Privacy Policy

This privacy policy explains how Within Reach Therapy collects, uses, stores and protects your personal information when you visit my website, make an enquiry or use my counselling and therapy services.

 

Within Reach Therapy is the data controller for the personal information I hold about you.

If you have any questions about this privacy policy or how your personal information is handled, please contact:

 

Sonya Paul
Within Reach Therapy
Email: sonya@withinreachtherapy.co.uk

Depending on your contact with Within Reach Therapy, I may collect and hold information including:

​

• Your name and contact details, including your email address and telephone number.

• Information you provide when making an enquiry or arranging an appointment.

• Information gathered during an initial assessment.

• Relevant personal history and information you choose to share during therapy.

• Brief clinical/session notes relating to our therapeutic work.

• Information relating to risk or safeguarding where relevant.

• Appointment, attendance and cancellation information.

• Payment and invoicing information.

• Relevant correspondence between us.

• Limited technical information generated when you use the website, such as IP address, browser information and cookie data.

​

Information discussed or recorded as part of counselling may include information about your physical or mental health and other sensitive aspects of your life. This may constitute special-category personal data under UK data-protection law and is handled with additional care.

I only collect and use personal information where it is necessary for providing and managing my counselling and therapy services or operating Within Reach Therapy.

​

This may include using your information to:

• Respond to enquiries.

• Arrange and manage appointments.

• Provide counselling and therapy.

• Conduct an initial assessment.

• Maintain appropriate clinical records.

• Communicate with you in relation to your therapy.

• Manage payments and invoices.

• Manage risk and safeguarding concerns.

• Meet professional, legal, regulatory and insurance requirements.

• Maintain the security and operation of the Within Reach Therapy website and business.

​

The lawful basis relied upon will depend on the purpose for which the information is being processed. This may include processing that is necessary to provide the therapy service you have requested, compliance with legal obligations and legitimate interests in appropriately managing and protecting my practice and records.

​

Where I process special-category personal information, I will also rely upon an appropriate condition under UK data-protection law. Depending on the circumstances, this may include the provisions relating to counselling, safeguarding, legal claims or explicit consent.

I will only collect information that is relevant and reasonably necessary for these purposes.

These may include:

​

• An initial assessment.

• Relevant contact and background information.

• Brief session notes.

• Therapy goals or agreed plans.

• Relevant correspondence.

• Risk or safeguarding information where necessary.

• ​

Session notes are kept brief and are intended to record clinically relevant information rather than provide a word-for-word account or transcript of therapy sessions.

Information shared during therapy is treated as confidential.

I do not sell your personal information.

​

There may be limited circumstances in which it is necessary to share information. These may include:

• Where you have asked or agreed for information to be shared.

• Where there is a serious concern about your safety or the safety of another person.

• Where safeguarding concerns arise.

• Where disclosure is required by law or by a court.

• Where disclosure is necessary in connection with a legal claim.

• Where appropriately vetted service providers process information on my behalf in order to provide essential business services, such as secure email, electronic storage, website hosting or payment processing

​

Where appropriate and possible, I would discuss a disclosure with you before information is shared.

Only information that is reasonably necessary for the particular purpose will be disclosed.

I take appropriate steps to protect personal information from unauthorised access, loss, disclosure or misuse.

​

Electronic clinical records are stored within the secure business systems used by Within Reach Therapy. Access is password protected and additional security measures, including two-step verification, are used to protect the account.

​

Access to client records is restricted.

​

Where appropriate, client initials or other identifiers may be used instead of full names as an additional privacy measure. Using an identifier does not remove the protections that apply to the information.

​

I take reasonable steps to ensure that devices and systems used to access confidential information are appropriately secured.

Clinical records relating to adult clients are normally retained securely for five years following the end of therapy, in accordance with my professional indemnity insurance requirements.

​

After this period, records are securely deleted unless there is a legal, safeguarding, regulatory, insurance-related or other legitimate reason why they need to be retained for longer.

​

Other personal information is kept only for as long as reasonably necessary for the purpose for which it was collected and to meet any applicable legal, professional or financial requirements.

​

Retention periods are reviewed periodically and information that is no longer required is securely deleted.

Under UK data-protection law, you have a number of rights concerning your personal information.

Depending on the circumstances and the lawful basis under which your information is being processed, these may include:

​

• The right to be informed about how your personal information is used.

• The right to request access to personal information held about you.

• The right to request correction of inaccurate or incomplete information.

• The right to request deletion of your information in certain circumstances.

• The right to request restriction of processing in certain circumstances.

• The right to object to certain uses of your information.

• The right to data portability where applicable.

• The right to withdraw consent where consent is being relied upon.

​

These rights are not absolute and some may not apply in particular circumstances.

If you wish to exercise any of your rights or have questions about information I hold about you, please contact:

sonya@withinreachtherapy.co.uk