Privacy and GDPR Policy

Last updated: 12 September 2026

1. Who is responsible for your information

Mill Park Therapy is the trading name of Robert Morgans Evans. I am the data controller responsible for deciding how and why your personal information is collected and used.

You can contact me at:

Email: rob@millparktherapy.co.uk
Website: www.millparktherapy.co.uk

This notice explains how I handle personal information in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018 and other applicable UK data-protection legislation.

2. Information I collect

To provide counselling and psychotherapy safely and effectively, I may collect:

  • Your name and contact details

  • Your age or date of birth

  • Information provided through enquiries, introductory conversations, intake forms and counselling contracts

  • Relevant health, mental-health, relationship and personal-history information

  • Information concerning sexuality, relationships, identity or other sensitive personal matters

  • Emergency-contact and safeguarding information

  • Brief clinical notes and attendance records

  • Relevant emails, messages and other communications

  • Appointment, invoice and payment records

  • Information relating to complaints or concerns

  • Limited technical information generated when you use this website, such as your IP address, browser information and cookie preferences

I normally receive personal information directly from you. I may also receive relevant information from your partner during couples therapy, a parent or guardian where appropriate, an emergency contact, a referrer or another professional where you have authorised this or where the law otherwise permits it.

3. Why I use your information

I use personal information to:

  • Respond to enquiries

  • Arrange introductory conversations and appointments

  • Assess whether I can offer an appropriate service

  • Enter into and manage our counselling contract

  • Provide counselling or psychotherapy

  • Communicate about appointments, cancellations and payments

  • Maintain appropriate clinical, contractual and financial records

  • Maintain the safety, security and integrity of my practice

  • Obtain confidential clinical supervision

  • Manage safeguarding concerns, complaints, insurance matters and professional responsibilities

  • Establish, exercise or defend legal claims

  • Meet applicable legal and tax obligations

  • Enable my clinical executor to contact current clients if I die or become seriously incapacitated

I do not use your information for unrelated marketing purposes or sell it to anyone.

4. Lawful bases for processing

Under UK data-protection law, I must have a lawful basis for using personal information. Depending on the purpose, I rely upon the following bases:

Contract: Where processing is necessary to respond to your request for therapy, enter into a counselling contract or provide and administer the agreed service.

Legal obligation: Where processing is necessary to comply with an obligation imposed by UK law, including applicable tax, court or safeguarding requirements.

Legitimate interests: Where processing is necessary to operate and protect a safe and professionally accountable therapy practice. These interests include maintaining appropriate records, obtaining professional advice, managing complaints or legal claims, maintaining information security and making suitable arrangements through my clinical executor. I consider these interests against your rights, interests and reasonable expectations.

Vital interests: In exceptional circumstances where processing is necessary to protect your life or another person’s life and the individual concerned is physically or legally incapable of giving consent.

You are not generally under a statutory obligation to provide personal information. However, I need certain information to assess whether I can offer therapy, enter into our counselling contract and provide the service safely. If you do not provide this information, I may be unable to offer or continue therapy.

5. Sensitive and special-category information

Information concerning physical or mental health, sexuality, racial or ethnic origin, religious or philosophical beliefs and certain other sensitive matters is described by UK data-protection law as special-category data.

For the information required to provide therapy, I rely primarily on your explicit consent under Article 9(2)(a) of the UK GDPR. This consent is obtained separately through the intake or contracting process.

Where appropriate, I may also process special-category information where this is necessary:

  • To protect someone’s vital interests when they are incapable of giving consent

  • To establish, exercise or defend a legal claim

  • For an applicable safeguarding purpose permitted by UK law

  • To provide confidential health or social-care services where the relevant legal requirements are met

You may withdraw consent where consent is the condition being used. Withdrawal does not affect processing already undertaken lawfully. It may mean that I am unable to continue providing therapy.

