Legal
Last updated: March 2026
Your privacy matters. This policy explains how I collect, use, and protect your personal information when you use this website or engage with my therapy services. I am committed to handling your data with care, in full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
The data controller for this website and therapy practice is:
| Category | Examples | How Collected |
|---|---|---|
| Contact details | Name, email address, phone number | Acuity booking form; Google Forms intake form |
| Booking information | Appointment type, date, time | Acuity Scheduling |
| Payment information | Transaction records (no card data stored by me) | Stripe via Acuity |
| Health and wellbeing information | Reason for seeking therapy, relevant background shared in sessions | Google Forms intake form, sessions |
| Session notes | Brief notes to support continuity of care | Recorded by me during/after sessions |
| Session recordings | Google Meet video recording of a therapy session | Only where you have given explicit prior consent via your Client Agreement; for clinical supervision purposes only |
| Communication records | Emails or messages relating to bookings | Email, WhatsApp |
| Website usage data | Pages visited, time on site (anonymised) | Google Analytics 4 (with your consent) |
I do not collect any data from children. My services are for adults only.
I do not use your personal data for marketing purposes and will never sell or share your data with third parties for commercial gain.
Everything discussed in your sessions is confidential. As a BACP Registered Member, I am required to attend regular clinical supervision. Aspects of our work may be discussed with my supervisor in an anonymised form — your full name and any identifying details will never be disclosed. My supervisor is bound by the same professional standards of confidentiality.
Where you have consented to session recording, recordings shared with my supervisor for supervision purposes are treated with the same strict confidentiality and deleted promptly after use (see Section 9).
There are limited circumstances in which I may be required to break confidentiality:
Where possible, I will discuss any need to break confidentiality with you before taking action.
I use the following trusted third-party services to deliver my practice. Each is bound by its own data protection obligations.
| Service | Purpose | Data Shared | Privacy Policy |
|---|---|---|---|
| Acuity Scheduling | Appointment booking and reminders | Name, email, phone, appointment details | acuityscheduling.com |
| Stripe | Payment processing | Transaction data (card data not stored by me) | stripe.com |
| Google Forms | Client intake form (sent by Roy after the initial consultation, prior to first therapy session) | Name, contact details, reason for seeking therapy, relevant health and personal background | policies.google.com |
| Google Workspace & Google Meet | Email, calendar, video sessions, and temporary storage of session recordings (where consent given) | Communication content, meeting data, session recordings (consent-only) | policies.google.com |
| WhatsApp (Meta) | Booking-related communication (if you initiate contact via WhatsApp) | Name, phone number, message content | whatsapp.com |
| Netlify | Website hosting | Standard server logs (IP address, browser type) | netlify.com |
| Google Analytics 4 | Website analytics (consent-gated) | Anonymised usage data (only if you accept cookies) | policies.google.com |
| DocuSeal | Electronic signing of client agreement | Name, signature, date | docuseal.com |
Some of the third-party services listed above (including Google, Stripe, Acuity Scheduling, and Meta/WhatsApp) may process your data outside the UK. Where this occurs, I rely on those providers operating under appropriate safeguards recognised under UK data protection law, including UK adequacy regulations or Standard Contractual Clauses (SCCs). Each provider’s privacy policy (linked above) sets out the specific transfer mechanisms they rely upon.
Client records (including session notes and the signed client agreement) are retained for 7 years from the date of our last session, in line with BACP guidance. After this period, records are securely destroyed.
Session recordings are subject to a separate, shorter retention period: they are permanently deleted within 30 days of the supervision session for which they were used, and no later than 30 days after the recording was made if not used in supervision.
Under UK GDPR, you have the following rights regarding your personal data:
To exercise any of these rights, please contact me at roy@therapywithroy.co.uk. I will respond within one calendar month.
This website uses two types of cookies:
You can withdraw consent for analytics cookies at any time by clearing your browser cookies and declining again on your next visit.
If you have a concern about how I handle your personal data, please contact me first at roy@therapywithroy.co.uk so I can try to resolve it.
If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
I may update this policy from time to time to reflect changes in the law or my practice. Any material changes will be noted at the top of this page with an updated date. I encourage you to review this policy periodically.