Privacy Policy

Last updated: [Confirm publication date]

Draft for review: complete all bracketed fields and check that each statement reflects the practice and website before publishing. This draft covers website visitors and initial enquiries. It does not replace a client privacy notice covering therapy records.

Who is responsible for your information

Sanctum Counselling and Psychotherapy is operated by [confirm full legal name and business status], referred to in this policy as “I”, “me” or “my”. I am the controller responsible for the personal information described here.

Website: [Confirm website address]
Contact address: [Confirm business correspondence address]
Email: anyaresolve@hotmail.com
ICO registration: [Confirm registration number if applicable, or remove this line]

This policy explains how I collect, use, store and share personal information when you visit my website or contact me about therapy, groups or professional training.

Information I collect

When you contact me, I may receive your name, email address, telephone number if provided, and the contents of your message. This includes information you choose to share about the support you are looking for.

When you visit the website, technical information may be processed to deliver and protect the site, such as your IP address, browser, device information, pages requested and the date and time of access.

[Confirm which technical data is actually collected by the website and its providers, the contact form fields if any, and whether referral information or information from other sources is received. Remove categories that do not apply.]

Please keep initial enquiries brief and avoid sending detailed health information, therapy histories or sensitive information about other people. We can discuss an appropriate way to share further information if needed.

How I use your information

I use information for the purposes relevant to your interaction with the practice, which may include:

• Responding to questions and requests for information.
• Discussing whether the services offered are suitable for your needs.
• Arranging an initial conversation or appointment at your request.
• Responding to enquiries about groups or professional training.
• Operating, maintaining and securing the website.
• Handling complaints, complying with legal obligations and establishing or defending legal claims where necessary.

[Confirm the actual purposes. Add any newsletter, booking, payment, analytics or advertising activity only if used, with the corresponding details below.]

You do not have to provide information simply to read the website. If you ask me to respond or arrange an appointment, I need enough information to deal with that request. Without it, I may be unable to do so.

Lawful bases for using your information

UK data protection law requires a lawful basis for each use of personal information. The bases applicable to this website and enquiry process are:

• Service enquiries and requested booking steps: [Confirm whether processing is necessary to take steps at your request before entering into a contract, or identify the appropriate alternative basis for each purpose.]
• General correspondence and website security: [Confirm the applicable basis. If relying on legitimate interests, specify the actual interests and confirm that an assessment supports this use.]
• Legal obligations: [Identify the relevant obligations and associated processing, or remove if not applicable.]
• Optional marketing or other consent-based activity: [Confirm whether used, the specific purposes, how consent is obtained and how it can be withdrawn; otherwise remove.]

If I rely on consent, you can withdraw it by contacting me. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Sensitive information and therapy records

Information about physical or mental health, and some other personal matters, is special category data. Processing it requires an appropriate lawful basis and an additional condition under data protection law.

Condition for sensitive information received during enquiries: [Confirm the applicable Article 9 condition and any associated Data Protection Act 2018 requirements. Do not assume that sending an email amounts to explicit consent.]

[Confirm how sensitive information received unexpectedly is assessed, minimised, stored or deleted. Confirm separately whether criminal offence information may be received and, if so, the applicable legal authority and safeguards.]

If we agree to work together, I will explain the arrangements for therapy records, confidentiality, supervision, safeguarding and retention in a separate client privacy notice before collecting information for that purpose.

Client privacy notice: [Insert link or explain how this is provided. If a separate notice is not used, extend this policy to accurately cover all client processing before publication.]

Providers and other recipients

Information may be processed by service providers where needed to operate the website and manage enquiries, and by other recipients where there is a lawful reason to share it.

Website hosting and technical support: [Confirm provider names or meaningful recipient categories and the information they access.]
Email provider: [Confirm the provider and account arrangements for the published Hotmail address.]
Forms, booking, security and other tools: [Confirm the tools actually used and relevant recipients, or state that none are used.]
Other disclosures: [Confirm any applicable legal, safeguarding, professional advice or complaints-related disclosures and their circumstances.]

Any sharing should be limited to information relevant to its purpose. The confidentiality arrangements for ongoing therapeutic work are explained separately in the client documentation.

Where your information is processed

[Confirm the countries in which the hosting, email and other providers store or access personal information.]

Where information is transferred outside the UK and a restricted transfer is involved, [identify the applicable adequacy regulations or other safeguards, such as the UK International Data Transfer Agreement or UK Addendum, and explain how a person can obtain information about those safeguards].

Do not assume information remains in the UK solely because the practice is based here.

How long I keep information

Information is kept for no longer than necessary for its purpose, taking account of applicable legal and professional requirements.

• Enquiries that do not lead to services: [Confirm retention period and when it starts.]
• Enquiries that lead to services: [Confirm when information becomes part of the client record and refer to the client retention policy.]
• Technical and security logs: [Confirm retention periods.]
• Complaints and related correspondence: [Confirm retention period or clear criteria.]
• Backups: [Confirm deletion or expiry arrangements.]

At the end of the relevant period, information is securely deleted or anonymised, unless a justified legal requirement requires it to be kept longer.

Cookies and similar technologies

[Complete this section after checking the live website, including analytics, embedded media, maps, fonts, security tools and any third-party tracking.]

Technologies used: [List each cookie or similar technology, its provider, purpose and duration, or link to an accurate cookie notice.]

Where consent is legally required, those technologies will not be used until you have given consent. Where a lawful exception applies, the relevant purpose and any available objection mechanism will be explained.

Managing your choices: [Insert the actual cookie settings link and explain how visitors can change or withdraw consent or exercise any applicable right to object. Remove references to controls that do not exist.]

Keeping information secure

I use appropriate technical and organisational measures to protect personal information against unauthorised access, loss or misuse. [Confirm the measures in place; do not claim encryption, restricted access or other controls unless verified.]

No internet service or email system can be guaranteed completely secure. Please contact me to discuss an appropriate method before sending particularly sensitive material.

Your rights

Depending on the circumstances and the lawful basis used, you may have the right to request access to your information, correction of inaccuracies, erasure, restriction of processing or transfer of certain information. You may also have the right to object to processing and to withdraw consent where consent is the basis relied on.

These rights are not absolute. If a request cannot be fulfilled, I will explain the reason and any available next steps. Requests will be handled within the applicable legal time limits, and proportionate identity checks may be needed.

To make a request, email anyaresolve@hotmail.com.

Automated decisions: [Confirm whether any solely automated decisions with legal or similarly significant effects are made. If not, state this; if they are, explain the logic, significance, consequences and safeguards.]

Questions and complaints

Please contact me if you have a question or concern about how your information is handled.

You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator. You do not have to contact me first to exercise that right.

Changes to this policy

I may update this policy to reflect changes to the website, services or data protection requirements. The current version will be published here with its update date. Where required, I will provide further notice of significant changes affecting your information.