This privacy notice explains what you should expect me to do with your personal information if you are a client, or are considering becoming a client, of my psychotherapy and counselling practice. It applies once you begin the process of arranging or attending therapy with me.
Client Privacy Notice
ICO registration: ZC236682
Telephone: 07597 311371
If you have only visited my website or sent an enquiry and have not yet become a client, my separate Website Privacy Policy explains how I handle your information at that stage.
I understand how important your privacy is, and I take care to maintain your confidentiality in accordance with current data protection law (the UK GDPR and the Data Protection Act 2018) and the UKCP's Code of Ethics and Professional Practice. These standards exist to protect your confidential information and to ensure that I always conduct myself with professionalism and integrity.
In order to provide you with the best service possible, I hold your personal contact details and records of your therapy sessions. This notice sets out important information about how that information is held and used. I will email you a full copy of this notice, via Microsoft 365, at the start of our work together, for you to keep for
On this page
Contact details
Telephone: 07597 311371
Email: stuart@stuartangelltherapy.co.uk
Post: Stuart Angell, 124 City Road, London, EC1V 2NX
ICO registration number: ZC236682
The information I collect, use and why
To provide and improve my therapy service, I collect or use the following information about you:
Names and contact details
Addresses
Date of birth
Third-party information (such as your GP and emergency contact)
Transaction data, including details of payments to and from you and the services you have purchased
Health information, such as relevant medical history or health conditions
Information relating to compliments or complaints
Records of meetings and decisions
As part of your onboarding process, you will receive a Client Information form requesting your contact details, date of birth and home address, and contact details for your GP and an emergency contact of your choosing, so that I can fulfil my duty of care to you. These details are stored securely in Kiku – my practice management software – and are only accessible to me.
Health information is special category data under data protection law and receives extra protection due to its sensitive nature. My condition for processing this data is the ‘health or social care purposes’ condition under Article 9(2)(h) UK GDPR and paragraph 2 of Schedule 1 to the Data Protection Act 2018. This applies because I provide psychotherapy and am bound by a professional duty of confidentiality equivalent to that of a health professional, through my membership of the UKCP and my adherence to its Code of Ethics and Professional Practice and complaints procedure.
For the operation of your client account, I collect: names and contact details, addresses, and your records of appointments and fees.
To comply with legal requirements, I collect: your name, contact information, safeguarding information, and any other personal information required to comply with legal obligations.
To protect your welfare, I collect: names and contact information, health and wellbeing information, and emergency contact details.
To deal with queries, complaints or claims, I collect: names and contact details, addresses, records of appointments and fees, client account records, financial transaction information, and correspondence.
Confidentiality of your therapy sessions
Everything you discuss with me is confidential. I will only break confidentiality if I am concerned about your safety or the safety of someone else, or if I am instructed to do so by a court of law. Wherever possible, I will talk to you about this first.
I discuss my clinical work with a supervisor, as required by my professional body, to make sure I am offering you the best possible service. These conversations are themselves bound by confidentiality, and your identity is anonymised.
I keep notes of each session. These are anonymised and stored securely within the password-protected Kiku system. They are for my use only, to help me keep track of your therapeutic work. In line with industry guidance, I keep your name, client reference number and session notes securely for up to seven years after your therapy ends, after which they are confidentially destroyed.
If your sessions are paid for or arranged by a third party (such as your employer, a friend or a family member), I will not share details of what is discussed in your sessions with them. Other than payment requests, invoices or receipts, this information remains confidential between us, and I will only share anything further with your written consent.
My clinical will
As part of my professional responsibilities, I have a clinical will in place – a formal arrangement that protects continuity of care for my clients in the rare event of my sudden incapacitation or death.
Under this arrangement, a named clinical executor – a fellow professional, bound by the same professional confidentiality obligations that I am – is authorised to gain temporary, limited access to my client contact details, solely for the purpose of contacting you and discussing appropriate arrangements for your ongoing support, including offering you further sessions with them if you wish. My clinical executor will also notify any agencies, employee assistance programmes or insurance companies for whom I act as a provider, and will arrange the confidential deletion of digital records, including my Kiku account, once these are no longer needed.
My next of kin holds a copy of this arrangement and my clinical executor’s contact details, and may access financial reports needed to settle outstanding business matters. My next of kin does not have access to your clinical records or therapy notes; that access is limited to my clinical executor, for the purposes described above.
My lawful basis for this arrangement is legitimate interests – ensuring continuity of care and fulfilling my professional and ethical duty of care to you – and, where necessary to protect your welfare, vital interests. This arrangement is reviewed and renewed annually.
My lawful bases for using your information
Under UK data protection law, I must have a lawful basis for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR, and you can find out more about these on the ICO's website. The lawful bases I rely on are set out below, by purpose.
To provide and improve your therapy service
Contract – I need to collect and use this information to enter into and carry out my agreement with you.
