Privacy Policy
Privacy Policy
EK Psychotherapies Ltd
At EK Psychotherapies Ltd, we are committed to protecting your privacy and handling your personal data lawfully, fairly, and transparently. This policy explains what information we collect, why, how we protect it, and what rights you have.
1. Who We Are
EK Psychotherapies Ltd provides mental health services, including therapy, workshops, neurodiversity assessments, and clinical supervision.
For the purposes of UK data protection law, EK Psychotherapies Ltd is the Data Controller for the personal data we process.
Contact details:
EK Psychotherapies Ltd
The Temple, Hesslewood Office Park, Ferriby Road, Hessle, United Kingdom, HU13 0LH
We are registered with the Information Commissioner's Office (ICO), registration reference ZB121783. You can view our register entry at ico.org.uk.
2. What Information We Collect
- Contact information — name, email address, phone number, Date of birth, postal address.
- Health and clinical information — information shared during assessment, therapy, or supervision, including mental health history, GP details, session notes, and assessment outcomes. This is "special category data" under UK GDPR and receives extra legal protection (see Section 4).
- Payment information — billing name, invoice details, and payment records. We do not store full card numbers; payments are handled by our payment processors (see Section 6).
-Session recordings (ADHD & Autism assessments) — ADHD and Autism (ASD) assessment sessions are recorded using NovoNote, our secure clinical platform, to support accurate scoring, clinical review, and report preparation. Recording is a required part of this assessment process; more detail is set out in Section 4 and Section 7 below.
- Other information you provide directly, such as through enquiry forms, workshop bookings, or correspondence.
- Website usage data, such as cookies (see Section 10).
3. How We Use Your Information
We use personal data to:
- Provide therapy, assessment, workshop, and supervision services.
- Communicate about appointments, invoices, and service updates.
- Take and reconcile payments.
- Maintain clinical records as required by professional bodies and law.
- Meet safeguarding and legal obligations.
- Improve our services, using anonymised or aggregated data where possible.
We do not use your data for automated decision-making or profiling.
4. Our Lawful Basis for Processing
For general personal data, we rely on:
- Contract — to provide the services you've booked.
- Legal obligation — to comply with professional, tax, and regulatory requirements.
- Consent — for optional communications, such as newsletters (you can withdraw this at any time).
- Legitimate interests — for administrative purposes like service improvement, where this doesn't override your rights.
For health and clinical (special category) data, general "legitimate interest" is not sufficient on its own. We rely on:
- Explicit consent you give at the start of therapy or assessment, and
- Provision of health or social care treatment by a health professional under a duty of confidentiality (UK GDPR Article 9(2)(h), Data Protection Act 2018 Schedule 1).
You may withdraw consent for optional aspects of processing at any time, though this does not affect the lawfulness of anything already done, and some processing (e.g. maintaining a clinical record) may continue to be required by our professional obligations even after consent is withdrawn.
Recording of ADHD and Autism assessment sessions is a required part of how we deliver this specific service — it is not optional, as it supports the clinical accuracy of the assessment and report. Because recording is a condition of providing the assessment itself, our lawful basis for this specific processing is performance of a contract (i.e. delivering the assessment service you've requested), together with the health/social care treatment condition described above. We will still ask you to explicitly agree to recording before your assessment begins, as a matter of good clinical practice and transparency, and we will explain that we are unable to carry out the assessment without it.
5. How We Protect Your Information
- Clinical records and personal data are stored securely, using encrypted electronic systems and/or locked physical storage.
- Access is limited to staff and practitioners directly involved in your care, or administrative staff who need it to manage bookings and payments.
- We use reputable, GDPR-compliant third-party platforms for booking and payment processing.
- We review our data protection practices regularly and provide relevant training to staff.
6. Sharing Your Information
We do not sell your data or share it for third-party marketing. We may share information:
- With your consent — for example, referrals to another healthcare provider, GP, or specialist.
- To meet legal or safeguarding obligations — for example, where there is a risk of serious harm, or in response to a court order.
- With service providers (data processors) who handle data on our behalf, under contract, including:
- Payment processors (Stripe) for card and online payments. These providers may process data outside the UK; where they do, they maintain their own UK/EU-approved safeguards (such as Standard Contractual Clauses). We recommend reviewing their own privacy policies for details.
- Barclays Bank, where you pay by BACS transfer directly into our business account. Barclays processes this as part of standard UK banking and is itself a separate data controller for that transaction.
- NovoNote (NovoPsych), our secure clinical transcription and recording platform, used for note-taking support in therapy sessions and for recording ADHD/Autism assessment sessions. NovoNote applies automated redaction to identifiable information processed by its underlying AI systems, and does not use client data to train third-party AI models.
- IT, hosting, or practice-management providers who support our systems, bound by data processing agreements.
We do not share clinical notes with any third party without your consent, except where required by law or in a genuine risk/safeguarding emergency.
7. Data Retention
We keep personal data only as long as necessary for the purposes set out in this policy, or as required by law and professional guidance.
- Clinical records are retained for a minimum of 7 years from the end of treatment for adults, in line with professional body guidance (this may be longer for records relating to a child or young person, or where otherwise required by insurers or regulators).
- Payment and invoicing records are retained as required for tax and accounting purposes (typically 6 years).
- Contact and enquiry data for people who do not become clients is deleted or anonymised after a reasonable period if no service is provided.
After the relevant retention period, data is securely deleted or destroyed.
8. Your Rights
Under UK GDPR, you have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate or incomplete data.
- Erasure — ask us to delete data where we're not legally required to keep it.
- Restriction — ask us to limit how we use your data in certain circumstances.
- Objection — object to processing based on legitimate interests or for direct marketing.
- Portability — receive data you've provided to us in a portable format, where technically feasible.
- Withdraw consent at any time, where consent is our legal basis for processing.
To exercise any of these rights, contact us at hello@ekpsychotherapies.com. We will respond within one month, as required by law.
If you're not satisfied with how we've handled your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
9. International Transfers
Where any of our service providers (such as payment processors) store or process data outside the UK, we ensure appropriate safeguards are in place, such as the UK's International Data Transfer Agreement or equivalent adequacy protections.
10. Cookies and Website Data
Our website may use cookies to support core functionality and, where applicable, analytics. You can manage or disable cookies through your browser settings.
11. Third-Party Links
Our website may link to third-party websites. We are not responsible for their content or privacy practices, and we encourage you to review their own policies.
12. Changes to This Policy
We may update this policy from time to time to reflect changes in our practices, services, or legal requirements. The effective date at the top of this page shows when it was last updated.
Questions about this policy or your data?
Contact us at hello@ekpsychotherapies.com or write to us at the address above.