POLICIES & GDPR 

Privacy Policy

Last updated: 9 July 2026

Who we are

Sarah Bosence psychotherapy is a private psychotherapy practice run by Sarah Louise Bosence. I am registered with the Information Commissioner's Office (ICO) under registration number ZB548598.

If you have any questions about how I handle your personal data, you can contact me at sarahbosencetherapy [at] gmail.com (please replace [at] with @ when emailing).

---

What personal data we collect

I collect and process the following types of personal data:

• Contact details — your name, address, telephone number, and email address
• Emergency contact details — name and contact number for someone I can reach in an emergency
• Health and therapy-related information — your presenting issues, relevant medical history, current medications, GP details, and information about your mental and emotional wellbeing
• Session notes — my professional notes about our therapy sessions together
• Contract and consent records — signed therapy agreements and consent forms
• Financial records — invoices and payment information
• Enquiry details — information you submit via the contact form on my website

Important: Health and therapy-related information is classified as "special category data" under Article 9(1) of the UK GDPR. This type of data receives enhanced legal protection because of its sensitive nature, and I take additional care to keep it secure.

---

How we collect your data

I collect your personal data directly from you:

• When you first contact me to enquire about therapy
• During our initial assessment or intake session
• Throughout our therapeutic work together
• Via email, telephone, or video call communications
• When you submit the contact form on my website

I do not collect personal data about you from other sources without your knowledge.

---

Why we process your data — lawful basis

Under UK GDPR, I must have a valid legal reason (a "lawful basis") to process your personal data. Because therapy involves health-related information, I rely on two separate legal bases:

Article 6 basis (general personal data): Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us. This means I need to process your data to provide the therapy service you have engaged me for.

Article 9 basis (special category health data): Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional. The additional condition required under the Data Protection Act 2018 is Schedule 1, Part 1, paragraph 2 (health or social care purposes). This processing is carried out by a qualified psychotherapist subject to the professional obligation of confidentiality under the BACP Ethical Framework for the Counselling Professions.

---

Professional obligations and CPD

I am required by BACP to attend regular clinical supervision as part of maintaining safe and ethical practice. I may discuss our therapeutic work with my supervisor. When I do so:

• Your name and any identifying details are not shared with my supervisor
• I use anonymised or pseudonymised case material only
• My clinical supervisor is a qualified professional bound by the same confidentiality obligations as I am
• My supervisor is bound by their own professional code of ethics and practice

I also share limited financial information (invoice data only) with an external accountant or bookkeeper for the purposes of managing my practice accounts. They do not have access to your therapy notes, health information, or any clinical details.

---

Clinical will — what happens to your records if I am unable to practise

I have appointed a Clinical Executor — a trusted fellow therapist — who will act on my behalf if I become seriously ill, incapacitated, or die unexpectedly.

If this happens, my Clinical Executor will:

• Contact you (or your emergency contact) to let you know what has happened
• Offer information about continuing therapy with another practitioner if appropriate
• Ensure all client records remain secure and confidential
• Retain records securely until the end of the applicable retention period
• Securely destroy records only after the retention period has ended

My Clinical Executor is bound by the same professional confidentiality obligations as I am and will not access the content of your records beyond what is necessary to fulfil these duties.

---

Who we share your data with

I do not sell your personal data to anyone, and I never will.

Beyond the limited sharing described above (anonymised material with my clinical supervisor; invoice data with my external accountant or bookkeeper), I use the following third-party services which may process some of your data:

• Zoom (Zoom Video Communications Inc, USA) — for online therapy sessions
• Google reCAPTCHA (Google LLC, USA) — to protect the contact form on my website from spam
• Google Maps (Google LLC, USA) — embedded map showing my practice location
• Mapbox (Mapbox Inc, USA) — embedded mapping on my website
• Vimeo (Vimeo Inc, USA) — embedded video content on my website

Each of these services operates under its own privacy policy and data processing agreements. I choose services that take data protection seriously, but I encourage you to review their privacy policies if you would like more detail.

---

International data transfers

The following third-party services I use may transfer personal data outside the United Kingdom:

• Google Maps (Google LLC, USA)
• Mapbox (Mapbox Inc, USA)
• Google reCAPTCHA (Google LLC, USA)
• Zoom (Zoom Video Communications Inc, USA)

Where data is transferred to the USA, I rely on Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs) as appropriate safeguards, in accordance with UK GDPR Chapter V and the updated requirements of the Data (Use and Access) Act 2025. The USA does not currently have a UK adequacy decision.

Details of these safeguards are set out in each provider's own privacy documentation.

---

How long we keep your data

I keep your personal data only for as long as necessary. My retention periods are:

• Therapy records (adult clients): 7 years after our last session, in line with the Limitation Act 1980 and standard professional indemnity insurance requirements
• Therapy records (clients under 18 at the time of therapy): until the client reaches the age of 25
• Financial records: 6 years, as required by HMRC
• Website enquiries (non-clients): 12 months

After the applicable retention period ends, paper records are securely destroyed and electronic records are permanently deleted.

---

Your rights under UK GDPR

You have the following rights regarding your personal data:

1. The right to be informed — to know how I collect and use your data (this privacy policy fulfils that right)

2. The right of access — to request a copy of the personal data I hold about you. Under the Data (Use and Access) Act 2025, I will conduct a reasonable and proportionate search when responding to your request.

3. The right to rectification — to ask me to correct any inaccurate or incomplete data

4. The right to erasure — to ask me to delete your data. However, this right is not absolute. I may need to retain your records until the end of the applicable retention period where required by professional guidelines, insurance obligations, or law.

5. The right to restrict processing — to ask me to limit how I use your data in certain circumstances

6. The right to data portability — to receive your data in a commonly used format so you can transfer it elsewhere

7. The right to object — to object to certain types of processing (though this is unlikely to apply to therapy records held under contract)

8. Rights related to automated decision-making — I do not use automated decision-making or profiling in my practice

To exercise any of these rights, please contact me at sarahbosencetherapy [at] gmail.com (please replace [at] with @ when emailing). I will respond within one month.

---

Data protection complaints — your right under the Data (Use and Access) Act 2025

You have the right to make a data protection complaint directly to me. I take all complaints seriously and will do my best to resolve any concerns.

To make a complaint, you can:

• Visit https://sarahbosencepsychotherapy.policydiary.co.uk and use the "Make a complaint" tab
• Email me at sarahbosencetherapy [at] gmail.com (please replace [at] with @ when emailing)

If you are not satisfied with my response, you have the right to escalate your complaint to the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Telephone: 0303 123 1113
• Address: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

---

Confidentiality exceptions

Everything you share in therapy is confidential. However, there are limited circumstances where I may need to share information without your consent:

• Risk of serious harm — if I believe you or someone else is at serious risk of harm
• Safeguarding concerns — if there are concerns about the safety of a child or vulnerable adult
• Legal requirement — if ordered to disclose information by a court of law

In these rare situations, I will always try to discuss this with you first, unless doing so would itself put someone at risk.

---

Changes to this policy

I review this privacy policy annually and whenever my practices change. If I make significant changes that affect how I handle your data, I will let you know.

You can always find the current version of this policy on my compliance page at https://sarahbosencepsychotherapy.policydiary.co.uk.