Privacy Policy
Important Information and Who We Are
The Data Controller is Regal Private Therapy Practice, registered in England and Wales under company number 16179937. Our registered office and correspondence address is: 4 Devonshire Street, Marylebone, London, W1W 5DT.
If you have any questions about this Privacy Policy or how we handle your personal data, please email us at info@regalprivatetherapypractice.co.uk
This Privacy Policy explains how we collect and use your Personal Data and is provided in accordance with our obligations under applicable privacy and data protection law in the UK, including the Data Protection Act 2018 and the UK General Data Protection Regulation ("UK GDPR").
Definitions
For the purposes of this Privacy Policy:
"Personal Data" means any information which identifies you, or which allows you to be identified when combined with other information.
"Special Category Data" means data that requires additional protection because of its sensitivity. This includes health information and medical data.
Personal Data and Special Category Data do not include data where your identity has been removed ("Anonymised Data").
Information We Collect and How
Information you provide directly
We collect information when you provide it to us directly, such as via email, telephone, or our website contact form. This may include your name, address, date of birth, email address, and telephone number.
When you register as a client, we will also collect:
Contact details for your next of kin, to be used only in an emergency and only where you have expressly given permission in your Terms and Conditions Agreement
Contact details for anyone medically responsible for you, such as your GP, referring psychiatrist, or medical consultant
Health and medical information relevant to your treatment
Information we receive from third parties
In the course of providing our services, we may receive Personal Data from third parties with whom we have agreements in place. These include clinical notes, assessments, and referral information from other healthcare providers.
How and Why We Use Your Personal Data
We will collect and use your Personal Data in order to provide the therapy and clinical services you have requested.
Legal bases for processing Personal Data
The legal bases we rely upon to process your Personal Data include:
Contract — where processing is necessary to deliver the services you have engaged us to provide
Legal obligation — where we are required to process or retain your data to comply with applicable law or professional regulatory requirements
Consent — where you have given us your explicit consent to process your data for a specific purpose
Legitimate interests — where processing is necessary for our legitimate interests, including administering, protecting, and improving our services and website (including troubleshooting, data analysis, fraud prevention, and hosting), provided those interests are not overridden by your rights
Legal bases for processing Special Category Data
Because therapy records constitute health data, they are classified as Special Category Data under UK GDPR. The legal bases upon which we process this data include:
Article 9(2)(a) — your explicit consent
Article 9(2)(h) — processing necessary for the purposes of preventive medicine, medical diagnosis, and the provision of healthcare and treatment
We will only use your Personal Data for the purposes for which it was collected, unless we reasonably consider that we need to use it for another reason compatible with the original purpose. If we need to use your Personal Data for an unrelated purpose, we will notify you and explain the legal basis for doing so.
Who We Share Your Personal Data With
Our service providers
In order to provide our services, we may share your Personal Data with third-party providers who perform functions on our behalf. These may include:
Clinical records and practice management software providers — your contact details, assessment information, and session notes are stored on WriteUpp, a GDPR-compliant clinical records platform. Your data is held securely on their cloud servers. A Data Processing Agreement is in place with WriteUpp, who act as a data processor on our behalf.
Our accountant, who may access your name and payment details only — and no clinical information — for the purposes of preparing and filing tax returns. A Data Processing Agreement is in place with our accountant.
IT service providers and system administrators
Professional advisers including lawyers, accountants, and auditors
Clinical supervision
As part of safe and reflective practice, we engage in regular clinical supervision. We may discuss client work with our supervisor; however, no names or identifying details are ever shared in this context.
Therapeutic executor
A trusted colleague is named as a therapeutic executor. In the event that your therapist passes away or becomes incapacitated, this person will contact you to advise you and help arrange appropriate follow-on care. The therapeutic executor will only access your data in this circumstance and for this purpose. You will be informed of this arrangement as part of your Terms and Conditions Agreement.
