Privacy policy.
Your privacy
Your privacy is fundamental to the therapeutic relationship.
When you seek support from The Loss Therapist, you entrust me with highly personal information about your health, wellbeing and life experiences. I recognise the importance of that trust and am committed to protecting your personal information with care, respect and transparency.
This Privacy Notice explains what information I collect, why I collect it, how it is used, how long it is kept and the choices and rights available to you.
I aim to explain these matters in plain English rather than legal language, but if anything is unclear, please ask.
Who I am
The Loss Therapist is the trading name of Christine Gregory, an independent Counselling Psychologist and EMDR Therapist.
For the purposes of UK data protection law, I am the Data Controller responsible for the personal information you provide.
Website:www.thelosstherapist.co.uk
Practice locations: Reading, with online therapy available throughout the UK.
The information I collect
Depending on the services you receive, I may collect:
Personal Details
Name
Address
Telephone number
Email address
Date of birth
Emergency contact details (where appropriate)
GP details
Health Information
As a Counselling Psychologist, I routinely collect information about your health and wellbeing.
This may include:
reasons for seeking therapy
medical history where relevant
mental health history
preferred gender pronouns
gender, ethnicity, sexuality, martial status or religious affiliation (where intersectional identity is relevant to treatment)
medications
psychological assessments
risk assessments
therapy goals
session notes
correspondence relating to your care
Special categories data are collected to ensure an appropriate level of care can be provided, to gain a better understanding of how these aspects of client experience may inform their mental health history, and to determine whether any reasonable adjustments are required during therapy sessions. Data are held securely and not shared with anyone without explicit consent.
Health information receives additional legal protection because it is classified as Special Category Data.
Administrative Information
I may also collect information necessary to manage the practice, including:
appointment history
insurance policy details
payment records
correspondence
referral information
communication preferences
Information from the Website and Counselling Directories
If you contact me through the website, I may collect:
your name
contact details
the information you choose to provide in your enquiry.
Technical information about your visit may also be collected through cookies and similar technologies. Please see the Cookie Policy for more information.
Why I use your information
Your information is used to:
respond to enquiries;
assess whether I am the right psychologist for you;
provide psychological therapy;
maintain clinical records;
arrange appointments;
communicate with you;
collate feedback;
process payments;
meet legal and professional obligations;
manage the safe operation of the practice.
I will only use your information for purposes that are compatible with providing professional services.
The legal basis for using your information
UK data protection law requires me to identify a lawful basis for processing your information.
These include:
providing therapeutic services;
complying with legal obligations;
safeguarding;
managing the practice;
protecting the safety of clients and others where necessary.
Because psychological therapy involves health information, UK law also requires an additional legal basis for processing Special Category Data. This is generally because the information is necessary for providing health or psychological care.
Confidentiality
Everything discussed during therapy is treated as confidential.
There are, however, a small number of situations in which I may be required to share information.
These include:
where required by law;
where there is a serious risk of harm to you or another person;
safeguarding concerns involving children or vulnerable adults;
where ordered by a court;
where required by my professional or regulatory obligations.
Where possible and appropriate, I will discuss this with you before sharing information.
Only the minimum necessary information will be disclosed.
How your information is stored
The practice uses a combination of secure digital systems to support the safe delivery of therapy.
These include secure systems for:
clinical record keeping;
appointment management;
online consultations;
scheduling;
note taking;
accounting;
payment processing;
secure email;
encrypted business devices.
Appropriate security measures include:
password protection;
multi-factor authentication where available;
encryption;
restricted access;
regular software updates.
Artificial intelligence
The practice makes limited use of carefully selected AI-assisted tools to improve administrative efficiency.
Examples may include:
assisting with transcription of therapy sessions where appropriate;
supporting document drafting;
administrative productivity tools.
AI is not used to:
diagnose clients;
make treatment decisions;
replace clinical judgement;
make automated decisions about your care.
All clinical decisions remain my responsibility.
Where AI-assisted tools process information, they are used with appropriate contractual safeguards and security measures.
If you would like further information about how AI is used within the practice, please ask.
Who may receive your information
Your information will not be sold.
It will only be shared where necessary.
Examples include:
secure software providers supporting the practice;
payment providers;
accountants;
clinical supervisors;
insurers;
legal advisers;
regulators, where legally required;
healthcare professionals; where necessary;
safeguarding agencies, where necessary.
All sharing is limited to what is reasonably necessary.
International transfers
Some technology providers may process information outside the United Kingdom.
Where this occurs, appropriate legal safeguards are used in accordance with UK data protection legislation.
How long your information is kept
Information is retained only for as long as necessary.
Retention periods are determined by legal requirements, professional guidance and the needs of safe clinical practice.
Further details are available in the Practice Data Retention Policy.
Your rights
You have rights under UK data protection law, including the right to:
request access to your information;
request correction of inaccurate information;
request deletion in certain circumstances;
request restriction of processing;
object to some types of processing;
request portability where applicable;
raise concerns about how your information has been handled.
Not all rights apply in every situation, particularly where information must be retained for legal or professional reasons.
Please make any requests to view, amend, or delete personal information in writing at christine@thelosstherapist.co.uk. All such requests will be actioned within one month of receipt. If I refuse a client's request under the right of access, a reason will be provided, and the client maintains the right to a legal challenge.
Clients can see more about their rights at:
Data requests
Clients have the right to request a copy of their personal data. If they want to access such information, they must make a subject access request by contacting me at christine@thelosstherapist.co.uk. Similarly, clients can request that information be transferred to an alternative provider of psychological services. Any requests for data must be made in writing, and I will respond within 30 days.
The client does not have to pay a fee to access their personal information (or exercise any of the other rights). However, I may charge a reasonable fee for a second or subsequent copy of the information, for a summarised version/report or if a client’s request for access is clearly unfounded or excessive.
Additionally, I may need to request specific information from a client to help me confirm their identity and ensure their right to access the information (or exercise any of their other rights). This is a security measure to ensure that personal information is not disclosed to anyone who does not have the right to receive it. When personal data is requested, the following forms of ID will be accepted: a copy of a driving license, passport or birth certificate, and a utility bill not older than three months.
If a client believes the information I hold about them is out of date or inaccurate, I request that they notify me as soon as possible so that I can update my records.
Data breaches
While many procedures are in place to protect client data, my security process may be vulnerable to compromise, potentially leading to a significant breach of client personal data. If this is the case, I have a legal obligation to report the data breach to any affected clients and to the Information Commissioner’s Office (ICO) within 72 hours.
Privacy concerns
If you have any questions or concerns about how your information has been handled, I encourage you to contact me in the first instance.
I will acknowledge your concern promptly and investigate it fairly.
If you remain dissatisfied, you have the right to complain to the Information Commissioner's Office (ICO). The ICO may be contacted via its website or by calling its helpline on 0303 123 1113.
Changes to the privacy notice
This notice may occasionally be updated to reflect changes in legislation, professional guidance or the operation of the practice.
The latest version will always be available on the practice website.
Commitment to safe and ethical practice
Protecting your privacy is an essential part of providing safe, ethical and effective psychological care.
If you have any questions about this Privacy Notice or how your information is used, please contact me and I will be happy to explain.