Privacy Statement
updated 26/07/26
This document outlines Marie Fitzpatrick’s (Gestalt Psychotherapist) procedures for collecting, storing and processing personal data.
Contact details for further information:
c/o The Bay Therapy Centre, 21 Trent Boulevard, Lady Bay, West Bridgford, NG2 5BBTel: 07743 877213
Email: marie@marie-fitzpatrick.com
What information I ask for and why:
If you contact me to enquire about therapy, I will usually offer an initial consultation, which is an opportunity for us to meet and discuss any questions or concerns before deciding whether to proceed with therapy. If we decide to proceed, I will ask you for some personal information either before we begin or during our first session. This helps me to administer and deliver the service you have requested. Some information is essential and I will not be able to proceed without it, other information is helpful but not essential. Information I will ask you for;
Required:
-
Your name
-
Your address
-
Your email address and/or phone number
-
Relevant medical history
-
Relevant current medication
-
Your GP's name and surgery
Optional:
-
Your date of birth and age
-
Emergency contact details
-
Alcohol or drug use
-
Sleep pattern/difficulties
-
Previous experience of therapy
What I will use your information for:
-
To contact you to arrange appointments and discuss any changes to appointments
-
To make a clinical assessment of the best course of therapy
-
To support you effectively in the case of an emergency
What information I will record about our therapy sessions:
-
After each therapy session I write case notes. These notes include the date and time of the session, a brief outline of the content of the session and my interventions. They do not include any names or other identifiable information
-
I will record how much you paid for the session
How I will securely store your information:
I will store your personal information both electronically and physically. All digital client data stored locally is protected with full-disk encryption (FileVault), in accordance with GDPR and ICO standards. Electronic devices are protected using strong passwords and kept up to date with current security software.
-
Your initial client intake form is either kept in a securely locked filing cabinet, or electronically on Proton Drivewhich is an encrypted, GDPR compliant, cloud-based storage and only accessible by me. Names and contact details are stored separately to other personal information.
-
I will store your phone number in my mobile phone for the period that you are engaging in therapy. I will only use a first name, and the phone is secured with a passcode. I will delete your number when you finish your course of therapy.
-
I will store your email address in my email account, which is with the encrypted email server Protonmail. I access my emails via my mobile phone and laptop, which are both secured with passcodes and antivirus software. Administrative emails will normally be retained as part of your client record for up to six years.
-
Case notes are stored electronically under a code name, eg client A1. Actual names are not used anywhere in my records. Case notes are stored in files either in Proton Drive, or on my password protected laptop, both of which are encrypted, GDPR compliant and only accessible by me.
Transfers outside the UK:
Some technology providers I use (for example Proton and Google) may process limited personal information outside the UK. Where this occurs, appropriate safeguards are in place to ensure your information receives an equivalent level of protection in accordance with UK GDPR.
Data retention:
-
I will keep your clinical file and case notes for six years after our work together ends, in line with the Statute of Limitations for the rare situation of case notes being subpoenaed for a court case.
-
I will keep a record of your payments for therapy sessions for six years, in line with the advice of the Financial Conduct Authority and HMRC.
-
I will delete all other information I hold relating to you immediately after our last therapy session, or sooner if you request that I do so.
Clinical supervision:
-
For my own ongoing professional development, I meet with another qualified therapist for clinical supervision. The focus of these sessions is the development of my practice, and when I discuss our work together. I will only share your first name and no identifiable information. My clinical supervisor is also bound by professional confidentiality and applicable data protection obligations.
-
Sometimes, I may use a digital recorder to record a therapy session solely for the purpose of reflecting on my practice with my clinical supervisor. I will only do this with your separate verbal and written consent. If you consent, I will transfer the recording to my encrypted, password-protected laptop and delete it immediately from the recording device. The recording will be securely stored and permanently deleted within 30 days, or sooner once it has been reviewed in supervision, whichever is earlier. You may withdraw your consent and request deletion of the recording at any time before it is reviewed in supervision.
Sharing your information with other organisations:
-
I will not share your personal information with anyone except in the case of an emergency, or if you ask me to do so. Examples of emergencies; in the case of a medical emergency I may contact your GP, Crisis Assessment Team, or the ambulance service. I may contact the police if I feel that you or someone else are at risk of serious harm.
