Privacy Policy

Effective date: July, 2026

1. Who We Are

[Practice Name] (“we”, “us”, “our”) is a creative counselling and arts therapy practice based in [City, UK]. [Your Name], [qualifications, e.g. registered member of BACP], is the data controller responsible for your personal data.

Contact: ewa@emikrut.com | [practice address] | [ICO registration number, if applicable]

2. What Personal Data We Collect

We collect the following categories of personal data:

  • Contact details: name, email address, phone number, submitted via our website contact form.
  • Booking data: appointment times, session type, and any information you provide through our booking system, [Booking Tool Name, e.g. Acuity Scheduling / Calendly].
  • Clinical and session information: notes relating to therapeutic sessions, which may include special category data (health, and where relevant, information about mental health, trauma, or wellbeing).
  • Newsletter data: name and email address if you subscribe, via [Newsletter Tool Name, e.g. Mailchimp].
  • Website usage data: collected via cookies and analytics tools, see our Cookie Policy for details.

3. Special Category (Health) Data

As a therapy practice, some of the information you share with us during sessions is “special category data” under UK GDPR. We only process this data:

  • With your explicit consent, given at the start of our therapeutic work; or
  • Where necessary to provide healthcare or therapeutic treatment, under a duty of confidentiality; or
  • Where necessary to protect your vital interests or those of another person (for example, in a safeguarding situation).

Session notes are kept securely and separately from general administrative records, in line with our professional body's guidelines and our clinical supervision arrangements.

4. Use of AI and Digital Tools

Before using any artificial intelligence tool, digital platform or online system in our work together, we assess the risks to confidentiality and data protection, in line with BACP guidance on the use of AI and digital tools.

[Delete as applicable: We do not currently use AI tools for note-taking, transcription, or clinical documentation. / We use [name of AI tool] for [purpose, e.g. session note drafting]; this is disclosed to you directly and your consent is sought before any such tool is used in relation to your data.]

Any digital tool we use to store or process your data is chosen with data protection compliance and security in mind.

5. How We Use Your Data

  • To respond to enquiries and arrange appointments.
  • To provide, manage, and follow up on therapeutic sessions.
  • To send appointment reminders and administrative communications.
  • To send newsletters or updates, only if you have opted in.
  • To understand how visitors use our website, using aggregated analytics.
  • To meet our legal, insurance, and professional body obligations.

6. Legal Basis for Processing

  • Consent: for newsletter sign-ups, non-essential cookies, and processing of clinical/health data.
  • Contract: to provide the therapy services you have booked.
  • Legitimate interests: for basic website analytics and practice administration.
  • Legal obligation: where we are required to keep records for insurance, tax, or safeguarding purposes.

7. Confidentiality and Its Limits

What you share in sessions is confidential. This confidentiality may be broken only where there is a serious risk of harm to you or others, where required by law, or where disclosure is required by a court. Where possible, this would be discussed with you first.

8. Who We Share Your Data With

We do not sell your data. We may share limited data with:

  • [Booking Tool Name]: to manage appointments.
  • [Analytics Tool Name, e.g. Google Analytics]: aggregated, anonymised website usage data.
  • [Newsletter Tool Name]: if you subscribe to our mailing list.
  • Clinical supervisor: anonymised case discussion only, as required by professional practice standards.
  • Regulatory or legal bodies, where required by law.

9. Data Retention

We retain clinical/session records for [7 years, or as required by your professional body/insurer] after the end of our work together. Contact form and newsletter data is retained until you ask us to delete it or unsubscribe.

10. Data Security

We take appropriate technical and organisational measures to protect your data, including secure storage of clinical notes, restricted access, and use of reputable, GDPR-compliant third-party tools.

11. Your Rights

Under UK GDPR, you have the right to:

  • Access the personal data we hold about you.
  • Ask us to correct inaccurate data.
  • Ask us to delete your data, subject to our record-keeping obligations.
  • Object to or restrict certain processing.
  • Withdraw consent at any time, where processing is based on consent.

12. Complaints

If you have a concern about how your data is handled, we encourage you to raise it with us directly in the first instance so we can try to resolve it. If you remain unsatisfied, you may lodge a complaint with the Information Commissioner's Office (ico.org.uk). If your concern relates to our professional conduct more broadly, see the Complaints section of our Terms & Conditions.

13. Cookies

Our website uses cookies. Full details are set out in our separate Cookie Policy.

14. Children's Data

Our services and website are intended for adults. If you are seeking support for a child or young person, please contact us directly to discuss appropriate arrangements and consent requirements.

15. Changes to This Policy

We may update this policy from time to time. The “Last updated” date at the top shows when it was last revised.

16. Contact Us

If you have questions about this policy or how your data is handled, contact us at ewa@emikrut.com.