Introduction

Your privacy is important to me. Your personal information will be kept safe and secure, and only used for the purpose it was given to me. I comply with current data protection legislation, including the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003.

This policy explains what I do with your personal information from your first point of contact through to after our work together has ended, including:

• Why I’m able to use your information, and for what purpose

• Whether you have to provide it to me

• How long I keep it

• Whether anyone else receives your information

• Whether I transfer it to another country

• Whether I carry out automated decision-making or profiling

• Your data protection rights

I’m happy to talk through any questions about this at any time. You can contact me by email at kirstymtherapy@gmail.com.

“Data controller” describes the person or organisation responsible for your personal data. In this case, that’s me, Kirsty Murray. I am registered with the Information Commissioner’s Office, registration number ZC272172.

Phone: 07737 986730

Email: kirstymtherapy@gmail.com

My lawful basis for using your information

• If you’re considering therapy or currently having therapy with me, I use your information because it is necessary to respond to your enquiry and to provide the therapy we have agreed (Article 6(1)(b) UK GDPR).

• Health and other sensitive information (“special category” data) is used because it is necessary for the provision of health care by a professional bound by a duty of confidentiality (Article 9(2)(h) UK GDPR). I only collect what is clinically relevant.

• After our work has ended, I keep your records for the period set out below. This lets me meet my professional record-keeping obligations and respond to any complaint or legal claim (Article 6(1)(f) and Article 9(2)(f) UK GDPR).

Do you have to provide your information?

You don’t have to give me any information. However, I need your contact details to respond to an enquiry. Before we begin working together, I need certain details, such as your GP and an emergency contact, so that I can provide therapy safely. If you’d prefer not to share something, please talk to me about it.

How I use your information

Initial contact

When you first contact me, I’ll collect the information I need to respond. This includes your name, contact details and a brief reason for your enquiry. A GP or other health professional may also send me your details when making a referral, or someone you trust may contact me on your behalf.

If you decide not to go ahead, I’ll delete your personal data within 6 months. If you’d like it deleted sooner, just let me know.

While you’re having sessions with me

Everything you discuss with me is confidential, except in the following circumstances:

• If I believe you are at serious risk of harming yourself or others

• If I believe you are at serious risk of harm from others

• If I have a safeguarding concern about a child or an adult at risk

• Where I am legally obliged to share information, for example in relation to acts of terrorism, or if I am required to by a court order

Wherever possible, I will discuss any concerns with you before taking further action, unless doing so would increase the risk to you or someone else.

I keep a record of your personal details so that our sessions run smoothly. These are kept securely on an encrypted, password-protected laptop used only by me.

I keep brief notes of each session. My notes use initials rather than full names, and any information that identifies you is kept separately. Typed notes are stored on an encrypted, password-protected laptop used only by me and backed up to an encrypted drive. Paper notes and backups are kept in a locked filing cabinet to which only I have access.

For security, I delete text messages within one month. If a text contains something clinically relevant, I’ll add a brief summary to your notes before deleting it. The same applies to email: I delete emails within three months, unless they are clinically relevant, in which case I add a brief summary to your notes first.

After our work together has ended

Your records are kept for 7 years from the end of our work together, then securely deleted or shredded.

Who I share information with

I do not share your information for marketing or commercial purposes. Limited sharing may happen in the following circumstances:

• Clinical supervision: I discuss my work in regular supervision, as required by my professional body. Only anonymised information is shared, and your identity is not disclosed.

• Emergency and safeguarding situations: in the circumstances described above, I may share relevant information with your GP, emergency services, social care or another appropriate professional.

• Service providers: I use a small number of trusted providers to run my practice: Squarespace (website and enquiry form), Google (email, calendar invitations and online sessions via Google Meet) and Xero (invoicing and accounts). They hold limited information, such as your name and contact details, only on my behalf, and they never receive session notes.

• Legal and professional requirements: I may need to share information with regulators or authorities where the law requires it, for example HMRC, the ICO, or my professional body.

• Business continuity: in the event of my death or incapacity, a nominated colleague, who is also a BACP member bound by the same confidentiality rules, would access records solely to let clients know and to close the practice confidentially.

Transfers outside the UK

Some of my service providers may store data outside the UK. Where this happens, your information is protected by safeguards recognised under UK data protection law.

Automated decision-making

I do not use automated decision-making or profiling.

Your rights

Under UK GDPR, you have the right to:

• Access the personal information I hold about you

• Ask me to correct inaccurate or incomplete information

• Ask me to delete your information, in certain circumstances

• Ask me to restrict how I use your information, in certain circumstances

• Object to how I use your information, in certain circumstances

• Request your information in a portable format

• Withdraw your permission for me to contact your GP at any time

Please note that I may need to keep some records for the period set out above to meet my professional and legal obligations, so I may not always be able to delete or stop using your information straight away. If this applies, I will explain why.

To make a request, please email kirstymtherapy@gmail.com. I will respond within one month.

If you have any concerns about how I handle your personal data, please get in touch. I’d welcome the chance to put things right. If you remain unhappy, you can make a complaint to the Information Commissioner’s Office (ICO), the UK’s statutory body overseeing data protection:

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
ico.org.uk/make-a-complaint

Data security

I take the security of your information seriously. I use an encrypted, password-protected laptop used only by me, with encrypted backups. Paper notes and backups are kept in a locked filing cabinet to which only I have access.

Information for website visitors

When you visit my website, Squarespace, my website host, may collect standard internet log information and details of how visitors use the site, to help me understand how it is used. This information doesn’t identify individual visitors, and I don’t try to find out the identity of anyone browsing the site. My lawful basis for this is legitimate interest (Article 6(1)(f) UK GDPR).

Like most websites, this site uses cookies to help it work efficiently. When you first visit, you’ll be asked to accept or decline non-essential cookies through a cookie banner. You can change your choice at any time. You can find general information about cookies and how to manage them at aboutcookies.org.

If you fill in the contact form on my website, your information is held securely by Squarespace and sent to my email. It is then handled as described under “Initial contact” above.

Changes to this policy

I may update this policy from time to time to reflect changes in my practice or the law. The current version will always be available on this page.

Contact

If you have any questions about this policy, please contact:

Kirsty Murray
kirstymtherapy@gmail.com

Last updated: October 2026