Privacy Policy & Data Protection - Ann Moorhouse Psychotherapy

Your privacy is a priority. This policy explains how I collect, store, and use your personal data in accordance with the UK General Data Protection Regulation (UK-GDPR) and the Data Protection Act 2018.

1. Who I Am

I am Ann Moorhouse, a Psychotherapist and Counsellor. I am the ‘Data Controller’ for your personal information. I am registered with the Information Commissioner’s Office (ICO) under registration number: ZC109945.

2. Information I Collect

I collect and process personal data to provide you with safe, professional and ethical therapy. This includes:

  • Contact Details: Name, email address, phone number, and home address.

  • Sensitive Information (special category data): Brief, encrypted clinical session notes, and relevant medical history or GP contact details where necessary.

  • Third party processors: to manage my practice securely, I use trusted digital sub-processors. When you interact with my practice, your data may be processed by:

  • Squarespace: hosts my website and processes secure contact form inquiries.

  • Calendly: manages appointment scheduling and collects your initial contact info.

  • Google Workspace / Google Meet: secures my professional email and hosts our encrypted online video sessions.

3. Legal Basis for Processing Your Data

To comply with UK GDPR laws, I process your data under the following strict legal grounds:

  • Personal Data (Contact Details): Processed under Article 6(1)(b) - it is strictly necessary for the performance of our contract to provide therapy or take steps before entering a contract.

  • Special Category Data (Clinical notes / Health info): Processed under Article 9(2)(h) - the provision of health or social care treatment, managed under professional duties of confidentiality.

4. How I Store and Protect Your Data

I operate a highly secure, paperless practice:

  • Digital Records: All clinical session notes and contact details are held in password-protected, encrypted files.

  • Device Security: Any operational contact info is kept on a dedicated, biometric / passcode-protected device.

  • Retention Period: In alignment with professional clinical insurance and accounting requirements, I retain your records for 7 years after our final session. Once this 7-year window closes, all records are permanently and securely destroyed.

5. Sharing Your Information

Your data is private and will never be sold or shared for marketing purposes. It is only shared under these highly specific professional exceptions:

  • Professional Supervision: In line with BACP and NCPS ethical frameworks, I regularly discuss clinical work with a supervisor. Your identity is completely anonymised.

  • Legal/Safety Exceptions: As detailed in our initial therapeutic contract, confidentiality may be broken if there is a legal requirement or an imminent risk of serious harm to yourself or others.

  • Professional Will: In the event of my unexpected sudden incapacity, an appointed clinical trustee would access your contact details to safely inform you.

6. Your Data Rights

Under UK GDPR framework, you hold clear rights regarding your personal data:

  • The right of access: you can request a copy of the information I hold about you at any time.

  • The right to rectification: You can ask me to correct any inaccuracies in your data immediately.

  • The right to erasure / objection: You can request that I delete or stop processing your data. Please note, that my legal obligation to retain records for 7 years for professional insurance purposes overrides the right to immediate erasure of clinical notes.

7. Contact & Complaints

If you have any questions about how your data is handled, please email me at ann@annmoorhouse.com. If you remain unsatisfied with how your data is handled, you have the absolute right to lodge a formal complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk.