Privacy Policy

Debbie Thomson Therapy

Last Updated: October 2026

1. Introduction

Debbie Thomson Therapy is committed to protecting your privacy and handling your personal information lawfully, transparently and securely.

This Privacy Policy explains how personal information is collected, used, stored and shared when you -

Enquire about services
Access psychotherapy, counselling or relationship therapy
Attend training courses, workshops or professional development events
Subscribe to the mailing list
Hire therapy rooms
Work as an Associate Therapist
Represent an organisation purchasing services such as employee wellbeing or Employee Assistance Programme (EAP) services
Visit the Debbie Thomson Therapy website

This Privacy Policy applies to psychotherapy services, relationship therapy, training, workshops, room hire, Associate Therapist relationships, Employee Wellbeing Services, mailing list subscriptions and website enquiries provided through Debbie Thomson Therapy.

Personal information is processed in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and applicable professional, legal and ethical requirements.

2. Data Controller

The Data Controller responsible for your personal information is-

Debbie Thomson Therapy
The Square, Willerby
East Yorkshire

Email - dthomsonta@outlook.com
Telephone - 07883 393590

Debbie Thomson Therapy is not required to appoint a Data Protection Officer under UK GDPR.

3. Who This Policy Applies To

This Privacy Policy applies to -

Therapy clients
Relationship therapy clients
Training delegates
Workshop attendees
Mailing list subscribers
Room hire therapists
Associate Therapists
Website visitors
Business contacts and organisations purchasing services
Individuals making enquiries about services

4. Information Collected

The information collected will depend on the services used and the nature of your relationship with Debbie Thomson Therapy.

Personal Information

This may include - :

Name
Address
Email address
Telephone number
Date of birth
Emergency contact details
Next of kin details where appropriate

Health and Therapy Information

Where psychotherapy, counselling or relationship therapy services are provided, special category data may be collected, including -

Personal history
Mental health information
Relevant physical health information
Medication information
Risk and safeguarding information
Information disclosed during therapy sessions
GP and healthcare professional details where relevant

Administrative Information

This may include -

Appointment records
Attendance records
Enquiry records
Communication records
Invoices and payment records
Signed agreements and contracts
Complaint records

Training and Workshop Information

For training courses and workshops, information may include -

Professional role
Professional registration details
Attendance records
Continuing Professional Development (CPD) records
Certificate information

Associate Therapist Information

Where individuals work with Debbie Thomson Therapy as associate therapists, information may include -

Contact details
Qualifications
Professional registrations
Professional indemnity insurance details
DBS information where required
Room rental arrangements
Financial and invoicing records

Mailing List Information

Where you subscribe to the mailing list, information may include -

Name
Email address
Marketing preferences
Professional role where voluntarily provided

Website Information

When you visit the website, information may be collected automatically, including -

IP address
Browser type
Device information
Usage data
Cookie information

Further information can be found in the website Cookie Policy.

5. How Personal Information Is Used

Personal information may be used to -

Respond to enquiries
Provide therapy services
Provide relationship therapy services
Deliver training and workshops
Manage bookings and appointments
Maintain professional records
Assess and manage risk
Meet safeguarding responsibilities
Issue invoices and receive payments
Provide certificates of attendance
Manage room hire arrangements
Manage Associate Therapist relationships
Communicate service updates
Send marketing communications where consent has been provided
Comply with legal, regulatory and insurance requirements
Investigate complaints or disputes
Improve services offered by Debbie Thomson Therapy

Information will only be used where there is a lawful basis for doing so.

6. Lawful Basis for Processing

Contract

Processing may be necessary to enter into or fulfil an agreement with you for the provision of services.

Legitimate Interests.

Processing may be necessary for the safe administration and operation of the practice, including record keeping, service management and professional support.

Legal Obligation.

Processing may be necessary to comply with legal requirements, including safeguarding obligations, taxation obligations and regulatory requirements.

Consent

Consent may be relied upon for certain activities, including marketing communications and mailing list subscriptions. Consent can be withdrawn at any time.

7. Special Category Data

As a psychotherapy practice, Debbie Thomson Therapy processes special category health data.

This information is processed under one or more of the following conditions under Article 9 UK GDPR

Article 9(2)(h)

Processing necessary for the provision of health or social care.

Article 9(2)(f)

Processing necessary for the establishment, exercise or defence of legal claims.

Article 9(2)(g)

Processing necessary for reasons of substantial public interest, including safeguarding where appropriate.

8. Confidentiality

Information disclosed through therapy and supervision services is treated confidentially.

However, confidentiality may be limited where -

There is serious concern about harm to yourself.
There is serious concern about harm to another person.
There are safeguarding concerns relating to a child or vulnerable adult.
Disclosure is required by law.
Disclosure is required by a court order.
Disclosure is necessary for the establishment, exercise or defence of legal claims.
Disclosure is necessary for regulatory, insurance or professional requirements.

Where appropriate and safe to do so, efforts will be made to discuss proposed disclosures with you beforehand.

9. Clinical Supervision

As part of maintaining professional standards, Debbie Thomson Therapy attends regular clinical supervision. Client work may be discussed within supervision to support ethical, safe and effective practice.

Identifying information is minimised wherever reasonably possible, and supervisors are subject to professional confidentiality obligations.

