01
Who I am
Judith Comrie Therapy is the data controller for the personal information described in this notice. This means I, Judith Comrie, decide why and how that information is processed in my independent psychotherapy practice.
For questions about your information or this policy, contact me at judith@judithcomrietherapy.com.
This policy applies to prospective, current and former clients, and to people who contact me through this website, by email or by telephone.
02
Information I may collect
I collect only information that is relevant to responding to an enquiry, providing psychotherapy safely and managing the practice. This may include:
- your name, age or date of birth, pronouns and contact details;
- the information you choose to include in an enquiry;
- emergency-contact and GP details where relevant and agreed;
- assessment information and details about your physical and mental health, relationships, history and current circumstances;
- brief clinical notes, risk or safeguarding information and relevant correspondence;
- appointment, attendance, payment and invoice records; and
- limited technical information needed to operate and secure the website.
Information about health, racial or ethnic origin, religious or philosophical beliefs, sexual life or sexual orientation is classed as special category data and receives additional protection under UK data protection law.
03
My lawful bases for processing
I process personal information only where there is a lawful reason to do so. Depending on the purpose, I may rely on:
Contract
Where processing is necessary to respond to steps you ask me to take before therapy begins, or to provide the psychotherapy service agreed with you.
Legitimate interests
For proportionate practice administration, responding to enquiries, maintaining security and establishing or defending legal or professional claims.
Legal obligation
Where records must be kept or information disclosed to comply with tax, regulatory, safeguarding or other legal duties.
Vital interests
In a rare emergency where processing is necessary to protect someone’s life and consent cannot reasonably be obtained.
For special category data, I may additionally rely on processing necessary for the provision of health or social care by a professional subject to confidentiality under Article 9(2)(h) of the UK GDPR. Where appropriate, I may rely on your explicit consent under Article 9(2)(a), or on Article 9(2)(f) where processing is necessary for legal claims.
04
How I use your information
- to respond to enquiries and arrange an initial consultation;
- to assess whether I can offer a suitable and safe service;
- to provide psychotherapy and maintain continuity of care;
- to manage appointments, payments, accounts and professional administration;
- to meet safeguarding, risk-management, ethical, insurance and legal responsibilities; and
- to protect the security and proper operation of the practice and website.
I do not sell personal information or use therapy information for advertising.
06
Storage, security and international transfers
I use proportionate technical and organisational safeguards, including access controls, strong passwords, protected devices, secure storage, data minimisation and separation of identifying information from clinical notes where practicable.
No internet or email system is completely risk-free. You are encouraged not to include highly sensitive clinical information in an initial website or email enquiry.
If a service provider stores or accesses information outside the UK, I will use providers and safeguards recognised under UK data protection law, such as an adequacy regulation or approved contractual protections.
If a personal-data breach is likely to create a risk to your rights and freedoms, I will take appropriate action and notify affected individuals where the law requires this.
07
How long information is kept
I keep information only for as long as it remains necessary for the purpose for which it was collected and for relevant legal, ethical and insurance requirements.
Enquiries that do not proceedNormally up to 12 months after the last contact
Clinical and contractual recordsNormally up to 7 years after therapy ends
Financial and tax recordsNormally 6 years after the relevant financial year
Website security logsFor the shortest period reasonably required for security and troubleshooting
A different period may be necessary where there is a safeguarding concern, complaint, legal claim or other lawful reason. When information is no longer required, it is securely deleted, destroyed or anonymised.
08
Your data-protection rights
Depending on the circumstances and lawful basis, you may have the right to:
- be informed about how your information is used;
- request access to a copy of your personal information;
- ask for inaccurate or incomplete information to be corrected;
- ask for information to be erased;
- ask for processing to be restricted;
- object to processing based on legitimate interests;
- receive certain information in a portable format; and
- withdraw consent at any time where consent is the basis relied upon.
These rights are not absolute and may be limited where information must lawfully be retained, where another person’s rights are affected or where an exemption applies. I will usually respond to a valid request within one month and may need to confirm your identity first.
10
Questions and concerns
Please contact me first at judith@judithcomrietherapy.com if you have a question, wish to exercise a right or are concerned about how your information has been handled. I will take your concern seriously and aim to resolve it promptly.
This policy may be updated when the practice, technology or legal requirements change. The latest version will always be published on this page.