Who I am

I am Sarah Rees, trading as Guiding Therapy. I am the data controller for the personal information described here, which means I decide how and why it is used. You can contact me at sarah@guidingtherapy.co.uk.

What information I collect

Enquiries: the name, email address and message you send through the contact form or by email.
Bookings: the name, email address and any answers you give when you book through my Google Calendar booking page.
Sessions: if you become a client, notes about my sessions with you and the information you share with me, which can include details about your health and wellbeing.
Website use: this website does not use analytics or advertising cookies, and does not track you.

Why I use it and my legal basis

To reply to your enquiry and arrange a consultation. My legal basis is taking steps at your request before a contract, and my legitimate interest in answering you.
To provide therapy and keep appropriate client records. My legal basis is performing my contract with you. Information about your health is special category data, and I use it with your explicit consent and to provide health care.
To meet legal, insurance and professional obligations. My legal basis is legal obligation and legitimate interests.

I do not sell your information, and I do not use it for marketing unless you ask me to.

Who I share it with

I do not share your information with anyone outside my practice, except in these cases:

Service providers who help me run the practice: Google (email, calendar and booking), and Netlify (which hosts this website and receives contact form messages). They process information on my behalf.
Where the law requires it, or where I believe someone is at risk of serious harm. Confidentiality has limits, and I will explain them to you before your first session.

Some of these providers may process information outside the UK. Where they do, they use recognised safeguards such as the UK's approved transfer mechanisms.

How long I keep it

Enquiries from people who do not become clients are deleted after 12 months.
Client records are kept securely for as long as my professional insurer and professional bodies require, and then deleted.

How I keep it safe

I keep records securely, limit access to myself, and use password-protected, encrypted services.

Your rights

You can ask me to give you a copy of your information, correct it, delete it, restrict how I use it, or move it to someone else. You can also object to how I use it. Email me and I will reply within one month. Some of these rights are limited where I have to keep records by law.

If you are unhappy with how I have handled your information, please tell me first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Links to other sites

This website links to Facebook, Instagram, Bluesky and Google. Those services have their own privacy policies, and I am not responsible for them.

Changes to this notice

If I change this notice I will update the date at the top of the page.

Privacy notice