Privacy & GDPR Policy

01

Who we are

Liz Kaskela Psychotherapy is the data controller for the personal information described in this notice. Liz Kaskela is a UKCP accredited and BACP registered integrative psychotherapist, practising in person at 17 Gosfield Street, Fitzrovia, London W1W, and online.

The practice is registered with the Information Commissioner's Office (ICO) as a data controller.

If you have any questions about this notice, or about how your information is handled, please get in touch using the contact form on this website.

02

The information I collect

I only collect the information I need in order to provide psychotherapy to you and to run the practice safely and effectively. That information may include:

• Contact details — your name, email address, telephone number and, where relevant, your address.
• Enquiry information — anything you choose to tell me when you get in touch, including through the contact form on this website.
• Personal and background information — your date of birth, GP details, an emergency contact, and how you came to be referred.
• Health and wellbeing information — what you bring to therapy and the brief clinical notes I keep, held securely.
• Attendance and payment records — the dates of your sessions and confirmation that payment has been made.
• Correspondence — emails, messages and text messages between us.
• Website information — see 'Cookies and this website' below.

03

Health information

What you share in therapy is likely to include information about your physical or mental health. Under the UK GDPR this is treated as 'special category' personal data and is given additional protection. It is processed only for the purpose of providing you with healthcare and treatment, on the bases set out below.

04

How and why I use your information

Under data protection law I must have a lawful basis for processing your information. I rely on the following:

• Contract — to provide therapy to you once we agree to work together (Article 6(1)(b)).
• Legitimate interests — to respond to your enquiry and to run the practice safely and effectively (Article 6(1)(f)).
• Legal obligation — to keep financial records and to comply with the law where required (Article 6(1)(c)).
• Vital interests — where it is necessary to protect your life or someone else's (Article 6(1)(d)).
• Health information is processed for the provision of health care and treatment (Article 9(2)(h)), and on the basis of your explicit consent (Article 9(2)(a)) for any other use, such as sharing information with your GP at your request.

05

Confidentiality and its limits

What you bring to therapy is confidential. There are, however, a small number of exceptional circumstances in which I may need to share information without your consent. Where it is safe and possible to do so, I will always discuss this with you first:

• If I believe there is a serious risk to your life or safety, or to the safety of another person.
• If a child or a vulnerable adult is at risk of harm, in line with my safeguarding duties.
• Where disclosure is required by law — for example under terrorism or drug trafficking legislation, or by order of a court.
• Where required by my professional and ethical obligations as a UKCP accredited and BACP registered practitioner.

As part of those professional obligations I attend regular clinical supervision, where I discuss my work with a senior, qualified supervisor who is bound by the same codes of confidentiality and ethics. Wherever possible, identifying details are withheld.

06

Who I share your information with

I share your information only where it is necessary, and never more widely than that.

• My clinical supervisor, as described above.
• Your GP or the emergency services, only in the circumstances set out under 'Confidentiality and its limits'.
• Trusted service providers who help me run the practice — for example my email provider, a secure video platform, this website's host and, where relevant, my accountant. They process information on my behalf under written agreements and only on my instructions.

I never sell your information, and I never share it for marketing or advertising purposes.

07

Transfers outside the UK

Some of the service providers I use may store information outside the UK. Where that happens, I take steps to ensure your information receives an equivalent standard of protection, using UK adequacy regulations or the International Data Transfer Agreement approved by the ICO.

08

How long I keep your information

I keep your information only for as long as it is needed.

• Enquiries that do not lead to therapy — up to 12 months, then securely deleted.
• Clinical notes — for seven years after therapy ends, in line with the requirements of my professional indemnity insurers and my professional bodies. For clients under 18, records are kept until their 25th birthday.
• Financial records — for six years, as required by HMRC.

When information is no longer needed it is securely deleted or destroyed.

09

Your rights under the UK GDPR

You have the right to:

• be informed about how your information is used;
• access a copy of the personal information I hold about you;
• ask for information that is inaccurate to be corrected;
• ask for your information to be erased, where there is no overriding reason for keeping it;
• ask for the processing of your information to be restricted;
• object to processing carried out on the basis of legitimate interests;
• receive your information in a portable format, or have it transferred to another provider;
• withdraw your consent at any time, where consent is the basis for processing.

To exercise any of these rights, please contact me using the contact form on this website. I will respond within one month. Some rights are limited — for example, I cannot delete clinical records that I am required to keep, and erasing them may mean I can no longer work with you safely.

10

How your information is kept secure

Your information is held securely. Paper notes, where used, are kept locked away, and electronic records are held on password-protected, encrypted devices and services. Access is limited to me and to the service providers described above. I take all reasonable steps to protect your information, although no method of storage or transmission can be guaranteed to be completely secure.

11

Cookies and this website

This website does not use advertising or tracking cookies. When you send an enquiry through the contact form, the details you provide are stored securely so that I can read and respond to your message.

12

Changes to this notice

This notice may be updated from time to time to reflect changes in the law or in how the practice operates. The date at the top of this page shows when it was last reviewed.

13

Questions and complaints

If you are unhappy with how your information has been handled, please raise it with me first so that I have the chance to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at ico.org.uk or on 0303 123 1113.

You can write to me at Liz Kaskela Psychotherapy, 17 Gosfield Street, Fitzrovia, London W1W, or get in touch using the contact form on this website.