Data Protection & Privacy Notice

Introduction

Anita T. Duke, trading as Anita Duke Therapy, is the data controller for the purposes of UK data protection law (referred to in this policy as "I", "me" or "my"). I am a therapist working in a UK-registered private practice. I am committed to complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025, and to handling your personal information responsibly and securely. I process personal information for the purposes of providing counselling, psychotherapy, coaching and wellbeing services and the management of my professional practice.

This privacy notice applies to anyone who contacts me about my services, current and former clients, and visitors to my website. It explains my lawful purpose for processing your personal data, what information I collect, why I collect and use it, how long I keep it, how I protect it, and your rights under UK data protection law. If you have any questions about this notice, please contact me by email at anita@anitaduketherapy.co.uk.


What I use your information for

I hold and process the personal data you provide in accordance with the data protection principles set out in the UK GDPR. I use your personal data only for the following purposes:



  • responding to enquiries and arranging appointments
  • providing and managing therapy, coaching and wellbeing services, and maintaining appropriate clinical records
  • managing payments and other practice administration
  • meeting legal, professional, insurance and safeguarding responsibilities


What personal information I collect

I may collect and process the following categories of personal information to respond to enquiries, assess your needs, provide therapy, support safe and ethical practice, and meet my legal and professional responsibilities:


  • Enquiries and initial consultation: Your name, contact details and any information you choose to share about your circumstances, reasons for seeking therapy and preferences for contact or appointments.
  • Assessment and therapy: At the start of therapy, I may collect contact and identification details, including your address, date of birth, emergency contact, GP details, and relevant information about your health and wellbeing. During therapy, I may record further relevant information about your health, mental health, personal circumstances and wellbeing. I may use clinical assessment measures to help assess needs, monitor progress and support safe practice.
  • Clinical records: I keep brief records in accordance with my professional and insurance responsibilities. These may include signed agreements, relevant clinical correspondence, assessments, and a log of session dates, attendance, key themes, and any risk or safeguarding information, including any relevant professional decisions or actions. I also maintain a record of payments.
  • Process notes: I may keep brief process notes to support my clinical thinking and the effective and ethical provision of therapy. These may include reflective observations and conjecture. I minimise identifying information and keep these notes limited to what is necessary for my professional practice.


I aim to collect only information that is relevant and necessary for the purposes described above. My session records are pseudonymised using a coding system and stored separately from identifying information. Some of the information I process, such as health information, is special category data and is subject to additional protection under UK data protection law.
 

Lawful purpose for processing

I process personal data on a lawful basis appropriate to each purpose. I rely on contract to provide and manage therapy services; legal obligation where I am required to keep or disclose information by law; vital interests where processing is necessary in an emergency; and legitimate interests for the administration and financial management of my practice, meeting obligations to my professional body and insurer, maintaining records for tax purposes, clinical supervision, and the operation of my website including the handling of enquiries received through it. Where supervision is required by my professional body, I also rely on legal obligation. I have considered that my legitimate interests do not override your interests or rights.


Health and therapy records are special category data requiring additional protection under UK data protection law. For this information, I also rely on Article 9(2)(h) UK GDPR and Schedule 1 of the Data Protection Act 2018, which permits processing necessary for the provision of health care carried out under an obligation of professional confidentiality.
 

 Confidentiality and information sharing

I will never sell your personal information or use it for marketing purposes. I will not disclose your personal information unless you have agreed to this or there is a lawful basis for doing so, including where disclosure is necessary for the reasons outlined below. Where information needs to be shared, I will consider the circumstances carefully and limit any disclosure to the minimum information necessary.
 
Therapy is confidential, but confidentiality is not absolute. I may need to share information without your consent in the following circumstances:


  • Safeguarding: Where I have concerns about the safety or welfare of a child or adult at risk.
  • Risk of serious harm: Where I believe there is a serious risk of harm to you or another person.
  • Medical emergency: Where sharing information is necessary to protect life or prevent serious harm in an emergency.
  • Legal or statutory requirements: Where disclosure is required or authorised by law, including in response to a court order or certain statutory obligations.


The following arrangements form part of the foreseeable limits to confidentiality and privacy that I will discuss with you as part of our therapy agreement:


  • Professional supervision: I use regular clinical supervision to support safe and ethical practice. I may discuss aspects of my work with my supervisor, but I minimise identifying information wherever possible. Supervision is subject to professional confidentiality and ethical standards.
  • If I become unable to practise: If I become suddenly unable to practise, seriously incapacitated or die, I have arrangements in place for a trusted professional colleague to access limited client contact information. This is so that current clients can be contacted and records managed appropriately. Access would be limited to what is necessary for this purpose, and the colleague would be bound by appropriate confidentiality and professional standards.


How long I retain your information

I aim to keep information only for as long as necessary for the purpose for which it was collected as outlined below:



  • Enquiry information: I do not operate a managed waiting list. If I am unable to offer an appointment or we do not proceed to an initial consultation, I normally delete enquiry information after the correspondence has concluded. If an initial consultation takes place but we do not begin therapy, I normally delete the enquiry record once it has been agreed that therapy will not proceed. This will usually be within 1–6 weeks.
  • Client records: If you begin therapy, I normally retain client records for seven years after the end of therapy, taking account of my professional, insurance and legal responsibilities. After this period, records are securely deleted or destroyed.
  • Financial records: I retain financial records for the period required for tax and accounting purposes. These records may be retained separately from clinical records.


