Privacy Notice

Chloe Reid Therapy is a private therapy practice operated by Chloe Reid.

For data protection purposes, Chloe Reid is the data controller responsible for your personal information.

If you have any questions about how your personal information is handled, or wish to exercise your data protection rights, you can contact me at:

Email: hello@chloereidtherapy.co.uk
Business: Chloe Reid Therapy
ICO registration number: ZC224383

Depending on the services you receive and how you communicate with me, I may collect and process the following types of personal information.

Contact and identification information

This may include:

• Your full name and preferred name

• Pronouns, where provided

• Email address and telephone number

• Date of birth or age, where necessary

• Information needed to arrange appointments

• Emergency contact details, where provided and appropriate for the provision of therapy or safeguarding purposes

Therapy and assessment information

I may collect information that you choose to provide during assessment and therapy sessions, including:

• Your reasons for seeking therapy

• Information about your emotional wellbeing and mental health

• Relevant physical health information

• Relevant healthcare information, such as GP or healthcare provider details, where provided and necessary

• Personal, family and relationship history

• Information about your circumstances and experiences

• Information relating to risk and safeguarding, where relevant

• Information discussed during therapy sessions

• Assessment information

• Therapy records and professional notes

Some of this information, particularly information concerning your physical ormental health, is considered special category data under UK data protection law and is subject to additional protection.

Administrative and financial information

Where applicable, I may also collect:

• Records of appointments

• Payment information and payment records

• Invoices and receipts

• Correspondence between you and me

• Information relating to cancellations or missed appointments

I will only collect information that is relevant and necessary for the purposes described in this Privacy Notice.

I may collect information:

• Directly from you when you contact me

• Through my website, email or telephone

• Through a Google Form that you choose to complete

• During an initial therapy assessment

• During therapy sessions

• When you complete or sign therapy documents

• When you make or receive payments

• Through agreed methods of communication

• From a third party where this is necessary and lawful, for example where information is provided by another professional or organisation with your knowledge, or where there is a safeguarding or legal reason for doing so

Website enquiries and online forms

If you contact me through my website, email or telephone, I will process the information you provide in order to respond to your enquiry and, where appropriate, discuss my therapy services with you.

I use Google Forms to collect basic information when you contact me through my website. This may include your name, email address, telephone number, preferred method of contact and the reason for your enquiry.

I use this information to respond to your enquiry, arrange a 15-minute introductory call where requested, answer questions about my services, or otherwise respond to your request.

Please do not include detailed or sensitive information about your mental health, personal circumstances or experiences in the enquiry form. The form is intended for basic contact and enquiry information only.

Information submitted through the form is processed using Google's services and is subject to Google's applicable privacy and security arrangements.

Where I receive information about you from another source, I will provide you with appropriate privacy information where required by law.

I may use email, telephone, Microsoft Teams and SMS (text messaging) to communicate with you about appointments, scheduling and other practical matters relating to your therapy, whether your sessions are provided face-to-face or remotely.

My email and other Microsoft 365 services, including Microsoft Outlook/Exchange, OneDrive and Microsoft Teams, may be used to communicate with you, store relevant information and, where agreed, provide online therapy.

I will keep communication to a minimum and, where possible, avoid discussing sensitive therapeutic information through email, Teams chat or SMS.

Where an email, Teams message or SMS contains information that forms part of your therapy record, relevant information may be transferred to your therapy record and retained in accordance with my retention arrangements. Non-essential messages will be deleted when they are no longer required.

Electronic communications may carry some risk of unauthorised access or interception. I will take reasonable steps to protect your information when using these communication methods.

I may use your personal information to:

• Respond to enquiries and requests for information

• Arrange and manage therapy appointments

• Complete an initial assessment

• Provide therapy services

• Maintain appropriate therapy records

• Communicate with you about your therapy

• Manage payments, invoices and accounts

• Manage cancellations and appointments

• Maintain appropriate professional and ethical standards

• Seek professional supervision

• Meet legal, regulatory and professional obligations

• Manage safeguarding concerns and risks where necessary

• Respond to complaints

• Establish, exercise or defend legal claims where necessary

• Protect the vital interests of you or another person where this is necessary and permitted by law

• Maintain the security of my systems and records

I will not use your personal information for purposes that are incompatible with those explained in this Privacy Notice unless I have a lawful reason to do so and, where required, provide you with further information.

