Privacy Policy

Effective Date: 1st August 2025 (Updated June 2026)

Young Life Psychotherapy – Heather Young NCPS Accredited Therapist

Based in Carluke, South Lanarkshire, UK

Introduction

This privacy policy explains how I collect, store, and use your personal information in line with:

  • UK General Data Protection Regulation (UK GDPR)
  • Data Protection Act 2018
  • UK Data (Use and Access) Act 2025 (where applicable)

Your confidentiality and trust are central to the therapy I provide.

Who I Am

I am Heather Young, an NCPS-accredited integrative therapist based in Carluke, offering both in-person and online therapy to adult clients.

I am the data controller for Young Life Psychotherapy.

Contact details:

  • Email: younglifepsychotherapy@gmail.com
  • Phone: 07552465977

What Information I Collect

When you contact me or engage in therapy, I may collect and process the following categories of personal data:

  • Name, email address, and phone number
  • Emergency contact information
  • Relevant medical, psychological, and mental health information (special category data)
  • Session notes (clinical records of therapy sessions)
  • Intake forms and counselling agreement documents
  • GP contact details (only where clinically or safeguarding relevant)
  • Payment or invoicing information (if applicable)
  • Records relating to consent, safeguarding, or risk management decisions

Important: Session notes are clinical records and are not anonymised, but are stored securely and confidentially in accordance with professional standards.

Lawful Basis for Processing Your Data

I process your personal data under the following legal bases:

  • Article 6(1)(b) UK GDPR – performance of a contract (therapeutic services agreement)
  • Article 9(2)(h) UK GDPR – provision of health or social care treatment
  • Schedule 1, Data Protection Act 2018 – provision of health or social care services

Where appropriate, I may also rely on:

  • Legal obligations (e.g. safeguarding or court orders)
  • Legitimate interests (e.g. professional supervision, secure service delivery)

How I Use Your Information

Your information is used to:

  • Process payments and maintain financial records (where applicable)Your information is used for the following purposes:
  • Provide safe and effective psychotherapy services
  • Manage appointments and communication
  • Maintain accurate clinical records
  • Fulfil professional, legal, and insurance requirements
  • Support clinical supervision (all identifying details removed where possible)
  • Process payments and maintain financial records (where applicable)

How Your Information is Stored

Your data is stored securely using encrypted digital systems and/or password-protected devices.

I take appropriate technical and organisational measures to protect your data from unauthorised access, loss, or misuse.

I do not sell or share your personal data.

Online Therapy & Digital Communication

For online therapy sessions, I use secure third-party platforms such as Zoom and Bilateral Base.

These platforms may process your data outside the UK or EEA. Where this occurs, appropriate safeguards are in place, such as:

  • UK International Data Transfer Agreement (IDTA), or
  • Standard Contractual Clauses (SCCs), where applicable

Email and phone communication are used for essential administrative purposes only.

While reasonable steps are taken to protect your privacy, no digital communication system can be guaranteed as completely secure.

Data Sharing

Your personal data will only be shared in the following circumstances:

  • With your explicit consent
  • Where required by law (e.g. safeguarding concerns, serious risk of harm, terrorism prevention)
  • With clinical supervisors (always anonymised wherever possible)
  • With service providers who support secure data storage or service delivery (under strict confidentiality agreements)

Data Retention

Clinical records and therapy notes are retained securely for up to 7 years after the end of therapy, in line with professional, insurance, and legal requirements.

After this period, data is securely deleted or destroyed.

Your Rights

Under data protection law, you have the right to:

  • Request access to the personal data I hold about you
  • Request correction of inaccurate data
  • Request deletion of your data (where legally permissible)
  • Restrict or object to certain processing
  • Request a copy of your data (data portability, where applicable)

Some rights may be limited where retaining data is required for legal, safeguarding, or clinical reasons.

Complaints

If you are concerned about how your data is handled, you can contact me directly in the first instance so I can address your concerns.

You also have the right to lodge a complaint with the supervisory authority:

Information Commissioner’s Office (ICO)
https://ico.org.uk

Data Protection Complaints Process

If you wish to make a formal data protection complaint, I will:

  • Acknowledge your complaint within a reasonable timeframe
  • Investigate the issue
  • Provide a written response outlining the outcome

Updates to This Policy

This privacy policy may be updated from time to time to reflect changes in law or practice.

The most current version will always be available on my website.

Last updated: June 2026
Original effective date: 1st August 2025