Privacy Policy & Data Protection - Ann Moorhouse Psychotherapy

Your privacy is a priority. This policy explains how I collect, store, and use your personal data in accordance with the UK General Data Protection Regulation (UK-GDPR) and the Data Protection Act 2018.

1. Who I Am

I am Ann Moorhouse, a Psychotherapist and Counsellor. I am the ‘Data Controller’ for your personal information. I am registered with the Information Commissioner’s Office (ICO) under registration number: ZC109945.

2. Information I Collect

I collect and process personal data to provide you with safe, professional and ethical therapy. This includes:

  • Contact & Waitlist Details: Name, email address, phone number, preferred session formats, and availability preferences provided via contact forms or waitlist submissions.

  • Sensitive Information (special category data): Brief, encrypted clinical session notes, and relevant medical history or GP contact details where necessary.

  • Third party processors: to manage my practice securely, I use trusted digital sub-processors. When you interact with my practice, your data may be processed by:

  • Squarespace: hosts my website and processes secure contact form inquiries.

  • Calendly: manages appointment scheduling and collects your initial contact info.

  • Google Workspace / Google Meet: secures my professional email and hosts our encrypted online video sessions.

3. Legal Basis for Processing Your Data

To comply with UK GDPR laws, I process your data under the following strict legal grounds:

  • Personal Data (Contact Details): Processed under Article 6(1)(b) - it is strictly necessary for the performance of our contract to provide therapy or take steps before entering a contract.

  • Special Category Data (Clinical notes / Health info): Processed under Article 9(2)(h) - the provision of health or social care treatment, managed under professional duties of confidentiality.

4. How I Store and Protect Your Data

I operate a highly secure, paperless practice:

  • Digital Records: All clinical session notes and contact details are held in password-protected, encrypted files.

  • Device Security: Any operational contact info is kept on a dedicated, biometric / passcode-protected device.

  • Retention Period: For active therapy clients, clinical records are retained for 7 years after our final session in alignment with professional clinical insurance requirements, after which they are permanently deleted. For waitlist entries, if you choose not to proceed with therapy when a space opens, your contact details will be deleted immediately upon your request or after 12 months of inactivity.

  • Artificial Intelligence (AI) Disclosure: I do not use Artificial Intelligence (AI) tools, automated transcription software, or third-party AI note-taking applications to record, transcribe, process, or store your clinical session notes, conversations, or personal data. All clinical notes are written manually and stored in encrypted, password-protected files.

5. Sharing Your Information

Your data is private and will never be sold or shared for marketing purposes. It is only shared under these highly specific professional exceptions:

  • Professional Supervision: In line with BACP and NCPS ethical frameworks, I regularly discuss clinical work with a supervisor. Your identity is completely anonymised and this work is also bound by BACP and NCPS confidentiality requirements.

  • Legal/Safety Exceptions: Confidentiality is a core principle of my practice. However, in rare circumstances, confidentiality may need to be broken—such as where there is a legal obligation or a significant risk of serious harm to yourself or others. In alignment with BACP ethical guidelines, wherever it is safe, legally permissible, and practical to do so, I will always aim to discuss any necessary disclosure with you collaboratively before sharing information with external professionals (such as your GP or emergency services).

  • Professional Will: In the event of my unexpected sudden incapacity, an appointed clinical trustee would access your contact details to safely inform you.

6. Your Data Rights

Under UK GDPR framework, you hold clear rights regarding your personal data:

  • The right of access: you can request a copy of the information I hold about you at any time.

  • The right to rectification: You can ask me to correct any inaccuracies in your data immediately.

  • The right to erasure / objection: You can request that I delete or stop processing your data. Please note, that my legal obligation to retain records for 7 years for professional insurance purposes overrides the right to immediate erasure of clinical notes.

7. Contact & Complaints

If you have any questions about how your data is handled or wish to raise a concern, please email me at ann@annmoorhouse.com. If you remain unsatisfied regarding data protection, you have the right to lodge a complaint with the ICO (www.ico.org.uk). For clinical or ethical concerns regarding my practice, you may also contact my professional accrediting bodies, the BACP (www.bacp.co.uk) or NCPS (www.ncps.com).