A Foundation of Trust and Safety
At Causeway Therapy, we believe that feeling safe and understood is the heart of our work together. Protecting your privacy is a vital part of the professional care we provide. This policy explains how we look after your information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025, and the ethical guidelines of the BACP and UKCP.
- Our Responsibility: Causeway Therapy acts as the “Data Controller” and is registered with the Information Commissioner’s Office (ICO).
- ICO Registration Number: ZA492668
- Contact Us: For any questions about your privacy, please email admin@causewaytherapy.co.uk.
The Information We Collect
To provide a safe and professional service, we collect the following information:
- Personal Details: Your name, address, date of birth, email address, and telephone number.
- Emergency Contact Information: We require the name and contact details of your GP and an elected Emergency Contact person.
- Clinical Data: Brief, pseudonymised professional notes regarding our sessions and any relevant mental health history you choose to share.
- Financial Data: Records of your payments made via BACS.
How Your Information is Stored and Protected
We take the security of your data very seriously and use the following methods to ensure it remains safe:
- Physical Storage: Your contact information and any paper records are stored in a securely locked filing cabinet.
- Digital Storage: Some limited information is held in a password-protected database. All electronic information is stored on encrypted devices.
- Email Security: Our email accounts use secure servers with double password protection. All devices used for correspondence are encrypted and protected by modern anti-virus software.
- Access: Access to your contact information is strictly limited to your therapist and our administrative team. Clinical notes are for your therapist’s use only.
Understanding Your Clinical Records
To provide you with the most consistent and thoughtful support, your therapist maintains brief professional records.
- Professional Memory: Your therapist keeps brief, pseudonymised notes after each session. These are not a detailed account of our conversations, but rather a professional tool used to track themes discussed, interventions used, and your general progress.
- Therapeutic Benefit: These records serve as a “professional memory,” allowing your therapist to hold the thread of your journey from week to week.
- Access to Records: Under data protection law, you have the right to request a copy of the information held about you (a Subject Access Request). We will respond within one calendar month. We reserve the right to refuse or charge a reasonable fee for requests that are manifestly unfounded or excessive.
Lawful Basis for Processing (UK GDPR Articles)
Under UK law, we must specify the legal grounds for holding your data:
- Contractual Necessity (Article 6(1)(b)): We use your contact and billing details to fulfil our agreement to provide you with therapy.
- Provision of Healthcare (Article 9(2)(h)): As healthcare providers, we process sensitive health information (clinical notes) for the provision of health or social care or treatment.
- Vital Interests (Article 9(2)(c)): In a life-or-death situation, we may share information with emergency services to protect your immediate safety.
Online Working and Digital Security
Whether we meet via Microsoft Teams or Zoom, your privacy is our priority.
- Technical Safety: Both platforms use high-level encryption to protect our conversations.
- A Private Environment: Your therapist will always be in a quiet, confidential setting. We ask that you do the same to protect the integrity of the therapeutic space.
- No Recording: No recording (audio or video) of sessions is permitted by either party without prior written consent.
Payments and Statutory Rights
- BACS Payments: Payments are made via BACS. While your name or reference will appear on our bank statements, these are held securely. In accordance with HMRC requirements, we keep financial records for 6 years.
- 14-Day Cooling-Off Period: You have a statutory 14-day cooling-off period after booking. If you choose to start sessions within these 14 days, you agree to waive the right to a full refund for sessions that have already taken place.
Confidentiality and Professional Continuity
Your information is strictly confidential. It is only shared in these professional circumstances:
- Clinical Supervision: In line with BACP and UKCP requirements, therapists discuss pseudonymisedwork with a qualified supervisor.
- Clinical Will (Therapeutic Executor): We have appointed a trusted, qualified colleague as a Therapeutic Executor. Should your therapist suddenly become unable to work, this colleague will be given limited access to your contact details only to ensure you are informed and supported.
- Safety and Legal Obligations: Confidentiality may be breached if there is a risk of serious harm to yourself or others, or if a Court of Law requires it (e.g., under the Children Act 1989).
Data Retention and Your Rights
- Retention: Pseudonymised notes are kept for 7 years after our work ends (or until age 25 for those who started as minors) to meet legal and insurance standards. After this, they are securely destroyed.
- Intellectual Property: Content on the Causeway Therapy website (articles, logos, and text) is our intellectual property and may not be reproduced without permission.
- Your Rights: You have the absolute right to object to the processing of your data. You may also ask us to update inaccurate details.
- Complaints Procedure: If you have a concern about how your data is handled, you must first raise it with us directly by emailing admin@causewaytherapy.co.uk. We will acknowledge your complaint within 30 days and keep you informed of the outcome of our investigation. If you remain dissatisfied after exhausting our internal process, you have the right to escalate your complaint to the ICO (http://www.ico.org.uk).
- Breach Notification: In the event of a high-risk data breach, we will notify the ICO and yourself within 72 hours.
