top of page

Privacy & Data Protection Policy

 

​

Last updated: 08/10/2026

​

I, Becca Robinson-Chinn, am committed to protecting your privacy and handling your personal information in accordance with UK data protection legislation. This policy explains how I collect, use, store, and share your personal information when you use my website www.beccarobinsonchinntherapy.com and my therapy service.

 

1. Who I am

I, Becca Robinson-Chinn, provide a therapy service based in the UK. For the purposes of data protection law, I am the 'data controller' of your personal information.

My contact details:

​​​​

2. Information I collect

I may, depending on the nature of our interactions, collect and process the following types of personal information:

​​

  • Identity data: name, date of birth, gender.

  • Contact details: phone number, email address, postal address, emergency contact details (name and phone number).

  • Health information: details relevant to your mental and physical health and wellbeing (special category data), GP details.

  • Session notes: brief written records of our sessions, including themes discussed and any agreed actions.

  • Assessment information: initial assessment notes and any questionnaires you complete

  • Correspondence: emails, letters and messages between us.

  • Consent forms: your signed therapy agreement (terms and conditions of therapy) and consultation form.

  • Financial records: invoices, payment records and receipts.

  • Website usage data: IP address, browser type and information collected through cookies and similar technologies. Further information about the cookies used on my website and how you can manage your cookie preferences is provided through my website's cookie settings.

  • Referral information: details of how you came to therapy, including any referral from an Employee Assistance Programme or other organisation.

Important: Your health and therapy-related information is classified as 'special category data' under Article 9(1) of the UK GDPR. This means it receives enhanced legal protection, and I can only process it under specific conditions set out in law.

​

3. How I collect your information

  • When you contact me via email, phone, WhatsApp or the website contact form. Please note, email and WhatsApp/text messaging should only be used for administrative purposes, such as arranging or cancelling appointments, rather than for sharing sensitive therapeutic information.

  • When you register for therapy sessions.

  • When you visit my website.

  • From third parties if you are referred by a GP, EAP, health professional, or other service (with your consent). Where personal information is provided to me by a third party, such as an EAP, GP, health professional or other referring organisation, I will explain the source of the information and, where applicable, the type of information received.

  • If you contact me via the website, I will use the information you provide only to respond to your enquiry and determine whether I am able to offer therapy services.

  • I may use QR codes on printed materials such as business cards to direct you to my website or other online resources. The QR code itself does not collect personal information. If you follow a QR code to my website, information may be collected as described in this Privacy & Data Protection Policy and through my website's cookie settings.

​​

4. Lawful basis for processing

I process your personal data under the following lawful bases:

​

Enquiries about therapy:

If you contact me to enquire about therapy services (for example by email, telephone or through the website contact form), I process the personal information you provide in order to respond to your enquiry and determine whether I am able to offer an appropriate service. This processing is carried out under Article 6 (1) f UK GDPR- Legitimate Interests, as it is necessary to respond to requests for information about my therapy services. 

​​

Article 6 basis (general personal data):

I rely on Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us. When you engage me as your therapist, we enter into a contract for me to provide therapy services. Processing your personal data is essential for me to fulfil that contract.

​​

Article 9 basis (special category health data):

I rely on Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional. As a qualified therapist bound by professional confidentiality obligations, I am permitted to process your health information for the purpose of providing your therapy.

​

The additional condition required under UK law is found in DPA 2018 Schedule 1, Part 1, paragraph 2 (health or social care purposes).

​

The data is collected by the following ways:

​

  • When you first contact me to enquire about therapy (by phone, WhatsApp, email, or through the website contact form)

  • During your initial consultation or intake session

  • Throughout our ongoing therapy sessions

  • Via email, telephone, or video call communications between sessions

  • Through any forms or questionnaires you complete as part of your therapy

​​​​​

Providing personal information
Some personal information is necessary for me to provide therapy services and to meet my legal and professional obligations. If you choose not to provide information that is necessary for these purposes, I may not be able to provide therapy or certain aspects of my service.

 

5. How I use your information

I use your information to:

  • Provide therapy services.

  • Communicate with you regarding appointments and enquiries.

  • Keep accurate records in line with professional and legal requirements.

  • Improve my website and services: I may process website usage data to understand how visitors use my website and improve its functionality and content. Where I rely on legitimate interests for this processing, my legitimate interest is maintaining and improving my website and services.

Automated decision-making: I do not use your personal information to make decisions about you solely through automated processing, including profiling.

​

6. Who I share your data with

I treat your information as confidential and do not share it without good reason. However, the following parties may have access to your data in limited circumstances:

Clinical supervisor: As explained below I discuss my therapeutic work in supervision using non-identifiable case material only.

EAP or referral platform: Where you have been referred to me through an Employee Assistance Programme or similar referral arrangement, I may share limited information with the commissioning organisation as part of that arrangement.

This is typically limited to confirming attendance and session count, not the content of our sessions. The specific information shared will be explained to you at the outset of therapy.

Safeguarding and legal obligations: In exceptional circumstances, I may need to share relevant information where this is necessary to protect you or another person from serious harm, to meet safeguarding responsibilities, or where disclosure is required or authorised by law. Wherever possible and appropriate, I will discuss this with you before making a disclosure.
​​​

7.  Professional obligations and supervision

I am required by the BACP to attend regular clinical supervision. Supervision is an essential part of ethical therapeutic practice — it helps me reflect on my work and ensures I am providing you with the best possible care.