Withdrawal of consent does not necessarily require me to erase information that must still be retained under another lawful basis or legal condition—for example, information required for an existing legal claim, complaint, safeguarding matter or applicable legal obligation.

6. How your information is stored

Contracts and intake forms are stored locally in a dedicated folder on a password-protected MacBook with FileVault full-disk encryption enabled. This folder is not synchronised with iCloud.

Clinical notes are stored separately as local files. They are identified by a client number rather than your name. The information connecting your client number with your identity is stored separately. The clinical-notes folder is not synchronised with cloud storage.

I use appropriate measures to protect personal information, including:

  • Device encryption

  • Password protection

  • Separation and pseudonymisation of records

  • Secure software and privacy settings

  • Access controls

  • Secure disposal and deletion

  • Encrypted and access-controlled backups where backups contain client information

Access to client information is limited to what is reasonably necessary. No electronic storage or communication system can be guaranteed to be entirely risk free.

7. Email, messaging and online services

I may use email, telephone, WhatsApp, AnotherNumber, Google Meet, electronic forms, website hosting, banking, invoicing and payment services in operating my practice.

The Mill Park Therapy website is hosted by Squarespace. Other service providers may include Google, Meta/WhatsApp, AnotherNumber, my bank or invoicing provider and any secure electronic-form service identified when it is used.

These providers may process limited personal information when supplying their services. I select and configure services with confidentiality and data protection in mind and limit the information shared to what is reasonably necessary.

Internet and mobile communications cannot be guaranteed to be completely secure. Please avoid sending highly sensitive clinical information through ordinary email or messaging unless necessary.

8. International processing and transfers

Some technology providers may store or process information outside the United Kingdom.

Where personal information is transferred internationally, I take reasonable steps to ensure that an appropriate legal safeguard is in place. Depending on the provider and destination, this may include:

  • UK adequacy regulations

  • The UK International Data Transfer Agreement

  • The UK Addendum to approved standard contractual clauses

  • Another transfer mechanism permitted by UK data-protection law

Information about the safeguards used by a particular provider is available on request.

9. Artificial intelligence

I do not use artificial-intelligence systems to make clinical decisions about you or to replace my professional judgement.

I will not enter your name, contact details, contracts, intake forms, identifiable clinical notes or other identifiable personal information into a generative-AI system without first completing an appropriate risk assessment and obtaining informed consent where required.

I may use digital tools for general administrative, drafting, educational or reflective purposes where no client information is included or where information has been genuinely anonymised so that an individual cannot reasonably be identified.

Removing a name or replacing it with initials does not necessarily make information anonymous. I remain responsible for reviewing any output and for all professional and clinical decisions.

I do not use solely automated decision-making or profiling that produces legal or similarly significant effects concerning clients.

10. Confidentiality and sharing information

I do not sell your personal information.

I may share a limited amount of relevant information in the following circumstances:

Clinical supervision: I discuss my clinical work with a suitably qualified supervisor. Identifying information is normally removed or reduced to the minimum necessary. My supervisor is bound by confidentiality.

Risk and safeguarding: I may share relevant information where I reasonably believe this is necessary and proportionate to protect you, a child, an adult at risk or another person, or where I am required or permitted to do so under an applicable safeguarding obligation.

Legal requirements and claims: Information may be disclosed where I am legally required to provide it, in response to a valid court order, or where reasonably necessary to establish, exercise or defend legal rights.

Professional support: Limited information may be shared with my insurer, professional body, legal adviser or another appropriate professional where advice, support or notification is reasonably necessary.

Service providers: Providers supporting communications, video sessions, electronic forms, website hosting, invoicing, payments, banking, information security or IT may process limited information in providing those services.

I consider what information is genuinely necessary before making any disclosure and, where appropriate and safe, will discuss the proposed disclosure with you first.

11. Clinical executor

I have appointed a suitably qualified psychotherapist as my clinical executor.