I must have a lawful basis under the UK GDPR for processing your personal information. The lawful basis I rely on depends on the purpose for which the information is being processed.

Contract

I may process personal information where this is necessary to provide the therapy services you have requested and to manage our therapeutic agreement.

Legitimate interests

I may process personal information where this is necessary for the legitimate interests of running and managing my private practice, including maintaining appropriate records, communicating with clients and managing administrative matters, provided that these interests are not overridden by your rights and freedoms.

Legal obligation

I may process personal information where this is necessary for me to comply with a legal obligation.

Vital interests

In limited circumstances, I may process personal information where this is necessary to protect your vital interests or those of another person.

Other lawful bases may apply in particular circumstances where permitted by applicable data protection law.

Where I process special category data, I will also rely on an applicable condition under Article 9 UK GDPR, as explained below.

Information concerning your physical or mental health is considered special category data under the UK GDPR and is subject to additional protection.

As part of providing therapy, I may need to process information about your physical or mental health and other sensitive information that you choose to share with me.

For ordinary personal information, I may rely on Article 6(1)(b) UK GDPR (contract)where processing is necessary to provide the therapy services you have requested and manage our therapeutic agreement.

For special category data relating to your health, I rely on Article 9(2)(h) UK GDPR, where processing is necessary for the provision of health or social care or treatment, together with the relevant condition in Schedule 1 of the Data Protection Act 2018 and applicable safeguards.

Where Article 9(2)(h) applies, I will only process special category data where it is necessary and proportionate for the relevant purpose and will take appropriate steps to protect your confidentiality and privacy.

In limited circumstances, another Article 6 lawful basis or Article 9 condition may apply, for example where processing is necessary to comply with a legal obligation, protect vital interests, or establish, exercise or defend legal claims.

I will only process special category data where there is a lawful basis and an applicable Article 9 condition, and only to the extent necessary for the relevant purpose.

Therapy is a confidential service, and I will respect your privacy.

Information you share during therapy will normally remain confidential. I will not disclose information about you to other people without your knowledge and, where appropriate, your consent.

However, confidentiality has limits. There may be circumstances where I need to share information without your consent. This may include:

• Where I believe there is a serious risk of harm to you or another person

• Where safeguarding concerns arise

• Where I am required or authorised to disclose information by law

• Where disclosure is necessary to meet a legal or professional obligation

• Where disclosure is otherwise legally permitted or required

Where it is appropriate and safe to do so, I will discuss any proposed disclosure with you beforehand and explain what information I need to share and why. There may be circumstances where I am unable to inform you in advance.

As part of responsible professional practice, I receive professional supervision.

I may discuss aspects of my therapeutic work with my supervisor for the purposes of professional reflection, ethical practice, safeguarding and maintaining appropriate standards of care.

Where possible, information will be anonymised or minimised so that you are not identifiable.

My supervisor is also expected to maintain appropriate confidentiality and comply with relevant professional and data protection requirements.

I will only share your personal information where there is a lawful reason to do so.

Depending on the circumstances, this may include:

• My professional supervisor

• Relevant healthcare or other professionals where necessary and lawful

• Emergency or safeguarding services where necessary

• Professional or regulatory bodies where required

• HM Revenue & Customs and other authorities where legally required

• Accountancy or financial service providers where necessary

• IT, email, video-conferencing, cloud storage and other service providers who process information on my behalf

• Microsoft, where Microsoft 365 services such as Outlook, OneDrive or Teams are used to process your information

• Google, where Google Forms is used to collect or process your information

• Payment providers where necessary to process payments

• Legal or professional advisers where necessary

I will only share information that is necessary for the relevant purpose.

I will not sell your personal information to third parties.

I use Microsoft 365 as part of the operation of my private practice. This includes Microsoft Outlook/Exchange for email, OneDrive for electronic storage and Microsoft Teams where online therapy or other online communication is provided. Client records may be stored securely in my business OneDrive. Microsoft Teams may be used for online therapy where this has been agreed with you.

Personal information stored or processed through these services is subject to Microsoft's applicable privacy, security and data-processing arrangements.

I will take reasonable steps to ensure that appropriate security measures are in place when using Microsoft 365 services, including appropriate account security and access controls.

Where online therapy is provided through Microsoft Teams, I will take reasonable steps to protect the confidentiality and security of the session.

You should also take reasonable steps to protect your own privacy when attending online therapy, such as using a private space and an appropriate device and internet connection.