Shared reception
Some of our clinics use a shared reception service. The reception team may be given your first name and appointment time to facilitate your arrival. No further information is shared with them, and this information is deleted at the end of each relevant day.
When required by law
We may share Personal Data where we are under a legal obligation to do so, or to protect the rights, property, or safety of our business, our clients, or others.
To enforce legal rights
We may also share Personal Data where disclosure is required in legal proceedings, to protect our legal rights, to enforce our agreements with you, or to investigate or prevent illegal activity or suspected fraud.
Confidentiality and When We May Disclose Without Your Consent
There are limited legal and ethical circumstances in which we may be required to share information without your consent. These include:
Your safety:
You have become incapacitated and are unable to communicate consent in a situation of extreme distress or physical danger, and we need to get you help
You have given us reason to believe you intend to take your life or seriously injure yourself
Public interest:
Disclosure of information relating to child abuse
Risk of serious injury or harm to another person
An act of terrorism, serious crime, or miscarriage of justice
If we are subpoenaed by a court of law
Where possible, we will inform you of any such disclosure in advance and will share only the information that is strictly relevant.
Data Security
We have appropriate security measures in place to prevent your Personal Data from being accidentally lost, used, accessed without authorisation, altered, or disclosed. We use encryption to store your Personal Data securely.
Access to your Personal Data is limited to those with a legitimate business need to know. We have procedures in place to respond to any suspected data breach and will notify you and any applicable regulator where we are legally required to do so.
Data Retention
We retain client records for 7 years from the end of treatment, in line with professional guidance from the HCPC and BPS. We will retain your Personal Data for as long as necessary to fulfil our contractual and legal obligations, resolve disputes, comply with insurance requirements, and enforce our agreements and policies.
Your Rights
Right to withdraw consent
Where we rely on your consent to process your Personal Data, you have the right to withdraw that consent at any time by contacting us using the details below. Withdrawal of consent will not affect the lawfulness of any processing carried out prior to withdrawal, nor any ongoing obligations requiring us to process your data — for example, pursuant to a legal or regulatory requirement.
Right of access
You have the right to make a Subject Access Request (SAR) to access the Personal Data we hold about you. We will respond within one month. In complex cases, this may be extended by a further two months, and you will be notified if this applies. There is no charge for making a request.
Other rights
You also have the following rights in relation to your Personal Data:
Right to be informed — the right to be informed about how your Personal Data is collected and used
Right to rectification — the right to have inaccurate or incomplete Personal Data corrected
Right to erasure — the right to request deletion of your Personal Data in certain circumstances, subject to our legal and professional retention obligations
Right to restrict processing — the right to request that we limit how we use your Personal Data in certain circumstances
Right to data portability — the right to request that your Personal Data be transferred to another organisation or provided directly to you
Right to object — the right to object to certain types of processing, including direct marketing
If we are unable to fulfil a request to exercise your rights, we will provide you with a reason. You have the right to complain to the UK Information Commissioner’s Office (ICO) at any time:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113 Website: ico.org.uk
Cookie Policy
Cookies are small files of letters and numbers downloaded onto your device when you visit a website. We use cookies to improve your experience on our site.
Essential cookies — required for the operation of our website and do not require your consent
Performance cookies — allow us to recognise and count visitors and understand how they navigate our site, helping us to improve its functionality
Functionality cookies — allow us to recognise you when you return to our site, personalise content, and remember your preferences
When you first visit our website, you will be asked to accept or decline non-essential cookies. If you decline, only a single cookie will be stored to remember your preference. You can also manage cookie settings within your browser at any time, though blocking certain cookies may affect your ability to use some areas of the site.
Changes to This Privacy Policy
This Privacy Policy may be updated from time to time to reflect changes in how we process Personal Data or to comply with changes in applicable law. The current version will always be available on our website.
Contact Information
Regal Private Therapy Practice
4 Devonshire Street
Marylebone
London
W1W 5DT