Free Consultation  

Privacy & Data Protection Policy

The Best You Therapy > Privacy & Data Protection Policy

Effective Date: 29 July 2026

Privacy & Data Protection

At The Best You Therapy, your privacy and confidentiality are treated with the utmost respect. This policy explains what personal information is collected, why it is needed, how it is protected, and your rights under UK data protection law.

I am committed to complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data Use and Access Act 2025.

Data Controller

The Data Controller is:

Tracey Rees
The Best You Therapy
Website: https://www.thebestyoutherapy.co.uk
Email: [email protected]
Telephone: 07771 993 845

Information Commissioner’s Office (ICO) Registration Number: ZA782043

The Information I Collect

Depending on the services you receive, I may collect:

  • Your name, address, telephone number and email address.
  • Your date of birth.
  • Emergency contact details.
  • GP details (where appropriate).
  • Information you provide when making an enquiry.
  • Appointment history.
  • Counselling assessment information.
  • Clinical notes relating to counselling sessions.
  • Payment and invoicing information.
  • Emails and correspondence between us.
  • Information required to comply with legal or professional obligations.

Where I work with children and young people, I may also collect appropriate information relating to a parent, guardian or person with parental responsibility where necessary.

I only collect information that is necessary to provide safe, ethical and professional counselling services.

How Your Information Is Used

Your information is used to:

  • Respond to enquiries.
  • Arrange counselling appointments.
  • Provide counselling safely and effectively.
  • Maintain confidential clinical records.
  • Contact you regarding appointments or changes.
  • Process payments and maintain financial records.
  • Meet legal, ethical and professional obligations.
  • Protect your welfare or the welfare of others where required by law.

I will never sell your personal information or use it for marketing without your consent.

Lawful Basis for Processing

Your personal information is processed under one or more of the lawful bases provided by UK GDPR, including:

  • Performance of a contract.
  • Legitimate interests in providing professional counselling services.
  • Compliance with legal obligations.
  • Protection of vital interests where necessary.
  • Provision of health-related services.

Special category (sensitive) personal data is processed in accordance with Article 9 of UK GDPR.

Confidentiality

Confidentiality is fundamental to counselling and psychotherapy – herein recorded as counselling.

Everything discussed during counselling sessions is treated as confidential unless there is a legal or ethical reason why confidentiality cannot be maintained.

Information may need to be shared where:

  • There is a serious risk of harm to you or another person.
  • There are safeguarding concerns involving a child or vulnerable adult.
  • Disclosure is required by law.
  • A court orders disclosure.

Where appropriate and safe to do so, I will discuss any necessary disclosure with you before sharing information.

Online Counselling

I offer counselling both face-to-face and online.

Where counselling is provided online, reasonable steps are taken to use secure technology and maintain confidentiality. However, no internet-based communication can ever be guaranteed to be completely secure.

Clients are encouraged to attend online sessions from a private location using a secure internet connection and a personal device wherever possible.

Booking Appointments

Appointments may be booked using a secure Google Calendar booking link.

Google acts as a data processor on my behalf for appointment scheduling. Only the minimum personal information necessary to manage appointments is processed through this system. Google’s own privacy practices apply to information processed through its services.

Clinical Records

Clinical records are maintained securely using Kiku, a practice management system designed specifically for counselling professionals.

Kiku acts as a data processor on my behalf and stores information using appropriate technical and organisational security measures designed to protect confidential client information.

Access to clinical records is restricted to me.

Storage and Security

Your personal information is stored securely using appropriate technical and organisational safeguards.

These include:

  • Password-protected computers and mobile devices.
  • Secure cloud-based systems.
  • Restricted access to personal information.
  • Regular software and security updates.
  • Secure destruction of records when no longer required.

Reasonable measures are taken to protect your information from accidental loss, unauthorised access, alteration or disclosure.

How Long Records Are Kept

Client records are retained only for as long as required by professional guidance, insurance requirements and legal obligations.

Once the appropriate retention period has expired, records are securely destroyed or permanently deleted.

 

Professional Supervision

As part of my professional and ethical responsibilities, I attend regular clinical supervision.

Client work may be discussed with my clinical supervisor to ensure safe and effective practice. Wherever possible, identifying details are removed or anonymised before discussion.

My supervisor is also bound by strict professional confidentiality.

Sharing Your Information

Your personal information will not normally be shared with anyone else.

Information will only be shared where:

  • You have given your consent.
  • It is necessary to protect someone from serious harm.
  • Safeguarding concerns require disclosure.
  • Disclosure is required by law.
  • A court or other lawful authority requires disclosure.

I never sell or share personal information for advertising or marketing purposes.

Your Rights

Under UK data protection legislation, you have the right to:

  • Request access to the personal information I hold about you.
  • Request correction of inaccurate or incomplete information.
  • Request deletion of information where appropriate.
  • Request restriction of processing.
  • Object to certain types of processing.
  • Request a portable copy of your data where applicable.
  • Withdraw consent where consent is the lawful basis for processing.

Some of these rights may be limited where legal or professional obligations apply.

Subject Access Requests

You may request a copy of the personal information I hold about you by contacting me using the details above.

I will normally respond within the statutory timescales.

If your request is unclear or particularly broad, I may ask you to clarify what information you require. In accordance with the Data Use and Access Act 2025, the response period may be paused while clarification is sought.

Any searches undertaken will be reasonable and proportionate.

Data Protection Complaints

If you are unhappy with how I have handled your personal information, please contact me in the first instance.

Email: [email protected]

I will:

  • Acknowledge your complaint within 30 days.
  • Investigate your concerns fairly and thoroughly.
  • Keep you informed of progress.
  • Provide a response and outcome without undue delay.

If you remain dissatisfied after I have responded, you have the right to complain to the Information Commissioner’s Office (ICO).

Cookies

The Best You Therapy website uses only cookies that are necessary for the website to function correctly.

The website does not use Google Analytics or any other visitor tracking or advertising analytics services.

If additional cookies or website functionality are introduced in the future, this policy will be updated accordingly.

Links to Other Websites

My website may contain links to third-party websites. Once you leave my website, I cannot be responsible for the privacy practices or content of those websites. I recommend reading the privacy policies of any external websites you visit.

Professional Standards

I am committed to maintaining the highest professional and ethical standards.

I am a registered member of:

  • UK Council for Psychotherapy (UKCP) – 2011174485
  • British Association for Counselling and Psychotherapy (BACP) – 00971650
  • National Counselling & Psychotherapy Society (NCPS) – NCS21-01523

I am also an NCPS Accredited Children and Young People’s Therapist and work in accordance with the ethical frameworks, professional standards and continuing professional development requirements of these organisations.

Changes to This Policy

This Privacy & Data Protection Policy may be reviewed and updated from time to time to reflect changes in legislation, professional guidance or working practices.

The most recent version will always be published on my website.

Contact

If you have any questions about this Privacy & Data Protection Policy or how your personal information is handled, please contact:

Tracey Rees
The Best You Therapy
Website: https://www.thebestyoutherapy.co.uk
Email: [email protected]
Telephone: 07771 993 845