Privacy Policy

Your privacy matters. This notice explains what information I keep, why I need it, how I use and share it, and the choices and rights you have.

This policy explains how I collect and use personal information when you contact me, use my therapy services or visit this website. I am the data controller for my practice. The relevant UK data protection law includes the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended.

Why do I need to collect your personal data?

1.1 To know who you are, respond to your enquiries and communicate with you.

1.2 To arrange appointments and provide therapy services.

1.3 To process payments, issue invoices and receipts, and keep financial records.

1.4 To keep appropriate clinical and financial records, meet legal obligations and respond to a serious concern about safety where necessary.

What personal information do I collect and when do I collect it?

2.1 I collect contact and background information relevant to our work. This may include your name, preferred name, date of birth, address, telephone number, email address, safe contact preferences, GP details and emergency contact details. I also receive information you choose to include in an enquiry or contact form.

2.2 If we work together, my records may include your completed intake form, therapy agreement, assessment information, brief clinical notes, appointment records and relevant correspondence. These may include sensitive information about your health, relationships and personal circumstances. I aim to record only what is relevant to providing therapy and managing my practice.

2.3 I usually collect information directly from you when you enquire or begin therapy. I may also receive relevant information from a referral agency or insurer if you are referred to me.

2.4 When you use this website, Squarespace and, where you consent to non-essential technologies, analytics and advertising providers may collect technical information about your visit. The cookies section below explains this further.

How do I use the information that I collect?

3.1 I use your contact details to respond to you, arrange or change appointments and send you information about sessions and consulting room locations.

3.2 I use information relevant to therapy and my clinical notes to provide and keep a record of your treatment.

3.3 You may pay by bank transfer, card or PayPal. I use payment information, such as your name, amount paid and payment reference, to identify payments and keep financial records. Card and PayPal transactions are handled by the relevant payment provider. I do not keep full payment card details in your therapy records.

3.4 If you request an invoice, I use the details needed to prepare and send it to you.

3.5 Under the UK GDPR, I rely on steps taken at your request before entering a therapy agreement and on the performance of that agreement to arrange and provide therapy. I rely on my legitimate interests in running a safe, accountable practice for relevant administration and record-keeping, and on legal obligations where I must keep financial records or disclose information by law. Where therapy involves special-category information, such as health information, I rely on the condition for the provision of health care or treatment in Article 9(2)(h) of the UK GDPR and Schedule 1, paragraph 2 of the Data Protection Act 2018, subject to my duty of confidentiality.

Where do I keep the information?

4.1 I keep client records electronically, including through a cloud-based practice management service. This provider stores and processes information such as contact details, completed forms, appointment information and clinical notes on my behalf to support the administration of my practice and the provision of therapy.

4.2 Information sent through my website or by email also passes through, and may be stored by, the relevant website and email services. I take reasonable steps to restrict access to personal information and protect it from unauthorised access, loss or disclosure. The email section below explains how we can communicate and exchange forms.

How long do I keep the information?

5.1 I keep your personal data and clinical notes for seven years after our work ends, then securely delete them.

5.2 If an enquiry does not lead to therapy, I keep it only for as long as needed to respond and deal with any related administration. Financial records may be kept for the period required by tax and accounting law.

Who do I share information with?

6.1 I treat information about therapy as confidential. Where necessary and justified, I may share relevant information with your GP, emergency contact, emergency services or an appropriate safeguarding service in response to a serious risk of harm or a safeguarding concern. Where possible, I will discuss this with you first. I may also disclose information where required by law or a court. Providing GP or emergency contact details does not give blanket permission to contact them; we will discuss the circumstances in which contact might be needed.

6.2 I use providers for website hosting, email, cloud-based practice management and record storage, banking and payment processing. They process information needed to provide their services. I also use Google for consented advertising conversion measurement, as explained in the cookies section. Some providers may process information outside the UK. You can contact me for details of the providers used, the countries involved and the applicable safeguards for international transfers.

6.3 I may discuss our work in professional supervision to support the quality of therapy. I limit identifying details as far as possible, and supervision is subject to confidentiality.

6.4 If you were referred by an agency or insurer, I will discuss with you any information that needs to be shared with them, unless another lawful reason requires disclosure.

How can you see or correct the information I hold about you?

You can ask me for a copy of your personal information or ask me to correct information that is inaccurate. Please contact me at the email address below. I may need to verify your identity before responding. I will respond within the time required by data protection law. Some information may be withheld where the law permits or requires this, including to protect the rights of another person.

How can you have your information removed or limit its use?

You can ask me to erase or restrict the use of your information in circumstances where those rights apply. These rights are not absolute; for example, I may need to retain records to meet a legal obligation or establish, exercise or defend legal claims. You can also object to processing based on my legitimate interests and, where applicable, ask for a portable copy of information you provided to me. Please contact me so I can consider your request and explain the outcome.

What if there is a data breach?

I have a process for responding to a personal data breach. If a breach occurs, I will assess it and notify the Information Commissioner’s Office (ICO) and affected individuals where the law requires me to do so.

Will I send emails and text messages to you?

I use ordinary email for enquiries, appointments and practice administration, including sending and receiving intake forms, agreements, invoices and receipts. I may also use SMS for appointment arrangements. Attachments are not routinely password-protected.

Email and text messages cannot be guaranteed to be completely confidential. Please tell me which contact methods are safe for you, including whether I may leave a voicemail and any restrictions on messages.

You can return your intake form by email or bring it to your appointment. You may leave sensitive background questions to discuss in person. If you are uncomfortable sharing information by email, please let me know so we can agree another way. I consider the sensitivity of information when deciding how it should be shared.

How do I use cookies?

This website is hosted by Squarespace. It uses essential cookies that are necessary for security, navigation and the basic operation of the site.

With your consent, the website also uses non-essential Squarespace analytics and performance cookies. These help me understand how the website is used, such as which pages are visited, and improve its performance. Non-essential cookies are restricted unless you select Accept all or enable them through Manage cookies. You can select Decline all and continue to use the website.

You can review or change your choice at any time by opening Cookie Preferences on the website. You can also control or delete cookies through your browser settings. Further information is available in the Squarespace cookie documentation.

Google Ads conversion tracking is active to measure the effectiveness of my advertising. It records when someone reaches the thank-you page after sending the contact form. Google receives the conversion event and associated technical information, not the content of the form. Non-essential Google technologies are used only with consent where required. I do not use this information for remarketing or personalised advertising based on health information.

Complaints

If you have a concern about how I handle your personal information, please contact me directly. I will acknowledge a data protection complaint within 30 days, investigate it as appropriate, keep you informed and tell you the outcome without undue delay. You can also complain to the Information Commissioner’s Office (ICO).

Changes to my Privacy Policy

I review this policy regularly. It was last updated on 17 October 2026. I may update it and will draw significant changes to your attention where appropriate.

Data Controller and contact

I, Ortensia Terzi, am the data controller for my practice. If you have a question about this policy or the information I hold about you, or wish to exercise a data protection right, please email terziortensia@gmail.com.