Privacy Policy

About this policy

This policy explains how I collect, use, store and protect your personal information when you contact me or work with me in therapy. I am committed to keeping your information safe and handling it in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025.

I am the data controller for the information I hold about you.

  • Name: Kate Wills, Kate Wills Psychotherapy

  • Email: kate@katewillspsychotherapy.co.uk

  • ICO registration number: ZB515447

What information I collect

I collect only the information I need to offer you therapy and run my practice.

  • When you enquire: your name, contact details and anything you choose to tell me in your message or our initial call.

  • When we work together: contact details, date of birth, GP details, emergency contact, and brief session notes.

  • Health information: information about your mental and physical health that you share with me. This is "special category" data under UK GDPR and is given extra protection.

  • Payment details: records of invoices and payments. I do not store your card or bank details.

  • Health insurance: if you use insurance, your insurer, policy or authorisation number, and the number of sessions authorised.

In relationship therapy, I may hold information about each partner. I keep this confidential in line with the agreement we make at the start of the work.

Why I can use your information (lawful basis)

UK GDPR requires a lawful basis for using personal information.

  • Enquiries and the initial call: legitimate interests, so I can respond to your enquiry (Article 6(1)(f)).

  • Contact, session and payment records: contract, to provide the therapy we have agreed (Article 6(1)(b)).

  • Health information: provision of health or social care (Article 9(2)(h), with the Data Protection Act 2018, Schedule 1).

  • Records kept after therapy ends: legal obligation and legitimate interests, to meet professional, insurance and tax requirements (Article 6(1)(c) and (f)).

How I store and protect your information

I use your information to arrange and provide therapy, keep appropriate records, take payment and, where relevant, invoice your insurer. I never sell your information or use it for marketing.

  • I keep session notes to a minimum: brief, factual and only what is needed to support our work. You are welcome to keep your own notes or reflections between sessions. They are kept separately from your contact details and do not include your full name.

  • Paper records are kept in a locked cabinet. Digital records are kept on password-protected, encrypted devices.

  • Online sessions take place on Zoom. Each session has its own invitation link, meeting ID and passcode, and I admit you to the session myself. I do not record sessions, and sessions may not be recorded by video or audio.

  • I use the following services to run my practice: Google Workspace (email), Zoom (online sessions), my mobile phone (calls and text messages), Google Calendar (appointments, recorded by first name only), Google Drive and Microsoft Word on a password-protected laptop (digital notes), my bank (payments by BACS) and Squarespace (this website and its contact form). Financial records are kept in written accounts. I ask clients not to use WhatsApp; if you choose to message me there, those messages are also held by WhatsApp. These providers are responsible for keeping the data they hold secure.

Who I share your information with

What you tell me stays confidential, with a small number of exceptions.

  • Clinical supervision: I discuss my work with my clinical supervisor, as BACP requires. I do not share your name or identifying details.

  • Health insurers: if you use insurance, I share only what your insurer needs to authorise and pay for sessions.

  • Risk of serious harm: if I believe you or someone else is at serious risk, I may need to contact your GP or another appropriate service. Wherever possible, I will discuss this with you first.

  • Legal requirements: I may be required by law to share information, for example under a court order, or in relation to terrorism or the safeguarding of children.

I will not share your information with anyone else without your written consent.

If I become unable to practise, a nominated fellow professional (my clinical executor) will contact you and make sure your records are handled confidentially and securely destroyed.

How long I keep your information

  • Enquiries that do not lead to therapy: 6 months after last contact.

  • Session notes and contact records: 7 years after therapy ends.

  • Financial records: 6 years after the end of the tax year, as HMRC requires.

After these periods, paper records are shredded and digital records are permanently deleted.

Keeping notes for 7 years covers the three years BACP allows for complaints and follows professional indemnity insurance guidance.

Your rights

You have the right to:

  • see the information I hold about you

  • ask me to correct anything that is inaccurate

  • ask me to delete your information, where I am not required to keep it

  • ask me to limit how I use your information, or object to its use

  • receive a copy of your information in a format you can take elsewhere

To make a request, email me. I will respond within one month.

If you are unhappy with how I have handled your information, you have the right to complain to me directly, in any way you choose, including by email. I will acknowledge your complaint within 30 days, look into it, keep you updated and tell you the outcome without undue delay. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

This website and email

  • Cookies: this website is hosted by Squarespace, which uses essential cookies to make the site work and, only if you agree, analytics cookies that show me in general terms how the site is used. You can change your cookie choices at any time through the cookie banner or your browser settings.

  • Email: email is not completely secure. Please keep emails brief and save personal details for our sessions. Emails and text messages are deleted once the information is no longer needed.

  • Links: this website links to other organisations. Their privacy policies apply when you visit their sites.

I may update this policy from time to time. Last updated: November 2026.