Privacy Policy

---

Privacy Policy
Last updated: September 2025

Phases Psychotherapy Ltd (“we”, “our”, “us”) is committed to protecting your privacy and handling your personal information in a safe, lawful, and transparent way. This policy explains what personal data we collect, how we use it, how we keep it secure, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller
Melisa Henderson at Phases Psychotherapy Ltd is the data controller for the purposes of UK GDPR.

Email: enquiries@phasespsychotherapy.co.uk

Telephone: +447881218428

2. Personal Data We Collect

We only collect the information necessary to provide our services. We do not collect more data than is needed to provide safe, professional services.

This may include:

• Contact details: name, phone number, email address, and emergency contact details
• Enquiries: information you provide when contacting us about services
• Therapy or supervision records: assessment notes, brief session notes, and treatment or supervision plans
• Administrative information: invoices, payments, and correspondence
• Website use: basic analytics and cookies (see Section 8)

3. Legal Basis 

We process personal data under the following lawful bases:

• Contract: to provide psychotherapy, art therapy, EMDR, clinical supervision, or reflective practice services
• Legal obligation: to comply with law (e.g. safeguarding, tax, or financial reporting)
• Legitimate interests: for record-keeping, service improvement, and professional supervision
• Consent: where we request and you provide explicit consent (e.g. for certain communications or the use of creative materials)

4. Your Information 

We do not use your data for direct marketing.
Your personal data is used to:

• Respond to enquiries and manage appointments
• Provide therapy, supervision, or reflective practice services
• Keep appropriate records in line with professional and legal requirements
• Process invoices and payments
• Ensure safety, safeguarding, and professional accountability

5. Confidentiality and Sharing
We will never sell or share your data with third parties for marketing purposes. 

All information shared in therapy, supervision, or reflective practice is treated as confidential. 

We will only share information in the following situations:

• Risk of harm: if there is serious risk to yourself or others
• Legal duty: if we are required to do so by law (e.g. court order, safeguarding)
• Professional consultation: limited, anonymised discussion with a clinical supervisor
• Service providers: trusted third parties (e.g. accountants, IT providers) who process data securely on our behalf

6. Data Storage and Security 

• Records are stored securely in password-protected electronic systems or locked storage.
• Access is restricted to authorised staff only.
• We use appropriate technical and organisational measures to protect your information from unauthorised access, alteration, or disclosure.

7. Data Retention
We retain records only for as long as necessary, in line with professional guidelines and legal obligations:

• Therapy and supervision notes: up to 7 years after the end of services (or until age 25 if working with children, whichever is longer)
• Financial records: 6 years, in line with HMRC requirements

After this period, records will be securely destroyed or permanently deleted.

8. Website and Cookies 

Our website may use cookies or analytics tools to understand how the site is used and improve user experience. Cookies are small text files stored on your device. You can manage or disable cookies through your browser settings.

9. Your Rights

You have the following rights under UK GDPR:

• Access: request a copy of the personal data we hold about you
• Rectification: ask us to correct inaccurate or incomplete information
• Erasure: request deletion of your information, where legally possible
• Restriction: ask us to limit how your data is used
• Portability: request a copy of your data in a transferable format (where applicable)
• Objection: object to how your data is processed under certain circumstances
• Withdraw consent: where consent is the legal basis for processing

Requests will be responded to within one month.

10. Complaints 

If you have concerns about how your data is handled, please contact us first so we can try to resolve the issue. If you remain dissatisfied, you can raise a complaint with the UK supervisory authority:

Information Commissioner’s Office (ICO)
Website: www.ico.org.uk
Telephone: 0303 123 1113

11. Updates to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted to this policy which can be found on the website.