07766 242 145
-FACE-TO-FACE APPOINTMENTS
IN BASILDON, ESSEX
-remote VIDEo APPOINTMENTs
DATA & PRIVACY
Kerry Crease Therapy is a private therapy practice run by Kerry Crease, who is registered with the Information Commissioner's Office (ICO) under registration number ZA799066.
For further information about how Kerry Crease Therapy handles clients' personal data, please email contact@kerrycrease.co.uk
collection of personal data
To provide therapy services, Kerry Crease Therapy collects the following types of client data:
- Name, address, telephone number and email address
- Emergency contact details
- Reasons for attending therapy
- Information about mental and physical health which is therapeutically relevant
- Notes on therapeutic sessions
- Therapeutically relevant medical history which a client chooses to share
- Details of client medication
- Therapeutically relevant details of client GP and/or other healthcare providers
- Records of appointments
- Payment and invoicing details
- Correspondence between client and Kerry Crease Therapy
- Details of initial therapy enquiry
Much of the data collected about client health and wellbeing is classed as 'Special Category Data' under Article 9(1) of the UK GDPR. This type of data received enhanced legal protection, and additional care is taken to keep it secure and confidential.
Personal data is collected directly from a client
- at the initial therapy enquiry
- upon completion of intake forms before a course of therapy begins
- during therapy sessions
- via email, text, telephone or video communication outside of therapy sessions
Personal data is not collected from other sources unless a client has given explicit permission e.g. if a client asks for liaison with their GP.
LAWFUL BASIS FOR DATA COLLECTION
Under UK data protection law, there must be a valid legal reason (a 'lawful basis') to process a client's data. Because therapy involves health-related information, two separate bases are required:
- Article 6(1)(b) UK GDPR - processing is necessary for the performance of the therapeutic contract between a client and Kerry Crease therapy
- Article 9(2)(h) UK GDPR - processing is necessary for the provision of health or social care treatment by a health professional
The additional condition required under the Data Protection Act 2018 is Schedule 1, Part 1, Paragraph 2, whereby clients' data is processed by a qualified therapist subject to the common-law duty of confidence and the professional standards expected of therapists in private practice.
PROFESSIONAL OBLIGATIONS AND CPD
As part of the maintenance of professional standards for therapists in private practice, Kerry Crease is subject to regular professional supervision. This is essential in order to ensure that the therapy provided by Kerry Crease Therapy is safe and effective.
During supervision,
- Names and identifying details of clients are NOT shared
- The supervisor is a qualified therapy professional bound by the same confidentiality obligations as Kerry Crease
- The supervisor is additionally bound by their own professional body's ethical framework
DATA SHARING
All data shared with Kerry Crease Therapy is kept strictly confidential. Notwithstanding this, certain third-party business services such as WhatsApp and Microsoft Teams are used by Kerry Crease Therapy, and these may process some of your data on my behalf.
All third-party services are bound by data processing agreements requiring them to keep client data secure and to use data only as per my instructions. Links to their privacy policies are available upon request.
Kerry Crease Therapy will never sell client data to any person or organisation.
DATA RETENTION
Client data is kept by Kerry Crease Therapy for only as long as is necessary:
- Therapy records (adult) are kept for 7 years after the final therapy session, in line with the Limitation Act 1980 and standard professional indemnity insurance requirements
- Therapy records (child) are kept until the client reaches the age of 25
- Financial records are kept for 6 years after the end of the relevant tax year, as per the legal requirement from HMRC
- Enquiries from non-clients are kept for 1 2 months
After the data retention period ends, both physical and digital records are securely deleted.
CLIENT RIGHTS UNDER GDPR
Clients have important rights under the UK General Data Protection Regulation:
- Right to be informed: Clients have the right to know how their data is used. This privacy policy fulfils that right
- Right of access: Clients may ask for a copy of all personal data held by Kerry Crease Therapy about them. Under the Data (Use and Access) Act 2025, Kerry Crease Therapy will conduct a reasonable and proportionate search to locate such data and will respond within one month in the event of such a request
- Right to correction: If any a client's personal data held by Kerry Crease Therapy is incorrect then a client may ask for it to be corrected
- Right to erasure: In certain circumstances, a client may ask Kerry Crease Therapy to delete their personal data. This right does not apply where Kerry Crease Therapy is required to keep a client's personal data in order to comply with the Limitation Act 1980 or with professional indemnity insurance requirements
- Right to restrict processing: In certain circumstances, a client may ask Kerry Crease Therapy to limit how their data is used e.g. if its accuracy is disputed
- Right to data portability: Where technically feasible, a client may ask Kerry Crease Therapy to provide their data in a format allowing it to be transferred to another service
- Right to object: A client has the right to object to certain types of processing. As Kerry Crease Therapy relies on contractual necessity rather than legitimate interests foir therapy services, this right is limited in application to clinical records
- Right to non-automated decision-making: A client has the right not to be subjected to decisions made solely by automated processing. Kerry Crease Therapy does not use automated decision-making
DATA PROTECTION COMPLAINTS
Under the Data (Use and Access) Act 2025 a client has the right to make a complaint to Kerry Crease Therapy in the event that they are unhappy with how their personal data has been handled.
All complaints will be handled seriously and promptly.
Should a client not be satisfied with how Kerry Crease Therapy has handled a data handling complaint they may escalate the complaint by contacting the Information Commissioner's Office:
- Website: www.ico.org.uk
- Telephone: 0303 123 1113
- Post: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF
CONFIDENTIALITY EXCEPTIONS
Everything shared during therapy with Kerry Crease Therapy is confidential. Notwithstanding this, there are certain circumstances where information might have to be shared without a client's consent: if Kerry Crease Therapy:
- believes that a client or other person is at serious risk of harm
- becomes aware of concerns about the safety of a child or vulnerable adult
- is ordered by a court of law to disclose client data
Wherever possible, Kerry Crease Therapy will discuss any requirement to break confidentiality with a client first, unless doing so would put the client or another person at risk. Only the minimum information necessary will be disclosed.