-
Wherever possible, I will discuss any request to share your information with you before doing so. This may include, for example, a request from the police, a solicitor or a court in connection with legal proceedings. However, there are circumstances in which I may be legally required to disclose information without your knowledge or consent, such as where required by law or to protect you or others from serious harm. Please note that my case notes are anonymised and do not contain your name or other direct identifying information.
-
If you have provided me with an emergency contact we will agree together under what circumstances I would contact them. I do not require you to provide an emergency contact.
-
In case of my being unable to practice, for example due to serious illness or death, my therapeutic executor (a fellow therapist) has instructions that enables them to access your name and contact details which is held in locked/encrypted storage, so they can inform you of the circumstances. However, they will only access the minimum information necessary to contact you.
Social media and website:
-
If you choose to follow or interact with my professional social media accounts (such as Facebook, Instagram or LinkedIn), any information you share is processed by the relevant social media platform in accordance with its own privacy policy. I do not collect or store information about your interactions outside of the platform itself unless you contact me directly.
-
Please be aware that following, liking or interacting with my social media accounts may be visible to others depending on your own privacy settings and the platform's features. This may affect your privacy or confidentiality, and these settings and algorithms are outside of my control. For this reason, I recommend that clients do not engage with my social media accounts if maintaining complete confidentiality is important to them.
-
I do not provide therapy, supervision or clinical advice through social media or direct messaging. If you need to contact me regarding appointments or administrative matters, please use email or telephone. If you require therapeutic support between sessions, we can discuss appropriate ways of managing this within our work together.
-
I may occasionally use social media advertising (for example through Meta) to raise awareness of my practice. This does not mean I know who has viewed or interacted with any advertisement unless you choose to contact me directly.
-
My website uses Google Analytics to help me understand how visitors use the site so that I can improve its content and usability. Google Analytics collects information such as pages visited, time spent on the website, general location (derived from IP address), device and browser type, and other anonymous usage statistics. I do not use Google Analytics to identify individual visitors.
-
Google Analytics uses cookies to collect this information. Where required by law, non-essential cookies will only be used with your consent through the website's cookie banner. You can also control or delete cookies through your browser settings at any time.
-
Further information about how Google processes data is available in Google's Privacy Policy and information about Google Analytics:
Your rights:
-
You have rights and control over how your data is used, and the relevant laws are the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA)
-
You have the right to be informed of what information I hold, and how it is stored and processed
-
You have a right to see the information I hold about you, free of charge
-
You have a right to rectify any inaccurate or incomplete personal information
-
You have the right to withdraw your consent to me using your personal information
-
You have the right to request that your personal information is erased
-
I can decline requests to erase information that I need to retain to practice lawfully and competently
-
You have the right to lodge a complaint with the Information Commissioner's Office (ICO)
How to request a copy of your information, deletion of information, or amendment of information:
-
You can ask me during a session or contact me at any time via the contact details at the top of this document
-
I will comply with your request as soon as I am able to and within one month
Data Protection Complaints:
If you have a concern about how I handle your personal information, I want to hear from you.
-
How to raise a concern
If you have any concerns about how I handle your personal information, please contact me using the email address provided at the beginning of this Privacy Policy. Please describe your concern as clearly as you can and include any relevant dates or details.
-
What happens next
I will acknowledge receipt of your complaint as soon as reasonably practicable. I will investigate your concerns and aim to provide a full response without undue delay, and in any event within one month of receiving your complaint.
-
If you remain dissatisfied
If you are not satisfied with my response, you have the right to make a complaint
to the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.
Legal notice:
-
Marie Fitzpatrick is the Data Controller for the personal information processed in connection with the psychotherapy and supervision services she provides (ICO Registration Number: ZA812525).
-
Personal information is processed in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025, together with any subsequent amendments or replacement legislation.
-
The lawful basis for processing your personal information under Article 6 UK GDPR is Legitimate Interests(Article 6(1)(f)), as it is necessary for me to provide psychotherapy services safely, ethically and effectively. The special category health information I process is handled under Article 9(2)(h) UK GDPR, which permits the processing of health data for the provision of health care, together with my professional and ethical obligations.
-
Where I ask for your specific agreement to undertake an additional activity, such as recording a therapy session for clinical supervision, I rely on your explicit consent, which you may withdraw at any time before the recording has been used for its intended purpose.