Privacy Policy

GDPR Compliance Statement

Wholeness Therapy Group is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018. We process personal data lawfully, fairly, and transparently, and only collect data that is necessary for the provision of therapy services.

Your rights under GDPR include the right to access your personal data, request corrections, request deletion, object to processing, and lodge a complaint with the Information Commissioner's Office (ICO).

1. Information We Collect

Personal Information

When you contact us or book therapy services, we may collect:

• Name and contact details (email, phone number, address)
• Date of birth and age
• Emergency contact information
• GP details (with your consent)

Therapeutic Information

During the provision of therapy services, we collect:

• Mental health history and presenting concerns
• Clinical notes from therapy sessions
• Assessment and outcome measure data
• Information relevant to your treatment plan
• For children/young people: parental consent and relevant family information

2. How We Use Your Information

Your personal information is used for the following purposes:

• Providing therapy services: To deliver effective, personalized therapeutic care
• Communication: To respond to inquiries, schedule appointments, and send appointment reminders
• Clinical record-keeping: To maintain accurate clinical records as required by professional guidelines
• Safety: To ensure your safety and the safety of others (in rare circumstances where there is risk of harm)
• Legal obligations: To comply with legal and regulatory requirements

3. Legal Basis for Processing

We process your personal data under the following legal bases:

• Consent: You have given explicit consent for us to process your personal data for specific purposes
• Contract: Processing is necessary for the performance of a contract to which you are a party
• Legal obligation: Processing is necessary for compliance with a legal obligation (e.g., safeguarding requirements)
• Vital interests: Processing is necessary to protect your vital interests or those of another person

4. Data Storage and Security

How We Protect Your Data

• All digital records are stored on encrypted, password-protected devices
• Clinical notes are kept in secure, locked filing cabinets when in paper form
• Access to your information is restricted to authorized personnel only
• We use secure, encrypted communication platforms for online sessions
• Regular backups are made to prevent data loss

How Long We Keep Your Data

In accordance with professional guidelines from the BABCP and HCPC:

• Adult clients: Clinical records are retained for a minimum of 7 years after the end of therapy
• Child/adolescent clients: Records are retained until the client's 25th birthday, or for 7 years after therapy ends, whichever is longer
• Contact form data: Deleted after 12 months if no therapy relationship is established

5. Information Sharing and Disclosure

Your information is kept strictly confidential. We will never share your personal or therapeutic information without your explicit consent, except in the following limited circumstances:

• Safeguarding: If there is a risk of serious harm to you or others, I am legally obligated to share relevant information with appropriate authorities
• Legal requirement: If required by law or court order
• With your consent: If you request that information be shared with your GP, another healthcare professional, or family member
• Clinical supervision: Anonymized case information may be discussed in professional supervision (supervisors are also bound by confidentiality)

6. Your Rights Under GDPR

You have the following rights regarding your personal data:

To exercise any of these rights, please contact us at info@wholenesstherapygroup.co.uk. We will respond within one month.

7. Children and Young People's Data

When working with children and young people under 18, we require parental or guardian consent to collect and process their personal data. We are committed to protecting children's privacy and will:

• Only collect information necessary for therapeutic care
• Store children's records securely and separately
• Retain records until the child's 25th birthday or 7 years post-therapy, whichever is longer
• Balance the child's right to confidentiality with parental rights and safeguarding responsibilities

8. Data Breaches

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will:

• Notify the Information Commissioner's Office (ICO) within 72 hours
• Notify affected individuals without undue delay
• Take immediate steps to contain and remedy the breach
• Document the breach and our response

9. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The current version will always be available on this website, with the date of last update clearly shown. Significant changes will be communicated to active clients.

10. Complaints and Concerns

If you have concerns about how your data is being handled, please contact us first:

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):