Privacy Policy

Therapy With Whitney
Last updated: 26 October 2026

1. Introduction

Your privacy, confidentiality and trust are important to me.

This Privacy Policy explains how I collect, use, store and protect your personal information when you visit my website, make an enquiry, book an appointment or receive online psychotherapy or EMDR therapy.

I process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and my professional responsibilities as a UKCP-registered psychotherapist.

2. Who is responsible for your information?

The data controller is Whitney Shaw-Dale, trading as Therapy With Whitney.

I am an independent UKCP-registered psychotherapist and EMDR therapist.

UKCP registration number: 2011166425

Email: therapywithWhitney@hotmail.com

I am registered with the Information Commissioner's Office (ICO).

As the data controller, I am responsible for deciding how and why personal information is processed within my private practice.

3. What information do I collect?

Depending on your interaction with my practice, I may collect:

Your name, email address, telephone number and other contact information.
Information submitted through website enquiries, contact forms and appointment bookings.
Relevant personal circumstances, mental health history and other health information.
Assessment information, therapy goals, clinical notes and treatment records.
Appointment details, attendance information and correspondence.
Payment and invoice information.
Insurance or employee assistance programme information, where relevant.
Limited technical information associated with your use of this website.

Health and mental health information is classified as special category personal data under UK GDPR and is subject to additional legal protections.

Please avoid submitting detailed clinical or medical information through general website contact forms unless specifically requested through an appropriate secure process.

4. Why do I process your information?

Your information is used where necessary to:

Respond to enquiries and communicate with you.
Arrange and manage appointments.
Assess whether the services I offer are appropriate for your needs.
Provide psychotherapy, EMDR therapy and related clinical services.
Maintain accurate and confidential clinical records.
Process payments, issue invoices and manage relevant administration.
Communicate about appointments and your treatment.
Fulfil legal, safeguarding and professional responsibilities.
Maintain the security and effective operation of my website and practice.
I do not sell your personal information.

5. Legal basis for processing

Under Article 6 of UK GDPR, I rely on the appropriate lawful basis for each processing activity. These may include:

Contract and pre-contractual steps: To respond to requests for services, arrange appointments and provide agreed therapy.

Legal obligation: To comply with applicable legal and regulatory requirements.

Legitimate interests: To manage and protect my practice, maintain appropriate records and respond to professional correspondence, where those interests do not override your rights.

Consent: Where specifically required, including for optional website technologies or communications.

For special category health information, I generally rely on Article 9(2)(h) of UK GDPR, concerning the provision of health care or treatment, together with the applicable professional confidentiality requirements under UK law.

Other lawful conditions may apply where necessary, including in relation to safeguarding or legal claims.

Consent to participate in therapy is separate from the lawful basis used to process necessary clinical information.

6. Confidentiality

Information shared during therapy is treated confidentially and handled in accordance with my professional and ethical obligations.

Confidentiality has limited exceptions. Information may need to be disclosed where required by law, where there is an appropriate safeguarding obligation or where disclosure is necessary and lawful in response to a serious risk of harm.

Where appropriate and practicable, I will discuss any necessary disclosure with you beforehand.

I may discuss aspects of clinical work in confidential professional supervision, normally without directly identifying information.

Further information about confidentiality and its limits is provided in the therapeutic agreement.

7. How is information stored?

I use appropriate professional systems and organisational safeguards to manage confidential information.

Clinical records are managed using Konfidens, a practice-management system used to support confidential clinical record-keeping.

My practice may also use services such as Wix for website and booking functions, Zoom for online appointments, and relevant payment, communication or administrative providers.

Access to personal information is restricted as appropriate to its purpose.

I take reasonable steps to protect information against unauthorised access, misuse, loss or disclosure.

8. Sharing information with others

I do not routinely disclose confidential clinical information to third parties.

Information may be shared where necessary and lawful with:

Providers supporting secure appointments, payments, communications and clinical administration.
Professional supervisors under appropriate confidentiality arrangements.
Insurance companies or employee assistance providers, where relevant and authorised.
Other healthcare professionals, where appropriate.
Professional advisers, regulators or relevant authorities where required by law.
Safeguarding services where a lawful disclosure is necessary.

Only information relevant to the particular purpose will be shared.

I do not disclose clinical information to advertising platforms for targeted advertising.

9. International transfers

Some technology providers may process information outside the United Kingdom.

Where a restricted international transfer takes place, I will use an appropriate legal transfer mechanism or safeguard, unless an applicable exception permits the transfer.

10. How long is information kept?

Clinical records are generally retained for seven years after the end of therapy, unless a longer period is required or justified by applicable law, safeguarding responsibilities or other relevant circumstances.

Information relating to enquiries that do not result in therapy is retained only for as long as reasonably necessary for the relevant purpose.

Financial and accounting records are retained for the periods required by applicable tax and accounting legislation.

Information that is no longer required will be securely deleted or otherwise disposed of appropriately.

11. Your data protection rights

Depending on the circumstances and applicable legal exemptions, you may have the right to:

Request access to your personal information.
Ask for inaccurate information to be corrected.
Request deletion of information in certain circumstances.
Request restriction of processing.
Object to certain processing activities.
Request transfer of certain information.
Withdraw consent where processing is based on consent.

Certain rights may be limited where information must be retained for legal, professional or safeguarding reasons.

To make a request, please email therapywithWhitney@hotmail.com.

I will respond in accordance with applicable data protection law.

You also have the right to complain to the Information Commissioner's Office at www.ico.org.uk.

12. Website cookies

This website uses cookies and similar technologies as explained in the separate Cookie Policy.

Optional technologies requiring consent will only be used where the appropriate consent has been obtained.

13. Changes to this policy

This Privacy Policy may be updated to reflect changes in legislation, professional guidance or practice operations.

The latest version will be available on this website.