including updates under the Data (Use and Access) Act 2025.