Effective Date: 1 July 2026
The Online Therapy Space is committed to protecting your privacy and handling your personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and professional obligations under the British Association for Counselling and Psychotherapy (BACP) Ethical Framework.
This Privacy Notice explains how your personal information is collected, used, stored, shared, and protected.
1. Data Controller
The Online Therapy Space is the Data Controller responsible for your personal data.
For any questions about this Privacy Notice or your personal data, please contact:
The Online Therapy Space
Email: info@theonlinetherapyspace.com
Address: Suite 6, Talbot House 34 Staple Gardens, Winchester SO23 8SR
Telephone: +44 7733 052 542
2. Personal Information We Collect
We may collect and process the following categories of personal information:
Identity and Contact Information
- Name
- Date of birth
- Address
- Telephone number
- Email address
- Emergency contact details
- GP details
Therapy and Assessment Information
- Information provided during initial enquiries
- Assessment forms
- Therapy goals
- Clinical notes
- Risk assessments
- Safeguarding information
- Information relevant to your wellbeing and therapeutic support
Administrative Information
- Appointment records
- Attendance records
- Correspondence
- Invoices and payment records
Technical Information
When using online services, limited technical information may be collected by service providers such as Zoom, including IP addresses and connection information, subject to their own privacy policies.
3. Special Category Data
Information relating to your physical or mental health is classified as Special Category Data under UK GDPR.
Additional safeguards apply to the processing of this information.
4. How We Collect Information
Information may be collected directly from you through:
- Initial enquiries
- Assessment forms
- Therapy sessions
- Email correspondence
- Telephone conversations
- Online booking or contact forms
- Payment transactions
In limited circumstances, information may also be obtained from:
- Your GP
- Healthcare professionals
- Emergency contacts
- Safeguarding agencies
This will normally only occur with your knowledge or where legally or ethically required.
5. Purpose of Processing
Your personal data may be used for:
- Providing counselling and psychotherapy services
- Assessing suitability for therapy
- Managing appointments
- Maintaining clinical records
- Risk assessment and safeguarding
- Communicating with you regarding therapy
- Processing payments
- Professional supervision
- Meeting legal, ethical, regulatory, and insurance requirements
- Establishing, exercising, or defending legal claims
6. Lawful Basis for Processing
Under Article 6 UK GDPR, personal data is processed on the following lawful bases:
Contract
Article 6(1)(b)
Processing is necessary to provide counselling and psychotherapy services requested by you.
Legal Obligation
Article 6(1)(c)
Processing may be required to comply with legal obligations, including safeguarding and court orders.
Legitimate Interests
Article 6(1)(f)
Certain administrative and practice management activities may be processed where necessary for the legitimate operation of the practice.
7. Lawful Basis for Health Information
Health information is Special Category Data under UK GDPR.
Processing is carried out under:
Article 9(2)(h)
Provision of health or social care and treatment.
Article 9(2)(f)
The establishment, exercise, or defence of legal claims where necessary.
Article 9(2)(g)
Substantial public interest where safeguarding obligations apply.
8. Confidentiality and Information Sharing
Information disclosed during therapy is treated as confidential.
Information will not normally be shared without your consent unless:
- There is a serious risk of harm to you or another person
- There are safeguarding concerns involving a child or vulnerable adult
- Disclosure is required by law
- A court orders disclosure
- There are concerns relating to terrorism, money laundering, or serious crime
- Disclosure is necessary to protect life or prevent serious harm
Any disclosure will be limited to what is necessary and proportionate.
9. Professional Supervision
As required by the BACP Ethical Framework, therapists participate in regular professional supervision.
Limited information about your therapy may be discussed with a clinical supervisor to support safe and ethical practice.
Where possible, identifying information will be removed or minimised.
Supervisors are bound by professional confidentiality obligations.
10. Service Providers and Data Processors
To provide services safely and efficiently, we use trusted third-party providers.
These may include:
WriteUpp
Used for secure clinical record keeping and practice management.
Zoom
Used for online therapy sessions.
Square
Used for secure payment processing.
Email and Cloud Service Providers
Used for communication, scheduling, and secure business administration.
These organisations act as data processors or independent controllers where applicable and process information in accordance with their own privacy and security obligations.
11. International Data Transfers
Some service providers may store or process data outside the United Kingdom.
Where international transfers occur, appropriate safeguards are implemented in accordance with UK GDPR requirements, including:
- Adequacy regulations
- International Data Transfer Agreements
- Standard Contractual Clauses
- Other lawful transfer mechanisms
12. Data Security
Appropriate technical and organisational measures are used to protect personal information, including:
- Password-protected systems
- Encrypted storage where available
- Secure cloud-based record systems
- Restricted access to records
- Regular software and security updates
While reasonable steps are taken to protect data, no internet-based transmission can be guaranteed to be completely secure.
13. Retention of Records
Adult client records are generally retained for seven years following the end of therapy.
Records may be retained longer where required for:
- Insurance purposes
- Legal proceedings
- Safeguarding matters
- Regulatory requirements
- Professional obligations
When retention periods expire, records are securely deleted or destroyed.
14. Your Rights Under UK GDPR
You have the right to:
- Access your personal data
- Request correction of inaccurate information
- Request restriction of processing in certain circumstances
- Object to certain processing activities
- Request erasure where legally applicable
- Request transfer of your data where applicable
- Withdraw consent where consent is relied upon
Some rights may be limited where records must be retained to comply with legal, professional, safeguarding, or insurance obligations.
15. Subject Access Requests
You may request access to the personal information held about you.
Requests should be made in writing.
Identity verification may be required before information is released.
Requests are normally responded to within one calendar month.
16. Complaints
If you have concerns regarding how your personal data is handled, please contact The Online Therapy Space in the first instance.
You also have the right to complain to the Information Commissioner’s Office (ICO).
Information about making a complaint is available from the ICO.
17. Website Cookies and Analytics
If our website uses cookies, analytics tools, or similar technologies, details will be provided through a separate Cookie Policy or cookie banner where required.
18. Changes to This Privacy Notice
This Privacy Notice may be updated from time to time to reflect legal, regulatory, or operational changes.
The most current version will always be available on request and, where applicable, on our website.
19. Contact
For any questions regarding this Privacy Notice or your personal information, please contact:
Data Protection Lead, The Online Therapy Space
Email: info@theonlinetherapyspace.com
Address: Suite 6, 34 Staple Gardens, Winchester, Hampshire, SO23 8SR
Telephone: +44 7733 052 542