If I die or become seriously incapacitated, my clinical executor may receive limited access to current clients’ contact details, appointment information and relevant practice records. This allows them to:

  • Contact current clients

  • Cancel or rearrange appointments

  • Communicate an orderly pause or closure of the practice

  • Respond to an immediate safety concern

  • Support the secure retention or disposal of records

My clinical executor is bound by confidentiality and may access only the information reasonably necessary to perform this role.

They are not automatically authorised to provide therapy or read complete clinical notes unless access is reasonably necessary for safety, legal compliance or secure records management.

12. Couples therapy

In couples therapy, the therapy record may contain information about both partners and information supplied by either person.

Each partner has rights concerning their own personal information. However, this does not automatically entitle either partner to receive personal or confidential information concerning the other person.

If either partner makes a request for access, I will consider the request carefully. Information concerning another person may be redacted or withheld where required or permitted by law.

Information disclosed privately by one partner may still affect the therapeutic work. The management of individual communications and secrets within couples therapy is also addressed in the counselling contract.

13. How long information is retained

I normally retain adult therapy records for seven years after therapy ends. This period may be reviewed according to professional guidance and the requirements of my professional indemnity insurer.

Enquiries that do not result in therapy are normally deleted within twelve months unless there is an appropriate reason to retain them for longer.

Routine appointment messages and administrative communications are deleted when no longer required unless they form part of the relevant clinical, contractual, safeguarding or financial record.

Financial and transaction records are retained for the period required by tax law.

Information may be kept for longer where reasonably necessary because of:

  • A safeguarding concern

  • A complaint or professional-conduct matter

  • An insurance requirement

  • An actual or anticipated legal claim

  • A court order or other legal obligation

When the relevant retention period ends, records are securely deleted or destroyed. Information contained in encrypted backups is removed through the normal backup-retention cycle.

14. Your data-protection rights

Depending on the circumstances and lawful basis being used, you may have the right to:

  • Request access to your personal information

  • Ask for inaccurate or incomplete information to be corrected

  • Ask for personal information to be erased

  • Request that the use of your information is restricted

  • Object to certain uses of your information

  • Receive certain information in a portable format

  • Withdraw consent where processing relies on consent

  • Raise a concern about how your information has been used

These rights are not absolute and do not apply in every circumstance. Information may sometimes need to be retained or withheld because of legal, safeguarding, insurance or professional requirements. Access may also be limited where disclosure would reveal another person’s personal or confidential information.

I may need to verify your identity before responding to a request. I will normally respond without undue delay and within one month, although the law permits an extension in certain circumstances.

15. Cookies and website information

This website uses essential cookies and similar technology required for it to operate securely and correctly.

Depending on the website features enabled and the choices you make through the cookie controls, the website may also use analytics or other optional cookies. Non-essential cookies will not be used without the consent required by law.

You can accept or reject non-essential cookies through the website’s cookie controls and can change your preferences later. Further information about the cookies used, their purposes, providers and duration is available through the website’s cookie settings or cookie policy.

The website may contain links to external websites or services. Those organisations are responsible for their own privacy practices.

16. Questions, requests and complaints

Please contact me if you:

  • Have a question about this notice

  • Want to exercise a data-protection right

  • Want to withdraw consent

  • Believe information I hold is inaccurate

  • Have concerns about how your information has been handled

Email: rob@millparktherapy.co.uk

You also have the right to complain directly to the Information Commissioner’s Office. You do not have to contact me before approaching the ICO.

Information Commissioner’s Office
Website: www.ico.org.uk
Telephone: 0303 123 1113

17. Changes to this notice

I may update this notice if my practice, technology, service providers, legal obligations or professional guidance changes.

The latest version will be published on this website with the date on which it was updated. If a change materially affects how I use existing clients’ information, I will take reasonable steps to bring it to their attention before the new use begins.

If you have any questions or concerns regarding your data or this policy,

please contact me directly at rob@millparktherapy.co.uk