10. Who Information May Be Shared With

Personal information may be shared where appropriate and lawful with -

Clinical supervisors
Associate Therapists
Healthcare professionals involved in your care
Accountants and bookkeepers
Legal advisers
Professional indemnity insurers
Professional membership and regulatory bodies where required
Safeguarding agencies
Law enforcement agencies where legally required
Courts where legally required

Debbie Thomson Therapy also uses trusted third-party providers to support the operation of the practice, including -

Microsoft 365 for email communications and secure storage of practice information and records
Google Drive for the secure sharing of resources and information with clients where appropriate
Wix for website hosting, website enquiries and website functionality
Brevo for managing mailing list subscriptions and sending marketing communications to individuals who have provided consent

These organisations act as data processors or independent controllers, depending on the service provided, and have their own privacy and security measures in place.

Information is shared only where necessary, proportionate and supported by an appropriate lawful basis.

11. Associate Therapists

Debbie Thomson Therapy may engage self-employed Associate Therapists to provide services.

Where an Associate Therapist is delivering a service, relevant information may be shared to support the safe and effective management of that service.

Associate Therapists are responsible for meeting their own professional, ethical and data protection obligations. Where Associate Therapists collect personal information directly from clients, they may act as independent Data Controllers for that information.

12. Training Courses and Workshops

Information collected in relation to training, workshops and professional development events may be used to -

Process registrations
Confirm attendance
Provide joining instructions
Issue certificates
Provide learning materials and resources
Maintain attendance records
Meet legal and accounting obligations

Training delegates may receive service communications relating to the training or event they have booked.

Future marketing communications about new training opportunities will only be sent where consent has been provided or another lawful basis applies.

13. Mailing Lists and Marketing Communications

If you subscribe to the Debbie Thomson Therapy mailing list, your information will be managed through Brevo, an email marketing platform.

Information collected may include -

Name
Email address
Marketing preferences
Professional role where voluntarily provided

Marketing communications may include -

Training announcements
Professional development opportunities
Workshop information
New services
Resources and practice updates
Information about future training programmes and events

Marketing emails will only be sent where you have actively provided your consent.

You may withdraw your consent and unsubscribe at any time by -

Using the unsubscribe link included within marketing emails
Contacting Debbie Thomson Therapy directly

Unsubscribing from marketing communications will not affect any service-related communications necessary to administer therapy, supervision, room hire, training or other booked services.

14. International Data Transfers

Debbie Thomson Therapy uses a number of third-party providers, including Microsoft 365, Google Drive, Wix and Brevo.

Some of these providers may store or process personal information outside the United Kingdom.

Where international transfers occur, Debbie Thomson Therapy will ensure that appropriate safeguards are in place in accordance with UK GDPR requirements. These may include -

UK International Data Transfer Agreements (IDTAs)
UK Addendums to approved Standard Contractual Clauses
Adequacy Regulations approved by the UK Government
Other lawful transfer mechanisms recognised under UK GDPR

Further information about these safeguards is available on request.

15. Data Security

Appropriate technical and organisational measures are used to help protect personal information, including -

Password-protected systems
Secure cloud-based services
Restricted access to information
Multi-factor authentication where available
Secure disposal procedures
Device security measures

While every effort is made to protect information, no system can be guaranteed to be completely secure.

16. Retention of Information

Personal information is retained only for as long as necessary to fulfil the purposes for which it was collected and to meet legal, regulatory, ethical and insurance requirements.

Therapy Records

Adult client records are generally retained for a minimum of seven years following the end of therapy.

Children and Young People

Records relating to children and young people are generally retained until the individual's twenty-fifth birthday, or twenty-sixth birthday where therapy ended at age seventeen.

Supervision, Training and Business Records

Records relating to supervision, workshops, training, room hire and business relationships are retained for as long as reasonably necessary to meet professional, contractual, legal and accounting requirements.

Financial Records

Financial records are retained in accordance with HMRC requirements.

Marketing Information

Mailing list information is retained until an individual unsubscribes, withdraws consent or requests deletion, unless there is a lawful reason to retain it.

At the end of the relevant retention period, information will be securely deleted or destroyed.

17. Your Rights

Under UK GDPR, you have rights that may include - :

The right to access your personal information
The right to request correction of inaccurate information
The right to request restriction of processing
The right to object to processing
The right to request erasure in certain circumstances
The right to withdraw consent where consent is relied upon
The right to request transfer of data where applicable
Rights relating to automated decision-making and profiling

Some rights may be limited by legal, ethical or professional obligations.

18. Subject Access Requests

You have the right to request a copy of the personal information held about you.

Requests should be made using the contact details provided in this policy.

In most cases, a response will be provided within one calendar month of receiving the request.

19. Providing Information

Certain information is required in order for services to be provided safely and effectively.

If sufficient information is not provided, Debbie Thomson Therapy may be unable to offer or continue services.

20. Automated Decision-Making

Debbie Thomson Therapy does not use automated decision-making or profiling when making decisions about individuals.

21. Personal Data Breaches

Procedures are in place to identify, investigate and manage personal data breaches.

Where required by law, relevant breaches will be reported to the Information Commissioner's Office and affected individuals.

22. Complaints

If you have concerns about how your personal information has been handled, please contact Debbie Thomson Therapy in the first instance.

You also have the right to make a complaint to -

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

Website: https://ico.org.uk

23. Changes to This Privacy Policy

This Privacy Policy may be reviewed and updated from time to time to reflect changes in services, legal requirements or professional guidance.

The most recent version will always be available on the Debbie Thomson Therapy website and available upon request.