I may use Google Forms to collect basic information from you when you make an enquiry through my website.

Information submitted through Google Forms may be processed and stored by Google in accordance with Google's applicable privacy, security and data-processing arrangements.

Where personal information is processed by Microsoft, Google or another service provider, some processing may take place outside the UK.

Where personal information is transferred outside the UK, I will ensure that the transfer is made in accordance with applicable UK data protection law and that appropriate safeguards are in place where required.

Information about how individual service providers process personal information, including information about international transfers and security measures, can be found in their own privacy and data-processing information.

Where therapy is provided face-to-face, I may collect and process information necessary to arrange and provide your sessions, including appointment information and relevant contact details.

I will take reasonable steps to protect your privacy and confidentiality during face-to-face sessions and to keep your personal information and therapy records secure.

Paper records, where used, will be stored securely and electronic records will be stored using the security measures described in this Privacy Notice.

I do not routinely audio or video record therapy sessions.

Therapy sessions will not be recorded without your explicit agreement and appropriate consideration of the legal, ethical and data protection implications.

I take the security of your personal information seriously.

I use appropriate technical and organisational measures to protect personal information against:

• Unauthorised access

• Accidental loss

• Unauthorised alteration

• Unauthorised disclosure

• Destruction

These measures may include password protection, access controls, secure electronic storage, device security and appropriate software and security updates.

Paper records, where used, will be stored securely and access will be restricted.

No method of electronic transmission or storage can be guaranteed to be completely secure. However, I will take reasonable and appropriate steps to protect your information.

I will only retain personal information for as long as it is necessary for the purpose for which it was collected, taking into account my professional, legal and regulatory responsibilities.

Different types of information may be retained for different periods.

Therapy records

I will retain your therapy records, including initial assessment information, therapy notes and relevant correspondence, for 7 years from the end of the therapeutic relationship.

At the end of this period, records will be securely destroyed or permanently deleted, unless there is a specific legal, professional or other legitimate reason for retaining them for longer.

Email, telephone, Microsoft Teams and SMS communication

I may retain emails, SMS messages and Teams messages where they contain information that is relevant to your therapy record or are necessary for administrative, legal or professional purposes.

Where information from a message is relevant to your therapy record, I may transfer the relevant information to your therapy record.

Non-essential messages will be deleted when they are no longer required.

Financial and accounting records

Financial records, including invoices, payment records and information required for tax and accounting purposes, will be retained for the period required by applicable legal and HM Revenue & Customs requirements.

These records may therefore be retained for a different period from your therapy records.

Enquiries that do not result in therapy

If you contact me to enquire about therapy but do not become a client, I will not retain your personal information indefinitely.

Information relating to an enquiry will be deleted when it is no longer reasonably required, unless there is a legal, professional or other legitimate reason to retain it for longer.

Secure disposal

When personal information is no longer required, I will take reasonable steps to ensure that it is securely deleted or destroyed.

Electronic information will be securely deleted where appropriate, and paper records will be securely destroyed, for example by confidential shredding.

Under UK data protection law, you may have rights in relation to your personal information.

Depending on the circumstances, these include the right to:

• Request access to the personal information I hold about you

• Request correction of inaccurate or incomplete information

• Request erasure of your personal information in certain circumstances

• Request restriction of processing in certain circumstances

• Object to certain processing

• Request transfer of certain personal information to another organisation where the right to data portability applies

• Withdraw consent where I am relying on consent as my lawful basis

These rights are not absolute and may not apply in every circumstance.

For example, there may be circumstances where I have a legal or professional reason to retain certain information even if you request that it is deleted.

If you wish to exercise any of your rights, please contact me using the details provided below.

I will normally respond to a valid request within one month, although this may be extended where permitted by law for complex or multiple requests.

I do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

If you have concerns about the way I have handled your personal information, I would encourage you to contact me first so that I can try to resolve your concern.

You also have the right to complain to the Information Commissioner's Office (ICO), which is the UK's independent supervisory authority for data protection.

Further information about making a complaint is available on the ICO's website.

I may update this Privacy Notice from time to time to reflect changes in my practice, the services I provide, the technology I use, or applicable legal and regulatory requirements.

The latest version will be made available on my website.

Last updated: September 2026

If you have any questions about this Privacy Notice or how your personal information is handled, please contact:

Chloe Reid
Chloe Reid Therapy
Email: hello@chloereidtherapy.co.uk
ICO registration number: ZC224383