Privacy Policy

1. Introduction: This Privacy Notice explains how I, Rowan Keddie, collect, store, process and protect your personal information from initial point of contact through to after your therapy has ended. Your information will remain safe and secure, and I will only ever use it for the purpose it was given to me. This Privacy Policy is in line with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018.

2. Data Controller: 'Data Controller' refers to the individual responsible for collecting and storing your personal data. In this instance, the Data Controller is me, Rowan Keddie. 

If you have any questions about my data protection policy you can contact me via phone: +447954718365; or by email: info@therapywithrowan.co.uk.

3. What information I collect and why: I collect and process the following information in order to deliver safe, ethical and effective therapy:

• Personal details, including your name, date of birth, contact information, GP details and emergency contact;
• Health and wellbeing data, including your mental health history, medication details and risk assessment;
• Written notes of each session;
• Correspondence by email or phone;
• Administrative data, including invoices, payment information and appointment schedules.

This data is collected directly from you or in some cases from third parties (e.g. GPs) with your explicit consent.

4. My lawful basis for holding and processing your information: The GDPR states I must have a lawful basis for storing and using your personal data. These are the relevant legal bases I use to process your data:

• If you have contacted me to consider my therapy services, or if you are currently in therapy with me, I will process your personal data to fulfil our contract.
• I will use legal obligation as my lawful basis to hold and process your data to comply with regulatory and/or tax requirements.
• If you have had therapy with me and it has now ended, I will use legitimate interest as my lawful basis to store your information to maintain continuity of care if you decide to return to therapy in the future.
• I will use vital interest as my lawful basis to use your personal information to act if there is a risk of serious harm to yourself or to someone else.
• In specific circumstances, I will use consent as my lawful basis to use and share your information, for example with other health professionals.

5. How your information is stored:  All of your data is stored securely in an electronic format in line with best practice. I do not store any physical paper records. Your personal information, administrative data and session notes are stored using Proton Drive, a GDPR-compliant end-to-end encrypted, cloud-based file storage service. Emails are stored securely using Proton Mail. Any text correspondence is deleted immediately. Only I, Rowan Keddie, have access to your stored information, unless I am required to share it under the terms outlined below.

6. Confidentiality and information sharing: Everything you share in therapy is kept confidential. However, there are some legal and ethical exceptions to this:

• If you disclose plans to seriously harm yourself or others;
• If I am required by law to share information (for example by court order or if there is a child or vulnerable adult safeguarding concern);
• If you disclose information about certain criminal activity (for example terrorism, human trafficking or money laundering);
• If you give your consent for me to share your information (for example with your GP).

I will always endeavour to discuss my need to share your information with you before doing so, unless doing so would increase the risk.

7. How long I keep your data: For security reasons, text correspondence is deleted immediately. If it contains information important to your therapy, this will be transferred to a secure note held in Proton Drive. Email correspondence is retained for one month before being securely deleted; if it contains information important to your therapy, this will be transferred to a secure note held in Proton Drive. I will retain the rest of your records for 5 years from the date you end therapy. This allows you to return to therapy at a later point and is in line with professional guidelines. After 5 years all personal data will be securely destroyed.

8. Your rights: You have the right to access your data, request correction of any inaccurate data, request deletion of your data (unless I have a legal obligation to retain it), limit how I use your personal information, or to make a formal complaint to the Information Commissioner's Office (ICO). You can read more about your rights at ico.org.uk/for-the-public. You can lodge a complaint at ico.org.uk/make-a-complaint.

9. Data breaches:  In the unlikely event of a data breach, I will notify the ICO and affected individuals where required in line with GDPR requirements.

10. Updates to this privacy notice: This Privacy Notice may be updated from time to time. The most recent version will always be available on my website or by request.

11. Website cookies: My website uses cookies (small text files placed on your device) to help the site function properly and to improve your browsing experience. These may include essential cookies (for site functionality) and optional cookies (e.g., for analytics). You’ll be given the option to accept or reject non-essential cookies when you visit the site. You can also manage or delete cookies through your browser settings at any time. No personally identifiable information is collected through cookies unless you explicitly provide it (e.g. through a contact form).