Your privacy is very important to me and you can be confident that your personal information will be kept safe and secure and will only be used for the purpose it was given to me. I adhere to current data protection legislation, including the General Data Protection Regulation (EU/2016/679) (the GDPR), the Data (Use and Access) (DUAA) Act (2025), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003.
This privacy notice tells you what I will do with your personal information from initial point of contact through to after your therapy has ended, including:
• Why I am able to process your information and what purpose I am processing it for
• Whether you have to provide it to me
• How long I store it for
• Whether there are other recipients of your personal information
• Whether I intend to transfer it to another country,
• Whether I do automated decision-making or profiling,
• Your data protection rights, including how to raise a data protection concern with me.
I am happy to chat through any questions you might have about my data protection policy and you can contact me via email at psychodynamictherapybirmingham@gmail.com
‘Data controller’ is the term used to describe the person/ organisation that collects and stores and has responsibility for people’s personal data. In this instance, the data controller is me (Louisa Harvey). I am registered with the Information Commissioner’s Office (registration reference: ZB455059).
My phone number is: 07719 985638. My email address is: psychodynamictherapybirmingham@gmail.com
My lawful basis for holding and using your personal information:
The GDPR states that I must have a lawful basis for processing your personal data. There are different lawful bases depending on the stage at which I am processing your data. I have explained these below:
- If you have had therapy with me and it has now ended, I will use legitimate interest as my lawful basis for holding and using your personal information.
- If you are currently having therapy or if you are in contact with me to consider therapy, I will process your personal data where it is necessary for the performance of our contract.
The GDPR also makes sure that I look after any sensitive personal information that you may disclose to me appropriately. This type of information is called ‘special category personal information’. The lawful basis for me processing any special categories of personal information is that it is for provision of health treatment (in this case therapy) and necessary for a contract with a health professional (in this case, a contract between me and you).
How I use your information
Initial contact
When you contact me with an enquiry about my therapy services, I will collect information to help me satisfy your enquiry. This may include:
- Contact details, such as telephone number and email address
- Brief details you send me about your need for counselling or therapy
Alternatively, your GP or other health professional may send me your details when making a referral or a parent or trusted individual may give me your details when making an enquiry on your behalf.
If you decide not to proceed, I will ensure all your personal data is deleted within one month. If you would like me to delete this information sooner, just let me know.
While you are accessing therapy:
Rest assured that everything you discuss with me is confidential. That confidentiality will only be broken if:
- If you tell me that you or someone you know is at risk of harm. This is something I would discuss and explore with you to see if we could find an appropriate course of action to create safety. If this is not possible, I will always seek your consent and be clear and honest if I need to share information, with whom I will share it, and exactly what I will share. This could be your GP, social services, or emergency services, for instance.
- An exception to the above would be if to do so would put others at an increased, and immediate, risk of significant harm.
- When required by a court of law.
I will keep a record of your personal details to help the therapy services run smoothly. These details are kept on paper on the ‘client intake form’ I will ask you to complete, such as name, your pronouns, date of birth, contact details, GP details, medication, any disability information you wish to share with me and an emergency contact. These are not shared with any third party, except in the confidentiality exceptions above, for safeguarding reasons. Hard copies will be stored in a locked filing cabinet that no one else may access, digital copies are stored in password protected files on my private secure laptop.
I will keep very brief, typed notes of each session, which log attendance and general themes only. These are encoded and kept separately from your client intake form. These are kept securely in password-protected files, backed up on an encrypted hard drive, which is also locked away.
For best practice, therapists are required to have regular supervision, so I may discuss some details of our work together with my supervisors. However, they also abide by the same code of BACP ethics as myself, keeping all information confidential as outlined above.
For security reasons I do not retain text messages for more than one month. If there is relevant information contained in a text message, I will transcribe it and add it to your secure notes. Likewise, any email correspondence will be deleted after one month if it is not important. If necessary, I will copy and paste the email into your secure notes.
After therapy has ended:
Once therapy has ended your records will be kept for 7 years from the end of our contact with each other and are then securely destroyed, which is line with industry standards and as required by my insurer. If you want me to delete your information sooner than this, please tell me.
