PRIVACY POLICY
Your privacy is very important to me, and you can remain confident that your personal information will be kept safely and securely and will only be used for the purpose it was given to me.
I adhere to current data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR).
This privacy notice informs you how I will use your personal information from the initial point of contact through to after therapy has ended, including:
Why I am able to process your information and what purpose I am processing it for
Whether you have to provide it to me
How long I store it for
Whether there are other recipients of your personal information
Whether I intend to transfer it to another country
Whether I perform automated decision-making or profiling
Your data protection rights and how to make a complaint
Please let me know if you have any questions about my data protection policy. You can contact me at info@alexmonktherapy.com.
‘Data Controller’ is the term used to describe the person or organization that collects, stores, and has responsibility for people’s personal data. In this instance, the Data Controller is me:
Name: Alex Monk
Email: info@alexmonktherapy.com
Phone: 07531 889011
Address: Ground Floor Office, 2A Median Road, London, E5 0PL
ICO Registration Number: ZC00015692921 (Note: Format verified against ICO register)
1. MY LAWFUL BASIS FOR HOLDING AND USING YOUR PERSONAL INFORMATION
The UK GDPR states that I must have a lawful basis for processing your personal data. There are different lawful bases depending on the stage of our work together:
Inquirers and Active Clients: If you are currently having therapy or are in contact with me to consider therapy, I process your personal data under the lawful basis of Contract (or taking steps prior to entering into a contract) so that we can carry out our therapeutic work together.
Former Clients: If therapy with me has ended, I use Legitimate Interests as my lawful basis for holding your personal information (specifically to maintain records in case of clinical follow-up or legal obligations).
Special Category Data
GDPR ensures that I look after any sensitive personal information that you may disclose to me appropriately. In legal terms, health and therapy details are classified as ‘Special Category Personal Information’. My lawful basis for processing this data is the provision of health or social care treatment (under UK GDPR Article 9(2)(h)), as it is necessary for our psychotherapy work together.
2. HOW I USE YOUR INFORMATION
Initial Enquiries
When you contact me with an enquiry about psychotherapy, I will collect information to help me respond to your request, including:
Your name
Your email address and phone number
If you decide not to proceed with psychotherapy, I will ensure all your personal data is deleted within 7 days. If you would like me to delete this information sooner, please inform me.
While in Psychotherapy
Everything you discuss with me in psychotherapy is confidential. I will break confidentiality only if I feel you are a risk to yourself or others and I therefore need to share your personal information with a health professional, such as your GP. I will always try to discuss this with you first, unless there are safeguarding or immediate risk issues that prevent this.
Your Personal Details
I will keep a record of your personal details while you are in therapy:
Paper Records: Your name, address, date of birth, and GP details are kept securely in a locked cabinet in my consulting room. At the end of our work together, I will retain your name and address for seven years to fulfill my professional liability insurance obligations and UKCP guidelines, after which they will be securely destroyed. All other non-essential personal information will be deleted.
Emergency Contacts: I securely share your first name and email address via encrypted email with my appointed Professional Executor, so that in the unlikely event of my sudden incapacity, they are able to contact you. At the end of therapy, my executor securely deletes these details.
Phone & Email: I keep your phone number in my mobile phone under a code so that you cannot be identified. My phone is protected with a passcode. Your email address is held in my Google Workspace account, which is password-protected and secured with two-factor authentication (2FA). Neither my computer nor my phone is shared with anyone else.
Communications: Once therapy has begun, I recommend electronic communications (email/SMS) are used primarily for scheduling and administrative purposes. I will delete your phone number, email address, and message history at the end of our work together.
Session Notes
I take brief handwritten session notes to fulfill my ethical responsibilities as set out in UKCP’s ethical guidelines, and to maintain obligations to my professional liability insurer.
Notes are locked away securely in my consulting room and completely anonymised.
I do not share my notes with anyone.
Notes are retained for 7 years post-therapy to meet liability obligations, after which they are permanently deleted.
Artwork
Your artwork is kept securely in a folder in my consulting room, accessible only to me.
If you do not wish to take your artwork with you at the end of therapy, I will dispose of it securely.
I may discuss artwork with my clinical supervisor as part of my ethical professional practice required by the UKCP and HCPC. To protect your confidentiality, I use pseudonyms so that your real identity is never revealed.
3. YOUR DATA PROTECTION RIGHTS
Under UK data protection law, you have several rights regarding your personal data, including the right to:
Access your data (Subject Access Request): Request a copy of the personal information and clinical records I hold about you.
Rectification: Ask me to correct any mistakes or incomplete information I hold about you.
Erasure ("Right to be Forgotten"): Ask me to delete your personal information. (Note: I may be legally or ethically required to retain certain clinical notes for 7 years as mandated by my insurer).
Restriction or Objection: Ask me to limit or stop how I process your data in certain circumstances.
Exercising Your Rights
If you submit a formal request for your data, I will:
Provide a response and fulfill valid requests within 30 calendar days at no charge.
Provide a description of the data, why I am holding it, how long it will be stored, and who it may be disclosed to.
Provide a copy of the information in an intelligible format.
To make a request regarding any of your data, please put your request in writing to info@alexmonktherapy.com. You can read more about your rights at ico.org.uk/your-data-matters.
4. COMPLAINTS & CONCERNS
I take data protection and client confidentiality with the utmost seriousness. If you have any concerns, questions, or complaints about how I handle your personal data, I encourage you to raise them with me directly in the first instance so I can address them.
Escalating to the Supervisory Authority
If you feel I have not resolved your concern satisfactorily, or if you believe I am processing your personal data unlawfully, you have the right to lodge a formal complaint with the UK data protection supervisory body:
Body: Information Commissioner’s Office (ICO)
Website: ico.org.uk/make-a-complaint
Helpline: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
5. WEBSITE, COOKIES & THIRD PARTIES
Enquiries via Website: None of your personal clinical information is stored directly on my website. Initial details submitted via email are stored in my password-protected Google Workspace account.
Website Hosting: This website is hosted by Squarespace. You can review their privacy practices via the Squarespace Privacy Policy.
Cookies: This website uses cookies (small text files saved on your computer) to improve user experience. Cookies do not collect personal health information. You can change your browser settings at any time to disable cookies.