Legitimate interests – as an independent psychotherapy practice, I have a legitimate interest in collecting and processing my clients’ personal data to ensure the safe, efficient and ethical delivery of psychological therapy. This is necessary to maintain accurate administrative records, manage session schedules, track attendance and support continuous service improvement. These benefits directly serve you by ensuring continuity of clinical care, clear professional communication and robust administrative support, and they outweigh any risk to you, as your data is kept strictly confidential and stored securely. I do not use more of your data than is necessary to support your ongoing therapeutic care and to meet the professional standards required by my clinical insurance and professional body.
Vital interests – where collecting or using information is needed because your (or someone else’s) physical or mental health is at urgent or serious risk.
For the operation of your client account
Contract – I need to collect and use this information to enter into and carry out my agreement with you.
Legitimate interests – I have a legitimate interest in processing personal data for the efficient administration of client accounts, booking schedules and financial records – for example, to manage appointment bookings, issue invoices, track session payments and maintain accurate financial records. To do this securely, I store your client details, onboarding forms and session records in practice management software (Kiku), arrange appointments directly by email, and use a secure accounting platform (Xero) for financial administration and invoicing. This serves you by ensuring reliable communication about bookings and transparent billing, and outweighs any impact on you, as the data collected is limited to basic administrative details, processed via encrypted systems and kept confidential.
To comply with legal requirements
Legal obligation – I need to collect and use your information to comply with the law.
Legitimate interests – I have a legitimate interest in processing and retaining personal data to satisfy my professional, regulatory and insurance requirements – including the record-keeping guidelines set out by my professional body and the retention requirements of my clinical liability insurance provider. This ensures my practice operates with professional integrity and protects both of us in the event of a legal or clinical claim, while data is limited to what is professionally required, encrypted and kept confidential.
To protect your welfare
Legitimate interests – I have a legitimate interest in processing personal data to actively protect and support your ongoing welfare, physical safety and mental wellbeing. This is necessary to conduct clinical risk assessments, document safety plans where appropriate, and securely hold emergency contact and GP details, so that I am prepared to act protectively before a situation becomes an emergency. This provides a robust clinical safety net and outweighs any impact on your privacy, as the data is limited to what is necessary for risk management and handled with the highest level of professional confidentiality.
Vital interests – where collecting or using information is needed because your (or someone else’s) physical or mental health is at urgent or serious risk.
To deal with queries, complaints or claims
Contract – I need to collect and use this information to enter into and carry out my agreement with you.
Legal obligation – I need to collect and use your information to comply with the law.
Legitimate interests – I have a legitimate interest in processing personal data to respond to queries, manage formal complaints, and defend against legal or insurance claims – for example, reviewing communication histories, financial records in Xero, and clinical session notes securely stored in Kiku, and sharing necessary evidence with my professional body, legal advisors or clinical liability insurer if a dispute arises. This ensures a fair, evidence-based resolution process, and the data reviewed is limited to what is relevant and remains protected by professional confidentiality standards.
Special category condition – where this involves your health information, my condition under Article 9 UK GDPR is that the processing is necessary for the establishment, exercise or defence of legal claims (Article 9(2)(f)), rather than the health or social care condition described above, which relates specifically to your therapy.
Your data protection rights
At any point during your time as my client, or during the seven years afterwards while I retain your records, you have the following rights. Which rights apply may depend on the lawful basis I am relying on for a particular use of your data.
Right of access – you can ask me for copies of your personal information, and for details of where I get it from and who I share it with.
Right to rectification – you can ask me to correct or delete personal information you think is inaccurate or incomplete.
Right to erasure – you can ask me to delete your personal information.
Right to restriction of processing – you can ask me to limit how I use your personal information.
Right to object – you can object to my processing of your personal data.
Right to data portability – you can ask me to transfer the personal information you gave me to another organisation, or to you.
Right to withdraw consent – where I rely on consent as my lawful basis, you can withdraw that consent at any time.
There are some exemptions to these rights, which means you may not always receive everything you ask for. You can read more about your rights on the ICO's website. If you make a request, I must respond without undue delay and within one month. To exercise any of these rights, please contact me using the details above.
Where I get your information from
I get your information directly from you, including any details you first shared through my website enquiry form (which are then covered by this notice once you become a client). I also receive personal information from trusted third-party service providers that support my practice: onboarding details processed via my practice management software, Kiku; and financial or invoicing data handled through my accounting platform, Xero. I may also occasionally receive information from other clinical professionals, such as your GP, where an official referral has been made or you have given explicit consent.
How long I keep your information
Your personal information is held for the duration of your therapy, after which it is deleted from my Kiku database.
Your name, client reference number and session notes are kept securely for up to seven years after your therapy ends, so that I can respond effectively to any request regarding your clinical notes and therapy. After this time, they are confidentially destroyed.
Payment records (anonymised with a unique client reference number) are retained for five years after the end of the relevant financial year, as required by HMRC.
Still working through this? Here’s the contents list again.