How I keep your information safe and communicate with you

I take the security and confidentiality of your information seriously and use appropriate technical and organisational measures, including password-protected devices and access controls, to prevent loss, unauthorised access, alteration or misuse.


  • Email and telephone: I use IONOS (www.ionos.co.uk) and Microsoft Outlook (www.outlook.com) for email, which is primarily for administrative communication. While I take reasonable steps to secure my systems, email is not completely secure, and I ask that you avoid including detailed or sensitive therapeutic content in emails. I use telephone and SMS for appointments and administration only. Messages are deleted when no longer needed. I do not use WhatsApp or other messaging apps for client communication.
  • Online therapy: Sessions take place via Zoom (www.zoom.com). I do not record or transcribe sessions. Zoom may process technical information such as your IP address and device details; further information is available in Zoom's privacy notice. I ask that you choose a private space where you cannot easily be overheard or interrupted.
  • Clinical records and agreements: Clinical records are primarily paper-based, kept in locked storage, and pseudonymised where appropriate. Therapy agreements and consent forms, which may be held in paper or electronic form, are stored securely and are kept separate from session notes.
  • Payments: I accept payment by bank transfer via Starling Bank (www.starlingbank.com), card payments via SumUp (www.sumup.com) or cash. Payment providers will collect and process your financial and transaction data in accordance with their independent privacy policies.
  • Cloud storage: I use Microsoft OneDrive (www.microsoft.com) for certain administrative documents, with password-protected access. I use iCloud (www.icloud.com) to back up my mobile phone, which may include email data and, before routine deletion, SMS messages and call history.


Use of AI and digital tools

I do not use AI tools to record, transcribe, process or store client records. I may use digital tools, including AI, for practice purposes such as planning, writing, research and professional development. I do not enter client-identifiable information into these tools and remain responsible for reviewing any AI-generated output.



Websites and third parties

My website (www.anitaduketherapy.co.uk) is hosted by IONOS. When you visit, some technical information may be collected automatically, such as IP address, device and browser type, pages visited and time of visit, through hosting and security tools.



  • Cookies: My website uses cookies to help the site function. You can remove or disable cookies at any time through your browser settings.
  • Contact form: Information submitted through the contact form, such as your name, email address and message, will be processed by IONOS in accordance with their data policies as part of hosting the website. I will handle any information received in accordance with this privacy notice.
  • Analytics: My website uses IONOS SiteAnalytics for statistical purposes and website optimisation. IONOS state that this tool does not use tracking cookies but automatically collects non-identifiable technical data (such as browser type, time of access, and pages visited) via server logs. Your IP address is anonymised immediately so you cannot be personally identified. In accordance with stated practice, logs are automatically deleted after 8 weeks. I do not use website analytics to identify individual visitors for marketing purposes.
  • External links: My website contains links to third-party websites, including an embedded Google Maps link, which are subject to their own privacy policies.
  • Referrals from third-party organisations: If you are referred to my practice by an agency, GP, charity or Employee Assistance Programme, that organisation is responsible for the personal information it holds. I will handle any information I receive in accordance with this privacy notice and will not share sensitive clinical information with the referring organisation without your explicit consent.


Your rights and responsibilities

By contacting me through my website, a professional directory, phone, email or any other means, you acknowledge that I will use your contact details and information to respond to your enquiry. If you choose to begin therapy, I will explain how your personal information is used as part of the therapy agreement and privacy information. I will discuss confidentiality, its foreseeable limits and how your information is handled, and agree the therapeutic arrangements with you.


You are responsible for ensuring that I have accurate and up-to-date contact and emergency information, and for notifying me of any changes while you are in therapy. Under UK GDPR, you also have the right to:


  • Request access to your personal data
  • Correct inaccurate information
  • Update your details
  • Request erasure where appropriate
  • Object to certain types of processing

 

However, these rights may be limited in the case of therapy records, particularly where disclosure could cause serious harm.


You may make a Subject Access Request (SAR) by contacting me at anita@anitaduketherapy.co.uk  using the subject line “Subject Access Request” helps me process your request promptly. I will respond to a valid Subject Access Request without undue delay and normally within one calendar month of receiving it. If I need further information to confirm your identity or clarify the scope of the request, the time period may run from when I receive the necessary information.


For complex requests, I may extend the response period by up to two further months. For requests that are manifestly unfounded or excessive, I may also charge a reasonable fee depending on the nature of the request. Where disclosure of therapy records could risk causing harm, I may seek professional guidance before responding, as permitted under the Data Protection Act 2018.


Complaints Procedure

Under the Data (Use and Access) Act 2025, I provide a procedure for you to raise a data protection complaint with me before escalating the matter to the Information Commissioner’s Office (ICO).


If you have concerns about how I have handled your personal data, please submit your complaint in writing to anita@anitaduketherapy.co.uk using the subject line “Data Use and Access Complaint.” I will acknowledge your complaint within 30 days (or the next working day if this falls on a weekend or bank holiday), and investigate and respond without undue delay.


If you remain dissatisfied, you may escalate your complaint to the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113. You may also raise concerns directly with the ICO at any stage, although they may ask whether you have attempted to resolve the matter with me first.


Changes to this policy

This Privacy Notice is reviewed annually and may also be updated between reviews to ensure it accurately reflects how and why I process your personal data. Any amendments will be published on this page. The date of the most recent update is shown below.


Anita T. Duke trading as Anita Duke Therapy is registered with the Information Commissioner’s Office

(Ref: ZA749898).



Updated: September 2026