Rebecca D'arcy Psychotherapist
Privacy Notice and Data Protection Complaints Procedure
Last updated: July 2026
Privacy Notice
Introduction
Rebecca D'arcy Psychotherapist is committed to protecting your privacy and handling your personal information with care, transparency, and respect. I process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025 (DUAA).
This Privacy Notice explains how I collect, use, store, and protect your personal information when you contact me or engage in psychotherapy services.
Data Controller
Rebecca D'arcy Psychotherapist
Website: www.rebeccadarcy.co.uk
Telephone: 07767 355744
Rebecca D'arcy is the Data Controller responsible for the personal information you provide.
What Information I Collect
Before Therapy
When you make an enquiry, I may collect:
-
Your name
-
Telephone number
-
Email address
-
Information you choose to share about your reasons for seeking therapy
During Therapy
If we begin working together, I may also collect:
-
Contact details
-
GP details (where appropriate)
-
Emergency contact information
-
Assessment information
-
Clinical notes
-
Appointment correspondence
-
Invoices and payment records
Website Information
If you visit my website, technical information may also be collected, including:
-
IP address
-
Browser and device information
-
Website usage statistics
-
Cookies (where applicable)
Special Category Data
Psychotherapy involves processing information relating to your physical and mental health. This is classified as Special Category Data under UK GDPR.
This information is processed for the provision of psychotherapy services in accordance with Article 9(2)(h) UK GDPR (health and social care provision), together with the relevant lawful basis under Article 6 UK GDPR.
How Your Information Is Used
Your information is used to:
-
Respond to enquiries
-
Arrange appointments
-
Provide psychotherapy
-
Maintain clinical records
-
Process payments
-
Meet professional, legal and insurance obligations
-
Manage safeguarding concerns where necessary
-
Obtain professional supervision (using anonymised information)
Lawful Basis for Processing
Your personal information is processed under one or more of the following lawful bases:
-
Performance of a contract
-
Legitimate interests
-
Compliance with legal obligations
-
Provision of health and therapeutic services
-
Explicit consent where required
Confidentiality
Everything discussed in therapy is treated as confidential.
However, confidentiality may be broken where:
-
You give your consent.
-
There is a serious risk of harm to yourself or another person.
-
There are safeguarding concerns involving a child or vulnerable adult.
-
Disclosure is required by law or court order.
-
Professional or insurance requirements make disclosure necessary.
-
Where possible, I will discuss any proposed disclosure with you beforehand.
Clinical Supervision
As part of ethical and professional practice, I undertake regular clinical supervision.
Client material discussed in supervision is anonymised wherever possible and handled confidentially in accordance with UKCP ethical standards.
Retention of Records
Records are retained in accordance with professional, legal and insurance requirements.
Unless there is a legal reason to retain them longer, records are generally kept for:
-
Adults: Seven years after therapy ends.
-
Children and young people: Until age 25 (or age 26 where therapy ended at age 17).
Data Security
Appropriate technical and organisational measures are used to protect your personal information, including:
-
Password-protected devices
-
Secure electronic storage
-
Encryption where appropriate
-
Secure disposal of confidential records
-
Restricted access to client information
Your Rights
Under UK GDPR you have the right to:
-
Request access to your personal information
-
Request correction of inaccurate information
-
Request erasure where applicable
-
Request restriction of processing
-
Request data portability
-
Object to processing in certain circumstances
-
Withdraw consent where consent is the lawful basis
-
Some rights may be limited where information must be retained for legal, professional or insurance purposes.
Data Protection Complaints Procedure
If you have concerns about how your personal information has been collected, stored or used, I encourage you to raise these concerns directly with me so that we can seek to resolve the matter promptly and fairly.
Complaints may be made by email or in writing using the contact details above.
Please include:
Your name
Contact details
A description of your concern
Any relevant dates or supporting information
What Happens Next
I will:
Acknowledge receipt of your complaint within 30 calendar days.
Investigate the matter fairly and impartially.
Review any relevant records or procedures.
Respond without undue delay.
Explain the outcome of the investigation and any actions taken where appropriate.
A confidential record of all data protection complaints will be maintained.
If You Are Not Satisfied
If you remain dissatisfied after your complaint has been considered, you have the right to contact the Information Commissioner's Office (ICO).
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk
Changes to this Notice
This Privacy Notice and Data Protection Complaints Procedure may be updated from time to time to reflect changes in legislation, professional guidance or practice procedures.
The most current version will always be available on my website.
Statement for the Psychotherapy Agreement
Data Protection
If you have any concerns regarding how your personal information is collected, stored or processed, you are encouraged to raise these concerns directly with Rebecca D'arcy Psychotherapist using the Data Protection Complaints Procedure. Complaints will be acknowledged within 30 calendar days and handled fairly, promptly and without undue delay in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025. If you remain dissatisfied after your complaint has been considered, you have the right to contact the Information Commissioner's Office (ICO).