Online sessions and how I communicate with you
Where we meet online or by telephone, I make sure sessions take place in a quiet, private and confidential setting. For online sessions, I use Zoom Video Communications, Inc. Video and audio are encrypted in transit, every session is protected by a unique password and a virtual waiting room, and I admit you to the session manually so that no unauthorised person can join. I do not record sessions – cloud recording, local recording and Zoom's automated transcription and AI Companion features are all disabled on my account. I have a data processing agreement in place with Zoom that incorporates the UK International Data Transfer Addendum, so my use of the platform is bound by UK data protection standards.
To protect your privacy in my day-to-day systems, I do not use your name, email address or initials in my digital calendar – appointments are logged internally against an anonymous client reference number instead. I also do not add your email address as a guest on calendar invites, so that no notification appears on a shared or family device. Your recurring Zoom meeting link is sent to you directly and manually by email ahead of our first session. Please ensure you attend our sessions from a private space, using a secure, password-protected internet connection rather than public Wi-Fi, to help protect your own confidentiality.
My email account is reserved for administrative purposes only – such as changing an appointment time, handling a billing query, or sending you documents like this notice – and must not be used to discuss sensitive therapeutic material, or for crisis support; please refer to the Emergency and Crisis Support section below if you need urgent help. I access my business email only through a secure, password-protected webmail interface, rather than a mail app on my phone or computer, so your email address and message contents are never stored on my personal devices. I do not keep an ongoing archive of email correspondence. Where something from an email needs to form part of your record – for example, a changed appointment time – I transfer that detail into your secure client file in Kiku and it is not separately retained in my email account.
I also have a dedicated mobile telephone number for calls and text messages with clients and prospective clients, which is separate from my personal phone, is password protected, and is not used for personal purposes. This number is reserved for administrative purposes only – such as arranging or changing an appointment time, or handling a billing query – and must not be used to discuss sensitive therapeutic material, or for crisis support; please refer to the Emergency and Crisis Support section below if you need urgent help. Voicemail is enabled on this number, provided through my network provider. I do not keep an ongoing archive of calls, texts or voicemails. Where something needs to form part of your record – for example, a changed appointment time – I transfer that detail into your secure client file in Kiku, and it is not otherwise retained.
Emergency and Crisis Support
I do not provide an emergency or crisis intervention service, and I cannot guarantee a response outside of our agreed session times. If you experience a mental health crisis or require immediate support, please contact the following services directly:
Emergency Services: Call 999 or attend your nearest hospital Accident & Emergency (A&E) department.
NHS Urgent Mental Health: Call 111 (Option 2) for 24/7 access to local NHS mental health crisis teams.
Samaritans: Call 116 123 for free, confidential emotional support, 24 hours a day.
Shout Crisis Text Line: Text SHOUT to 85258 for free, 24/7 confidential support via text.
Your General Practitioner (GP): Contact your local surgery for an urgent appointment.
Sharing information outside the UK
Where necessary, I may transfer personal information outside the UK. When I do, I comply with the UK GDPR and make sure appropriate safeguards are in place. For further information, or to obtain a copy of a safeguard listed below, please contact me using the details above.
Microsoft Corporation – country: United States. Safeguard: Microsoft is certified under the UK Extension to the EU-U.S. Data Privacy Framework, which the UK government recognises as providing an adequate level of data protection for this transfer.
Xero – country: New Zealand and the United States. Safeguards: for New Zealand, the transfer relies on UK Adequacy Regulations, as the UK government formally recognises New Zealand’s domestic privacy laws as providing an adequate level of data protection; for the United States, the transfer is safeguarded by Xero’s Data Processing Terms, which incorporate the UK International Data Transfer Addendum appended to the Standard Contractual Clauses.
Zoom Video Communications, Inc. – country: United States. Safeguard: Zoom’s standard contract incorporates the UK International Data Transfer Addendum issued under section 119A of the Data Protection Act 2018, appended to the European Commission’s Standard Contractual Clauses. This contractually obliges Zoom to maintain data protection standards equivalent to those within the UK.
Consent
Before we begin working together, you will be asked to sign my Client Agreement via Kiku, which includes your acknowledgement that you have read and understood this notice, and your agreement to its terms. Separately, I will always ask for your specific, explicit consent before undertaking any activity not already covered by this notice – for example, before recording a session, or before sharing your information with a third party beyond what is described above. You are entitled to withdraw any consent you have given at any time by emailing me at stuart@stuartangelltherapy.co.uk.
If there is a data breach
In the event of a breach of my data protection practices, I will notify you and the Information Commissioner's Office (ICO) within 72 hours, and will act immediately to put things right.
How to complain
If you have any concerns about my use of your personal information, please contact me:
Telephone: 07597 311371
Post: FAO Stuart Angell, 124 City Road, London, EC1V 2NX
If you remain unhappy with how I have used your data after raising a complaint with me, you can also complain to the ICO. I am registered with the ICO under reference number ZC236682.
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Helpline: 0303 123 1113. Website: https://www.ico.org.uk/make-a-complaint