Privacy policy
1. Introduction
Craig Isherwood and Isherwood Therapy (“we”, “us”, “our”) is committed to protecting your privacy and handling your personal information in a lawful, fair, and transparent way. This Privacy Policy explains how we collect, use, store, and protect your personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Data Controller
The Data Controller responsible for your personal data is:
Craig Isherwood
Isherwood Therapy
Email: craig@isherwoodtherapy.co.uk
3. Information We Collect
We may collect and process the following personal data:
Identity information (e.g. name, date of birth).
Contact information (e.g. phone number, email, postal address).
Health information (e.g. relevant medical history, mental health information, GP details).
Session notes (brief anonymised records of therapy sessions).
Payment details (only as required for invoicing; we do not store card details).
Technical data (e.g. IP address, browser type, when using our website).
4. How We Use Your Data
We use your personal data for the following purposes:
To provide psychotherapy services.
To communicate with you regarding appointments, cancellations, and administrative matters.
To maintain accurate clinical records as required by professional and legal standards.
To comply with legal obligations (e.g. safeguarding, HMRC requirements).
To manage our website and improve user experience.
5. Legal Basis for Processing
We rely on the following lawful bases under UK GDPR:
Consent: Where you have given explicit consent (e.g. for contacting your GP).
Contract: To provide psychotherapy services agreed with you.
Legal obligation: To comply with safeguarding, tax, or regulatory requirements.
Legitimate interests: For administrative purposes and website functionality, provided your rights are not overridden.
6. Confidentiality and Disclosure
Your information is kept confidential. However, we may share information in the following circumstances:
Where you provide explicit consent.
If required by law or court order.
If there is a risk of serious harm to yourself or others.
For safeguarding concerns involving children or vulnerable adults.
With relevant healthcare professionals (e.g. GP) only with your consent, unless urgent circumstances apply.
7. Data Retention
Therapy records are kept securely for a minimum of 7 years after the end of treatment, in line with professional and insurance requirements. After this period, records will be securely deleted or destroyed.
8. Data Security
Records are stored securely in encrypted digital files. Electronic communications are protected as far as reasonably possible, though absolute security of data transmitted over the internet cannot be guaranteed.
9. Your Rights
Under UK GDPR, you have the following rights:
The right to access the personal data we hold about you.
The right to request correction of inaccurate or incomplete data.
The right to request deletion of your data (subject to legal/insurance requirements).
The right to restrict or object to processing.
The right to data portability.
The right to withdraw consent at any time (where applicable).
To exercise your rights, please contact us using the details in Section 2.
10. Cookies and Website Use
Our website may use cookies or similar technologies for functionality and analytics.
You can adjust your browser settings to refuse cookies, but some website features may not work properly.
11. Complaints
If you have concerns about how your data is handled, please contact us first.
You also have the right to complain to the UK regulator:
Information Commissioner’s Office (ICO)
Website: https://ico.org.uk
Phone: 0303 123 1113
12. Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with the updated effective date.
13. Contact
If you have any questions about this Privacy Policy, please contact:
Craig Isherwood
Isherwood Therapy
Email: craig@isherwoodtherapy.co.uk