Privacy Policy

1) What personal data I collect

A) Information you provide

When you use the contact form, I collect:

  • Name
  • Email address
  • Message content (anything you choose to write, which may include sensitive information).

B) Information collected automatically

When you browse the site, the website and its hosting provider may automatically log:

  • IP address
  • Device/browser type and settings
  • Pages viewed, date/time of access
  • General diagnostic and security logs

This data is used to run the website securely and reliably.

2) Special category (sensitive) data

Because this is a psychotherapy website, messages you send may include special category data (for example, information about your mental health, relationships, or experiences of abuse).

Please only share what you feel is necessary for me to respond to your enquiry. If we proceed to therapy, I will give you further information about how client records are handled.

3) How I use your information and my lawful basis

I use your personal data for the following purposes:

A) Responding to enquiries and arranging sessions
  • Purpose: to reply to you, answer questions, and (if appropriate) arrange an initial call or session.
  • Lawful basis (UK GDPR Art. 6): legitimate interests (responding to enquiries) and/or steps prior to entering a contract.
  • Special category condition (UK GDPR Art. 9, where applicable): health or social care purposes under a duty of confidentiality and/or explicit consent (depending on the context).
B) Providing psychotherapy services (if you become a client)
  • Purpose: to provide therapy and manage the professional relationship.
  • Lawful basis: performance of a contract.
  • Special category condition: health or social care purposes under confidentiality.

You will receive additional information as part of your therapy contract/terms (including record-keeping and confidentiality limits).

C) Website administration and security
  • Purpose: to keep the site functioning, secure, and prevent misuse/spam.
  • Lawful basis: legitimate interests.
D) Legal and accounting obligations
  • Purpose: to meet legal obligations (e.g., tax/accounting).
  • Lawful basis: legal obligation.
4) Who I share your data with

I do not sell your personal data.

I may share personal data only where necessary, for example with:

  • Website/IT service providers (e.g., hosting, maintenance) who process data on my instructions
  • Email/communications providers used to respond to you
  • Professional advisers (accountant/insurer) where needed
  • Regulators or law enforcement if required by law

If you become a client, I may also use clinical supervision to support safe practice. Supervision is typically conducted in a way that avoids identifying details wherever possible.

5) International transfers

Some service providers (e.g., web hosting, email, anti-spam tools) may process data outside the UK. Where this happens, I will take steps to ensure appropriate safeguards are in place (for example, UK adequacy regulations or standard contractual clauses).

6) How long I keep your information (retention)

I keep personal data only for as long as needed for the purpose it was collected.

Typical retention (you can adjust these):

  • Website enquiries: kept for up to 12 months after last contact (unless you become a client or there is a legal/clinical reason to keep it longer).
  • Client records: retained in line with professional, insurance, and legal requirements (details provided separately if we begin work together).
  • Website logs: retained for a limited period for security/diagnostic purposes.
7) Cookies

This website uses cookies and similar technologies to help it function.

Cookies may be used for:

  • Essential site functionality and security
  • Remembering preferences
  • Enabling comment functionality (if comments are enabled)
  • Spam prevention

You can control cookies through your browser settings. If you disable cookies, parts of the website may not work as intended.

8) Your data protection rights

You have rights under UK data protection law, including:

  • Access to your personal data
  • Correction of inaccurate data
  • Deletion of your data (in some circumstances)
  • Restriction of processing (in some circumstances)
  • Objection to processing based on legitimate interests
  • Data portability (in some circumstances)
  • Withdrawal of consent (where processing is based on consent)

To exercise any rights, contact me using the website contact form (write “Privacy” at the start of your message).

9) Complaints

If you are unhappy with how I have handled your data, please contact me first so I can try to resolve it.

You can also complain to the UK regulator, the Information Commissioner’s Office. (ICO)

10) Children

This website and services are intended for adults (18 ). I do not knowingly collect data from children through this website.

11) Links to other websites

This website may include links to other sites. If you follow a link, that website’s privacy policy will apply. I am not responsible for third-party sites.

12) Changes to this policy

I may update this Privacy Policy from time to time. The latest version will always be posted on this page with the updated date.

Privacy Notice Summary

I collect and process personal data to…

I collect and process personal data to respond to enquiries, arrange sessions, provide counselling/therapy, manage appointments and payments, keep appropriate clinical records, communicate with you, meet legal and professional obligations, maintain insurance records, and protect safety where necessary.
Information I may collect includes identity and contact details, GP and emergency contact details, assessment information, clinical notes, correspondence, payment information, safeguarding or risk information, and information you choose to share during therapy. If you use the website contact form, the information collected may include your name, email address, message content, and limited technical information such as website logs.
I do not sell your personal data. I may share limited relevant information where necessary with my clinical supervisor, website/IT or communications providers, professional advisers, insurer, accountant, secure software providers, professional bodies, safeguarding agencies, emergency or health services, courts, regulators, or law enforcement bodies. I will only share what is necessary for the specific purpose.
I store information securely and retain it only for as long as needed for the purpose it was collected. Website enquiries are usually kept for up to 12 months after last contact unless you become a client or there is a legal, clinical, safeguarding, or professional reason to keep them longer. Adult client records are retained for 7 years after the end of therapy, unless there is a lawful, safeguarding, professional, insurance, complaint-related, or legal reason to retain them for longer. After that, records are securely deleted, anonymised, or destroyed unless there is a lawful reason to keep them longer.You can request access to your personal data by contacting matildaklein@proton.me. You also have the right to complain to the Information Commissioner’s Office if you are concerned about how your data is handled.