1. Who is responsible for your information?

Carolyn Stevenson, trading as Carolyn Stevenson Psychotherapy, is the data controller responsible for the personal information described in this notice.

You can contact Carolyn about privacy or data protection matters using:

Email: CLICK HERE
Telephone: 07889 276 992

2. Information that may be collected

When you contact Carolyn through the website contact form, by email or by telephone, you may provide information including:

• Your name

• Your email address

• Your telephone number

• Your preferred method of contact

• The contents of your message or enquiry

• Appointment and availability information

• Records of communications

• Information you choose to provide about your circumstances, wellbeing, physical or mental health

• Information required to manage appointments, payments and the therapeutic relationship

Please only include information in an initial website enquiry that is reasonably necessary for Carolyn to respond. Email, text messages and online forms cannot be guaranteed to be completely secure.

The website may also generate limited technical information needed for its operation and security, such as an IP address, browser type, device information, date and time of access, and website security logs. This information is not used to create advertising profiles or track you across other websites.

3. Sensitive personal information

Information about physical health, mental health, relationships, sexuality, beliefs or other personal circumstances may be classed as special-category personal data.

This information will only be used where it is necessary to:

• Respond appropriately to your enquiry

• Assess whether Carolyn’s services are suitable for you

• Provide psychotherapy or counselling services

• Protect your vital interests or those of another person

• Meet professional, safeguarding or legal responsibilities

• Establish, exercise or defend a legal claim

Where health or therapy information is processed as part of providing psychotherapy, the relevant additional legal condition will normally be that processing is necessary for the provision of health or social care or treatment by a professional subject to confidentiality obligations.

4. How your information is collected

Information may be collected directly from you when you:

• Submit the website contact form

• Send an email

• Telephone, leave a voicemail or send a text message

• Arrange or attend a consultation or therapy appointment

• Complete any client agreement, assessment or administrative documentation

• Communicate with Carolyn during the course of therapy

In limited circumstances, information may also be received from another person or organisation, such as a healthcare professional or family member. This would normally happen with your knowledge or permission, unless there is a legal, safeguarding or vital-interest reason why this is not possible.

5. How your information is used

Your personal information may be used to:

• Respond to enquiries

• Contact you using your preferred contact method

• Arrange consultations and appointments

• Decide whether Carolyn’s services are appropriate for your needs

• Provide psychotherapy and counselling services

• Maintain appropriate clinical and administrative records

• Process and record payments

• Manage cancellations and appointment changes

• Maintain the safety, security and operation of the website

• Comply with legal, insurance, professional and safeguarding responsibilities

• Respond to complaints, disputes or legal claims

Your enquiry details will not be added to a marketing list or used to send promotional communications without your specific permission.

6. Lawful bases for using your information

Depending on the circumstances, personal information may be processed because:

Steps before entering into a contract

Processing may be necessary to respond to your enquiry, discuss therapy and arrange an initial consultation at your request.

Performance of a contract

Processing may be necessary to provide agreed psychotherapy or counselling services and manage the therapeutic relationship.

Legitimate interests

There may be a legitimate interest in operating a safe and effective therapy practice, responding to communications, managing appointments, protecting the website, maintaining appropriate records and dealing with complaints or legal claims.

These interests will be balanced against your privacy rights and reasonable expectations.

Legal obligation

Some information may need to be processed or retained to comply with legal, tax, accounting, regulatory or safeguarding obligations.

Vital interests

Information may be processed or shared where this is necessary to protect someone’s life or physical safety.

Consent

Consent may be used for particular optional activities. Where processing is based on consent, you may withdraw that consent at any time. Withdrawing consent will not affect processing that took place before it was withdrawn.

7. Confidentiality and sharing information

Your information will be treated confidentially and will not be sold, rented or provided to other organisations for advertising.

Information may be shared only where reasonably necessary with:

• Website hosting, email, telephone, IT or security providers

• Appointment, video consultation, payment or administrative service providers used by the practice

• Professional advisers, insurers or legal representatives

• A professional clinical supervisor, with identifying information minimised wherever reasonably possible

• Healthcare professionals, emergency services, safeguarding authorities or other relevant bodies where necessary to protect you or another person

• Courts, regulators, law-enforcement bodies or public authorities where disclosure is legally required

Service providers are only permitted to use information for the services they provide and are expected to protect it appropriately.