Third party recipients of personal data
I sometimes share personal data with third parties, for example, where I have contracted with a supplier to carry out specific tasks. This may be for the legal purposes of tax and accounting obligations. In such cases I have carefully selected which partners I work with. I take great care to ensure that I have a contract with the third party that states what they are allowed to do with the data I share with them. I ensure that they do not use your information in any way other than the task for which they have been contracted.
In line with Making Tax Digital changes coming up, I now send invoices through my Starling business bank account. To be HMRC/tax compliant, I have to use client name and address on invoices. The legitimate interest in this data use is for tax compliance, but I will also use the minimum data required as there is optional information that can be added that will not be used. These invoices will be kept securely for 7 years for tax compliance.
I have a clinical will in the event of my incapacity or death and client information is stored at www.clinicalwill.app. Only my clinical trustee has access to client information and only in the event that they are notified by a next of kin. ClinicalWill.App is password protected, designed by psychotherapists specifically with client confidentiality in mind. For more information about their Data Protection policy please see https://clinicalwill.app/security
I use a Remarkable digital notebook, which is password protected and contains emergency contact details for clients. This is stored in a locked filing cabinet in my home. I also access this data via the Remarkable app which stores data within the EEA on a Google Cloud Platform and access to the app is password protected on my device. Remarkable encrypt this information in transit and complies with both EU and GDPR privacy standards.
I use a separate phone for work and professional purposes which is password protected.
My professional email account is held with Google Mail
Remote video sessions are held on Zoom Pro with AI settings switched off.
AI Use
I do not put client data into AI platforms or use client data in AI tools. Wherever possible, I turn off AI settings on platforms used for work and professional purposes. If this changes, I will inform clients in advance of intention to use their data in this way and to account for the reasons for doing so.
Your rights
I try to be as open as I can be in terms of giving people access to their personal information. You have a right to ask me to delete your personal information, to limit how I use your personal information, or to stop processing your personal information. You also have a right to ask for a copy of any information that I hold about you and to object to the use of your personal data in some circumstances. You can read more about your rights at www.ico.org.uk/your-data-matters
If I do hold information about you I will:
• give you a description of it and where it came from;
• tell you why I am holding it, tell you how long I will store your data and how I made this decision;
• tell you who it could be disclosed to;
• let you have a copy of the information in an intelligible form.
You can also ask me at any time to correct any mistakes there may be in the personal information I hold about you.
To make a request for any personal information I may hold about you, please put the request in writing addressing it to Louisa Harvey at psychodynamictherapybirmingham@gmail.com
RAISING A DATA PROTECTION CONCERN OR COMPLAINT WITH ME
If you have any concern or complaint about how I handle your personal data, please do not hesitate to get in touch with me by emailing me: psychodynamictherapybirmingham@gmail.com
- Upon receiving your email I will confirm receipt of it letting you know the next steps I will take and when you can expect to hear from me about the outcome of the complaint.
- Without undue delay, I will begin to deal with the complaint by gathering all relevant information to establish the relevant facts, as thoroughly, fairly and accurately as possible. This may mean that I need to ask you for more information.
- I will give you regular updates about the process, in plain language, accounting for anything that might take longer than anticipated.
- I will record my actions as I go so that if you are unhappy with the outcome or response, it can be escalated to the ICO.
- I will respond to the complaint with the outcome once I have completed the investigation. I will explain clearly what I have done to resolve the data protection complaint and any actions I have taken as a result.
- If you are unhappy with how I have handled the complaint or with the outcome and wish to take it further, you can also take this to the ICO with whom I am registered (registration reference: ZB455059).
The ICO which is the statutory body that oversees data protection law in the UK. For more information go to www.ico.org.uk/make-a-complaint
Data security
I take the security of the data I hold about you very seriously and as such I take every effort to make sure it is kept secure. I use encrypted devices, a locked filing cabinet, and all mobile devices are password protected and/or use face recognition.
Visitors to my website
When someone visits my website www.psychodynamictherapybirmingham.co.uk, a WordPress site, standard internet log information is collected and details of visitor behaviour patterns. I do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way that does not identify anyone. More information on the relevant ‘Cookie’ policy for WordPress websites can be found here: https://automattic.com/cookies/.
I do not make, and do not allow WordPress to make, any attempt to find out the identities of those visiting my website.
I use legitimate interests as my lawful basis for holding and using your personal information in this way when you visit my website.
