Ortensia Terzi – Privacy Policy

I aim to be clear about how and why I use information about you, so that you can feel confident that your privacy is protected.

This policy explains how I collect and use personal information when you contact me, use my therapy services or visit this website. I am the data controller for my practice. The relevant UK data protection law includes the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended.

Why do I need to collect your personal data?

1.1 To know who you are, respond to your enquiries and communicate with you.

1.2 To arrange appointments and provide therapy services.

1.3 To receive and account for payments made into my bank account.

1.4 To keep appropriate clinical and financial records, meet legal obligations and respond to a serious concern about safety where necessary.

What personal information do I collect and when do I collect it?

2.1 I may collect your name, postal address, telephone number, email address, date of birth and GP details, where these are relevant to your care. I also receive the information you choose to send in an enquiry or contact form.

2.2 If we work together, I keep brief electronic clinical notes relating to your attendance and treatment. These may include sensitive information about your health and personal circumstances.

2.3 I usually collect information directly from you when you enquire or begin therapy. I may also receive relevant information from a referral agency or insurer if you are referred to me.

2.4 When you use this website, Squarespace and, where you consent to non-essential technologies, analytics and advertising providers may collect technical information about your visit. The cookies section below explains this further.

How do I use the information that I collect?

3.1 I use your contact details to respond to you, arrange or change appointments and send you information about sessions and consulting room locations.

3.2 I use information relevant to therapy and my clinical notes to provide and keep a record of your treatment.

3.3 Payments for therapy are made into my bank account. I use your name and payment reference to identify payments and keep financial records. I do not collect or store your payment card details for therapy sessions.

3.4 If you request an invoice, I use the details needed to prepare and send it to you.

3.5 Under the UK GDPR, I rely on steps taken at your request before entering a therapy agreement and on the performance of that agreement to arrange and provide therapy. I rely on my legitimate interests in running a safe, accountable practice for relevant administration and record-keeping, and on legal obligations where I must keep financial records or disclose information by law. Where therapy involves special-category information, such as health information, I rely on the condition for the provision of health care or treatment in Article 9(2)(h) of the UK GDPR and Schedule 1, paragraph 2 of the Data Protection Act 2018, subject to my duty of confidentiality.

Where do I keep the information?

4.1 I keep client records electronically, including an Excel spreadsheet with contact details and electronic clinical notes, on a password-protected, encrypted computer. I do not maintain a paper client archive or a paper personal-data sheet.

4.2 Information sent through the website or by email also passes through the relevant website and email services. I take reasonable steps to limit access to personal information and keep it secure.

How long do I keep the information?

5.1 I keep your personal data and clinical notes for seven years after our work ends, then securely delete them.

5.2 If an enquiry does not lead to therapy, I keep it only for as long as needed to respond and deal with any related administration. Financial records may be kept for the period required by tax and accounting law.

Who do I share information with?

6.1 I treat information about therapy as confidential. I may share information with your GP or an emergency service if I believe there is a serious risk of harm to you or someone else. Where possible, I would discuss this with you first. I may also disclose information if required by law or a court.

6.2 I use service providers for my website, email and banking, and Google for consented advertising conversion measurement. They may process information needed to provide those services. Some providers may process information outside the UK; applicable UK data-transfer safeguards are relevant to such processing. You can contact me for further details.

6.3 I may discuss clinical work in supervision, taking care to avoid identifying you where possible. My clinical supervisor does not hold a list of client contact details for a Professional Will.

6.4 If you were referred by an agency or insurer, I will discuss with you any information that needs to be shared with them, unless another lawful reason requires disclosure.

How can you see or correct the information I hold about you?

You can ask me for a copy of your personal information or ask me to correct information that is inaccurate. Please contact me at the email address below. I may need to verify your identity before responding. I will respond within the time required by data protection law. Some information may be withheld where the law permits or requires this, including to protect the rights of another person.

How can you have your information removed or limit its use?

You can ask me to erase or restrict the use of your information in circumstances where those rights apply. These rights are not absolute; for example, I may need to retain records to meet a legal obligation or establish, exercise or defend legal claims. You can also object to processing based on my legitimate interests and, where applicable, ask for a portable copy of information you provided to me. Please contact me so I can consider your request and explain the outcome.

What if there is a data breach?

I have a process for responding to a personal data breach. If a breach occurs, I will assess it and notify the Information Commissioner’s Office (ICO) and affected individuals where the law requires me to do so.

Will I send emails and text messages to you?

I may communicate with you by email or SMS text message about appointments and consulting room locations. Where I email clinical information, form letters or reports, I use a password-protected format.

How do I use cookies?

This website is hosted by Squarespace. It uses essential cookies that are necessary for security, navigation and the basic operation of the site.

With your consent, the website also uses non-essential Squarespace analytics and performance cookies. These help me understand how the website is used, such as which pages are visited, and improve its performance. Non-essential cookies are restricted unless you select Accept all or enable them through Manage cookies. You can select Decline all and continue to use the website.

You can review or change your choice at any time by opening Cookie Preferences on the website. You can also control or delete cookies through your browser settings. Further information is available in the Squarespace cookie documentation.

Google Ads conversion tracking is active to measure the effectiveness of my advertising. It records when someone reaches the thank-you page after sending the contact form. Google receives the conversion event and associated technical information, not the content of the form. Non-essential Google technologies are used only with consent where required. I do not use this information for remarketing or personalised advertising based on health information.

Complaints

If you have a concern about how I handle your personal information, please contact me directly. I will acknowledge a data protection complaint within 30 days, investigate it as appropriate, keep you informed and tell you the outcome without undue delay. You can also complain to the Information Commissioner’s Office (ICO).

Changes to my Privacy Policy

I review this policy regularly. It was last updated in September 2026. I may update it and will draw significant changes to your attention where appropriate.

Data Controller and contact

I, Ortensia Terzi, am the data controller for my practice. If you have a question about this policy or the information I hold about you, or wish to exercise a data protection right, please email terziortensia@gmail.com.