When I discuss my therapeutic work with my supervisor:

  • Identifying details are not shared with my supervisor

  • I use first names or initials case material only

  • My supervisor is a qualified professional bound by the same confidentiality obligations as I am

  • My supervisor is bound by their own professional body's ethical framework

Supervision discussions are focused on the therapeutic process and my professional development, not on identifying individual clients.

​​

​

8. Third-party service providers: I use the following third-party services which may process your data:

  • GoDaddy —  used for domain registration services.

  • Wix —  used to build and host this website and may process certain technical data about website visitors, including basic analytics.

  • Zoom — used for video therapy sessions where agreed.

  • WhatsApp – used for administrative purposes to arrange and/or cancel sessions.

  • Google Workspace – used for administration purposes and email communication.

  • Jotform – used for client forms and contracts.

  • ​

Links to their privacy policies are available below.

 

I never sell or rent your personal data.

​​

9. International data transfers

Some of the third-party providers I use to deliver my services, including Wix (website hosting), GoDaddy (domain registration services), WhatsApp (communications),  Zoom (video consultations) and Google Workspace (communications, forms), may process or store personal data outside the UK. Where this occurs, those providers rely on recognised data transfer mechanisms and appropriate safeguards, such as UK adequacy regulations or Standard Contractual Clauses, to protect personal information

​​​

  • Wix (Wix.com, Israel)

  • GoDaddy (GoDaddy.com, LLC, USA)

  • WhatsApp (Meta Platforms Inc. USA)

  • Zoom (Zoom Communications, Inc. USA)

  • Google Workspace (Google LLC and/or the applicable Google Workspace contracting entity, USA)

  • Jotform (Jotform Ltd, United Kingdom)

​

Where personal data is transferred outside the UK, I ensure that appropriate safeguards are in place in accordance with UK GDPR. Depending on the provider and destination country, this may include UK adequacy regulations, participation in the UK Extension to the EU-US Data Privacy Framework, or the use of International Data Transfer Agreements (IDTAs) or Standard Contractual Clauses (SCCs), as appropriate.

​​​

For further information about how these providers process personal data, please refer to their own privacy policies:

​

10. Data retention - Why I retain your data

 

As a therapist in private practice, I keep records of our work together for several important reasons:

•Legal obligations — The law requires me to keep certain records for specific periods, including financial records for tax purposes.

•Professional standards — I maintain records in accordance with the professional standards expected of therapists in private practice and the ethical framework of BACP.

•Insurance requirements — My professional indemnity and public liability insurance requires me to retain records in case a claim is made after therapy ends.

•Continuity of care — If you return to therapy, having access to previous records helps me provide appropriate support.

•Your protection and mine — Records may be needed if questions arise about the therapy we undertook together.

 

11. Data retention periods

The following outlines the type of record, it’s data retention period and the reason for retaining this data.

​

Client therapy records (including session notes, contracts and consultation forms)

7 years after our last session

To meet professional, legal and professional indemnity insurance requirements and to enable the establishment, exercise or defence of legal claims where necessary.

​

Enquiry and contact data (including website contact form submissions)

7 years after our last session

OR

6 months if you do not proceed with therapy

To respond to your enquiry and follow up if appropriate.

​

Financial records and invoices

7 years after our last session

Required by HMRC for tax purposes.

​

Insurance records

7 years after our last session

To evidence coverage in case of a claim.

 

12.How your data is stored

I take the security of your information seriously and use the following safeguards:

Electronic records:

  • Session notes are saved in an encrypted, password-protected document.

  • Documents are saved to an encrypted, password-protected USB stick which is kept in a locked storage container separate from laptop.

  • The device, laptop, used for sessions, note taking and other correspondence is password-protected.

  • Correspondence via email and consultation forms are stored on Google Workspace which is an encrypted platform.

  • Zoom and WhatsApp use encryption and other security measures to protect communications. Where appropriate, I use the available security and privacy settings provided by these services.

  • Access is restricted to me only.

  • Regular backups maintained securely and appropriate anti-virus protection is in place a regularly renewed on the device.

Electronic records are securely and permanently deleted from the systems on which they are held.

I do not keep paper records.

 

​​13. Your rights

Under UK data protection law, you have the right to:

  • Access a copy of your personal data.

  • Correct inaccurate or incomplete data.

  • Request deletion of your data (subject to professional/legal obligations).

  • Restrict or object to processing in certain circumstances.

  • Data portability (in certain cases).

  • Withdraw consent at any time (where processing is based on consent).

​Right to object: You have the right to object to certain types of processing, including processing based on legitimate interests. Where I rely on legitimate interests, I will explain this and consider any objection in accordance with applicable data protection law.

 

14. Complaints​​

If you have concerns about how I have collected, used, stored, shared or otherwise handled your personal information, please contact me in the first instance at becca@beccarobinsonchinntherapy.com so that I have the opportunity to investigate and resolve the matter.

I will acknowledge receipt of a data protection complaint within 30 days. I will take appropriate steps to investigate the complaint without undue delay, keep you informed where appropriate, and let you know the outcome of my investigation.

If you remain dissatisfied following my response, you have the right to raise your concern with the Information Commissioner's Office (ICO). Further information about making a complaint can be found at www.ico.org.uk .

​​​

15. Security

I take appropriate technical and organisational measures to protect your personal information from loss, misuse, or unauthorised access.

 

16. Artificial Intelligence (AI)

I do not use artificial intelligence (AI) to record, transcribe or analyse counselling sessions.

​

17. Changes to this policy

I may update this Policy from time to time. Any changes will be posted on this page with an updated 'last updated' date.

bottom of page