Privacy policy

Effective Date: 4th August 2026

Version: 2.0

Review Date: August 2027

Graceful Therapy is committed to protecting your privacy and handling your personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy explains what personal information I collect, why I collect it, how it is used, how it is stored, how long it is retained, and your rights regarding your personal data.

Katie Westbury, trading as Graceful Therapy, is the Data Controller for the purposes of UK data protection legislation.

1. Lawful Basis for Processing Personal Data

Data protection legislation allows personal data to be processed where there is a lawful basis to do so. Within Graceful Therapy, this includes:

  • Legitimate Interests: Processing personal data to respond to enquiries, assess suitability for therapy and provide a safe, ethical and professional counselling service.

  • Contractual Obligations: Processing information necessary to arrange appointments, provide counselling services, communicate with clients and manage payments.

  • Consent: Processing certain information where your explicit consent has been given, for example when recording sessions or communicating with another healthcare professional.

  • Legal Obligations: Processing information where required by law or professional obligations, including safeguarding, prevention of serious harm, court orders or regulatory requirements.

Where special category data is processed, this is done in accordance with Article 9 UK GDPR.

2. Personal Data Collected

To provide a safe and effective counselling service, I may collect the following information:

  • Personal Data: Full name, address, date of birth, telephone number, email address, emergency contact details, GP details, occupation, payment information and invoices.

  • Special Category Data: Relevant physical and mental health information, session notes, family or relationship information where relevant, preferred pronouns, gender identity, ethnicity, sexual orientation (where relevant to therapy) and voice recordings where explicit consent has been provided.

Only information that is necessary for the provision of counselling services will be collected.

3. How Data is Collected

Personal data is typically collected in the following ways:

  • Initial Enquiries: Through my website, email, telephone, WhatsApp, Counselling Directory, BACP, Psychology Today or other referral sources.

  • Consultations and Therapy Sessions: During introductory consultations and throughout our therapeutic work together.

  • Professional Referrals: From GPs or other healthcare professionals where appropriate and with your consent where required.

4. Enquiries That Do Not Proceed

If you contact Graceful Therapy but choose not to begin therapy, or if we determine that I am not the most appropriate therapist for your needs, I will retain only the minimum information necessary to manage your enquiry.

This may include:

  • Enquiry Emails and Messages: Normally retained for up to 12 months before being securely deleted.

  • Administrative Information: Retained only where necessary for legal, insurance or legitimate business purposes.

5. How Your Data is Stored

Personal information is stored securely using appropriate technical and organisational measures.

This includes:

  • Encrypted Digital Storage: Clinical records and administrative information are stored securely using encrypted digital storage and password-protected devices.

  • Secure Communication Platforms: Online counselling sessions are conducted via Zoom. Communication regarding appointments may also take place via email, telephone or WhatsApp, where agreed.

  • Security Measures: Password protection, encrypted devices, secure backups and two-factor authentication where available.

6. Use of Artificial Intelligence (AI)

Artificial Intelligence (AI) may be used to support certain administrative tasks within my practice. This includes:

  • Administrative Support: Assisting with formatting clinical notes, drafting correspondence and improving administrative documentation.

  • Professional Oversight: AI is used solely as an administrative support tool and never replaces my professional judgement or clinical decision-making.

  • Data Minimisation: Wherever reasonably possible, personally identifying information will be removed or minimised before information is processed using AI. Any AI-assisted documentation is reviewed, amended where necessary, and approved by me before becoming part of the clinical record.

7. Data Sharing

Your personal information will not be shared with third parties without your explicit consent except where required by law or where there is a clear ethical or legal duty to do so.

This may include:

  • Healthcare Professionals: Where appropriate and with your consent, information may be shared with your GP or another healthcare professional.

  • Legal Requirements: Where disclosure is required by law, safeguarding obligations, court order or where there is a risk of serious harm.

  • Clinical Will: In the event of my incapacity or death, my appointed Clinical Will Executor may access limited client information solely to contact clients and ensure continuity of care.

8. Third Party Services

Certain third-party providers may process personal information on my behalf.

These include:

  • Website and Email Services: Squarespace and Google Workspace.

  • Online Counselling: Zoom.

  • Communication Platforms: WhatsApp and FaceTime (where specifically agreed).

  • Administrative AI Services: Secure AI providers used solely to assist with administrative tasks.

These providers process information in accordance with their own privacy policies and applicable data protection legislation.

9. Client Rights

Under UK GDPR, you have a number of rights regarding your personal information.

These include:

  • The Right to be Informed: You have the right to know what information I collect and how it is used.

  • The Right of Access: You may request a copy of the information I hold about you.

  • The Right to Rectification: You may request corrections to inaccurate or incomplete information.

  • The Right to Erasure: You may request deletion of your information where there is no lawful reason for it to be retained.

  • The Right to Restrict Processing: You may ask for the way your information is processed to be restricted.

  • The Right to Data Portability: Where applicable, you may request your information in a portable format.

  • The Right to Object: You may object to certain types of processing.

  • Rights Relating to Automated Decision Making: Graceful Therapy does not use automated decision-making or profiling.

If you wish to exercise any of these rights, please contact me at katie@gracefultherapy.co.uk. I aim to respond within one calendar month.

10. Data Retention

Personal information will only be retained for as long as necessary.

This includes:

  • Client Records: Retained for six years following the end of therapy in accordance with professional guidance.

  • Enquiry Records: Normally retained for up to 12 months where therapy does not proceed.

  • Secure Disposal: Once retention periods have expired, records will be securely deleted or anonymised where appropriate.

11. Security Measures

I take the security of your information seriously and have implemented appropriate measures to protect it.

These include:

  • Technical Safeguards: Password protection, encrypted devices, secure backups and two-factor authentication where available.

  • Confidentiality: Access to client information is restricted to me unless disclosure is legally or ethically required.

  • Data Breaches: In the unlikely event of a reportable data breach, I will comply with my legal obligations, including notifying the Information Commissioner's Office (ICO) where required.

12. International Transfers

I aim to use providers that store information within the UK or countries recognised as providing adequate levels of data protection.

Where international transfers occur, appropriate safeguards will be in place to ensure your personal information remains protected.

13. Complaints

If you have concerns about how your personal information is being processed, please contact me in the first instance.

If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

14. Policy Review

This Privacy Policy is reviewed regularly and updated where necessary to reflect changes in legislation, professional guidance or the way Graceful Therapy operates.

The latest version will always be available on the Graceful Therapy website.