Privacy Policy
Last updated: 1st September 2026
I am committed to protecting and respecting your privacy. This Privacy Policy explains how I collect, use, store, and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025/2026.
I am registered as a Data Controller with the Information Commissioner’s Office (ICO) under registration reference: ZA249395.
What information I collect
I may collect and securely store the following information:
Contact details: Your name, email address, telephone number, and address.
Intake & emergency details: Date of birth, emergency contact details, and GP practice information.
Clinical records: Brief, encrypted electronic session notes, assessment forms, and correspondence related to our therapeutic work.
Health & special category data: Relevant medical history, psychological health details, and lifestyle context shared during therapy.
Financial & administrative data: Invoicing records, session attendance dates, and insurance policy/authorisation numbers where applicable.
Recordings: Audio/video recordings only in rare circumstances where explicit, written consent has been provided (e.g., for specific training or professional development).
Lawful Basis for Processing Your Data
Under UK data protection law, I rely on the following lawful bases to process your information:
Contract: To provide therapy services, manage bookings, and fulfil our therapeutic agreement.
Health or Social Care (Article 9(2)(h) UK GDPR): For processing confidential special category health data necessary for the provision of healthcare and psychological therapy.
Legal Obligation & Vital Interests: To comply with statutory safeguarding requirements or take action where there is a serious risk of harm to you or others.
Legitimate Interests: For standard administrative management, accounting, clinical supervision, and professional practice requirements.
Consent: For optional uses, such as specific audio recordings or electronic marketing/blog updates, which you may withdraw at any time.
How Your Information is Stored & Secured
Digital security: Electronic notes, emails, and intake forms are stored securely using encrypted, password-protected systems and two-factor authentication (2FA).
Third-party processors: Where third-party platforms are used (e.g., website hosting, encrypted email, secure video platforms, or practice management tools), I take appropriate steps to ensure they comply with UK GDPR security standards.
Paper records: Any physical or paper documents are kept securely in a locked location.
How Long I Keep Your Information
I retain personal data only for as long as necessary and in alignment with UK professional standards and insurance guidelines:
Clinical session notes: Retained for 6 years following the end of therapy (in accordance with standard professional indemnity requirements), after which they are securely destroyed.
General contact and administrative data: Retained for the duration of our work together and securely deleted within 1 month following the end of therapy.
Financial and invoice records: Retained for 7 years to satisfy HMRC legal and accounting requirements.
Session recordings (if consented): Retained only for the agreed duration and securely deleted upon completion of the specific purpose.
Sharing Your Information & Confidentiality
Your therapy sessions and records are confidential. Information is only shared in the following specific circumstances:
Clinical Supervision: In line with UKCP professional standards, I regularly review my clinical work with a qualified supervisor. All case material discussed is anonymised to protect your identity.
Therapeutic Executor: I share limited client contact details with a trusted, qualified therapeutic colleague (Therapeutic Executor). This information would only ever be accessed in the event of my sudden incapacitation or death, ensuring you are contacted and supported appropriately.
Private Healthcare Insurers: If your therapy is funded through an insurer (e.g. Bupa, AXA Health, Vitality, Aviva), required billing, attendance, or treatment summaries will only be shared with your explicit agreement.
Legal & Safeguarding Exceptions: Confidentiality may be broken only if legally required (e.g., court order, terrorism, money laundering) or if I hold serious concerns regarding imminent risk of harm to you or another person. Where safe and appropriate, I will discuss this with you beforehand.
Your Rights Under Data Protection Law
You have statutory rights regarding the personal data I hold, including:
Right of access (Subject Access Request): You have the right to request a copy of the personal data held about you (searches will be conducted in a reasonable and proportionate manner).
Right to rectification: You may ask me to correct inaccurate or incomplete data.
Right to erasure: You may ask for data to be deleted where there is no overriding legal or insurance requirement to retain it.
Right to restrict or object to processing: In certain circumstances, you can request that the processing of your data be restricted or object to its use.
Data Protection Concerns & Complaints Procedure (Updated 2026)
If you have any questions or concerns about how your data is handled, you have the right to raise a complaint directly with me:
First-tier complaint: Please email your concern in writing to alison@alisonbrake.com.
Acknowledgement: I will formally acknowledge receipt of your complaint in writing within 30 days.
Investigation & Resolution: I will investigate the matter without undue delay and provide a written response regarding the outcome (aiming to resolve all complaints within 3 months).
Escalation to the Regulator: If you remain unsatisfied with my response, you have the right to escalate your complaint to the Information Commissioner’s Office (ICO):
Website: www.ico.org.uk
Helpline: 0303 123 1113
Website enquiries
If you contact me through this website, your personal data will be processed in accordance with this Privacy Policy.