Privacy Notice

This Privacy Notice explains how I, Cole Ruegg, trading as Cole Ruegg Psychotherapy, collect, use and protect personal data relating to clients and prospective clients. I am the data controller for this information and am registered with the Information Commissioner’s Office (ICO). I am committed to handling your information lawfully, fairly and transparently, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

What information I collect

In the course of our work together, I may collect and store:

• Your name and contact details (for example, telephone number and email address).
• Basic personal information (for example, date of birth, gender and occupation).
• GP details or an emergency contact, where relevant for safety.
• Information about your health and wellbeing, including mental health information, that you share during assessment and therapy.
• Session notes. These are kept brief and pseudonymised: they are stored under a client code and do not include your name. They are still personal data because they relate to you.
• Financial information (payments received by bank transfer, including the payer’s name and reference), for accounting purposes.
• Correspondence between us, such as emails about appointments.

Some of this information, particularly information about your health, is “special category data” under the UK GDPR and receives additional protection.

Why I collect this information and my lawful basis

I use your information to provide psychotherapy services, to arrange and manage appointments, to keep appropriate clinical records in line with professional standards, to support your safety and meet my duty of care, and to meet my legal, professional and accounting obligations.

The law requires me to have a lawful basis for using your personal data. My lawful bases are:

• Contract: processing is necessary to provide the therapy you have agreed to receive (Article 6(1)(b) UK GDPR).
• Legal obligation: for example, keeping financial records for HMRC (Article 6(1)(c) UK GDPR).
• Legitimate interests: for example, responding to enquiries from prospective clients (Article 6(1)(f) UK GDPR).

For health information and other special category data, I rely on the provision of health and social care, including psychotherapy, by a professional bound by a duty of confidentiality (Article 9(2)(h) UK GDPR and Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018). Where I need to share information to protect you or someone else from serious harm, I may also rely on vital interests or the safeguarding provisions of the Data Protection Act 2018.

How your information is stored and kept secure

• Electronic records are stored on encrypted devices protected by strong passwords and two-factor authentication.
• Email and documents are held with Zoho, a secure cloud service provider, on servers located in the European Union, under a data processing agreement.
• Paper notes (if used) are stored in a locked cabinet.
• Identifying details are stored separately from session notes.

Who I share your information with

I use a small number of trusted service providers (“processors”) who handle data on my behalf, under written agreements that require them to keep it secure and use it only on my instructions:

• Zoho (email and document storage, EU-hosted).
• Zoho Meeting (video sessions). Sessions are never recorded.

As part of good professional practice and the requirements of my professional body, the British Association for Counselling and Psychotherapy (BACP), I discuss my clinical work with a clinical supervisor. I do this without using your name or any details that would identify you.

In line with BACP requirements, I have appointed a professional colleague, bound by the same duty of confidentiality, to manage my practice and records in the event of my death or incapacity.

Otherwise, I do not share your personal information with third parties unless required by law, where there is a serious risk of harm (see below), or with your consent.

How long your information is kept

Session notes and personal data are normally kept for seven years after our work ends, in line with professional, insurance and legal requirements. After this period, records are securely deleted or destroyed. Enquiries from people who do not go on to start therapy are deleted within 12 months.

Your rights

Under the UK GDPR, you have the right to:

• Access the personal data I hold about you.
• Ask me to correct information that is inaccurate or incomplete.
• Ask me to delete your data, where this does not conflict with my professional, insurance or legal obligations.
• Ask me to restrict how your data is used, or object to it being used.
• Receive a copy of data you have given me in a portable format, where this applies.

To exercise any of these rights, please contact me using the details below. I will respond within one month. There is normally no charge.

Confidentiality and its limits

Everything shared in therapy is confidential. However, there are some limits:

• If I believe you or someone else is at serious risk of harm, I may need to share information with your GP or the emergency services.
• If required by law (for example, a court order, or legislation relating to terrorism or money laundering), I may be legally obliged to share information.

Where possible, I will always try to discuss this with you first.

Email and Text Messages

Email and text messages are not fully secure forms of communication. I use them for practical matters such as arranging or changing appointments and sending invoices, and I would encourage you to keep anything sensitive for our sessions.

Contact and complaints

If you have any questions about this notice or how your data is handled, please contact me at contact@colerueggpsychotherapy.com.

If you are unhappy with how I have handled your data, you have the right to complain to the Information Commissioner’s Office: www.ico.org.uk, telephone 0303 123 1113. I would welcome the chance to address your concerns first.