Confidentiality may need to be limited where:

• There is a serious and immediate risk of harm to you or another person

• There is a safeguarding concern involving a child or vulnerable adult

• Disclosure is required by law or a court order

• Information relates to certain serious criminal or terrorism-related matters

• Disclosure is necessary to establish, exercise or defend a legal claim

Where appropriate and safe, Carolyn will try to discuss a proposed disclosure with you before information is shared.

Further information about therapeutic confidentiality will be provided through the client agreement or discussed at the beginning of therapy.

8. International data transfers

Some technology or communication providers may process information outside the United Kingdom.

Where this happens, reasonable steps will be taken to ensure that an appropriate legal safeguard is in place, such as UK adequacy regulations, approved contractual protections or another legally recognised transfer mechanism.

9. How long information is retained

Information will only be kept for as long as it is reasonably needed for the purpose for which it was collected and to meet professional, insurance and legal responsibilities.

The usual retention periods are:

• Enquiries that do not lead to therapy: normally up to 12 months after the last meaningful communication

• Client and therapy records: normally up to seven years after the therapeutic relationship ends, unless a longer period is required for legal, safeguarding, insurance or professional reasons

• Financial and transaction records: for the period required by tax and accounting law

• Website and security records: for only as long as reasonably necessary to maintain website security and investigate technical problems

Information may be retained for longer where there is an ongoing complaint, safeguarding concern, legal claim or other lawful reason.

When information is no longer required, it will be securely deleted, destroyed or anonymised.

10. How your information is protected

Reasonable technical and organisational measures are used to protect personal information from loss, misuse, unauthorised access, alteration or disclosure.

These measures may include password protection, access controls, secure devices, software updates, protected accounts, secure storage and appropriate confidentiality procedures.

No internet, telephone or email communication system can be guaranteed to be completely secure. You are therefore encouraged not to include highly sensitive or extensive clinical information in an initial website enquiry.

This website and its contact channels are not intended for emergency or crisis support. If you or another person is in immediate danger, call 999 or attend the nearest Accident and Emergency department.

11. Your data protection rights

Depending on the circumstances, you may have the right to:

• Ask for confirmation that your information is being processed

• Request a copy of the personal information held about you

• Ask for inaccurate or incomplete information to be corrected

• Ask for information to be deleted

• Ask for the use of your information to be restricted

• Object to certain uses of your information

• Receive certain information in a portable format

• Withdraw consent where consent is the lawful basis

• Complain about the way your information has been handled

These rights are not absolute. Information may sometimes need to be retained or withheld where there is a legal, professional, safeguarding or confidentiality reason.

To exercise a right, contact:

Email: carolyn@carolynstevensonpsychotherapy.co.uk
Telephone: 07889 276 992

Carolyn may need to confirm your identity before responding. Requests will normally be answered within one month.

12. Complaints

Please contact Carolyn first if you have a concern about how your personal information has been handled. Every effort will be made to investigate and resolve the matter fairly.

You also have the right to complain to the UK data protection regulator:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: ico.org.uk

13. Cookies

Cookies are small files that websites may place on a computer, tablet or mobile device. They can be used to operate website functions, maintain security, remember preferences or collect information about how a website is used.

Cookies currently used by this website

This website does not currently use advertising cookies, analytics cookies, behavioural tracking cookies, marketing pixels or technology designed to track visitors across different websites.

The website may use limited, strictly necessary cookies or similar technologies where required for:

• Website security

• Preventing spam or fraudulent form submissions

• Operating the contact form

• Maintaining website sessions

• Distributing website traffic

• Remembering privacy or cookie preferences

Strictly necessary cookies cannot normally be switched off through the website because they are required to provide a service or function requested by the visitor.

No information collected through strictly necessary cookies is used for targeted advertising.

Managing cookies

You can configure your web browser to block or delete cookies. Blocking strictly necessary cookies may prevent parts of the website, including the contact form, from operating correctly.

Browser controls vary, so consult the privacy or help settings within your browser for further information.

Future changes to cookie use

If analytics, advertising, embedded media or other non-essential technologies are introduced in the future, this notice will be updated and an appropriate consent mechanism will be provided before those technologies are activated.

14. External websites

This website may contain links to websites operated by other organisations. Carolyn Stevenson Psychotherapy is not responsible for the privacy practices, security or content of external websites.

You should review the privacy information provided by any external website before submitting personal information to it.

15. Automated decision-making

Your personal information is not used to make decisions about you solely through automated processing, and it is not used for automated profiling or targeted advertising.

16. Changes to this notice

This notice may be updated when the website, services, technology providers or legal requirements change.

The latest version will be published on this page with the date of the most recent update shown at the top.