Therapy with Victoria  - Customer Privacy Notice

This privacy notice tells you what to expect me to do with your personal

information.

 Contact details

 What information I collect, use, and why

 Lawful bases and data protection rights

 Where I get personal information from

 How long I keep information

 Who I share information with

 How to complain

Contact details

Email: psychotherapy.victoria@gmail.com

​

What information I collect, use, and why

I collect or use the following information to provide patient care and

services:

 Name, address and contact details

 Gender

 Pronoun preferences

 Date of birth

 Next of Kin details including any support networks

 Emergency contact details

 Health information (including medical conditions, allergies, medical

requirements and medical history)

 Information about care needs (including disabilities, home conditions,

medication and dietary requirements and general care provisions)

 Test results (including psychological evaluations, scans, bloods, x-rays,

tissue tests and genetic tests)

 Payment details (including card or bank information for transfers and

direct debits)

 Insurance policy details

 Records of meetings and decisions

 Call recordings

 GP Address

 

13 October 2025 

I also collect the following special category information to provide patient

care and services. This information is subject to additional protection due

to its sensitive nature:

 Racial or ethnic origin

 Religious or philosophical beliefs

 Health information

 Sexual orientation information

I collect or use the following information for safeguarding or public

protection reasons:

 Name, address and contact details

 Emergency contact details

 Health information (including medical conditions, allergies, medical

requirements and medical history)

 Information about care needs (including disabilities, home conditions,

dietary requirements and general care provisions)

 Records of meetings and decisions

I also collect the following special category information for safeguarding or

public protection reasons. This information is subject to additional

protection due to its sensitive nature:

 Racial or ethnic origin

 Religious or philosophical beliefs

 Health information

 Sexual orientation information

​

I collect or use the following personal information to comply with legal

requirements:

 Name

 Contact information

 Any other personal information required to comply with legal obligations

 Insurance details

 Safeguarding information

I also collect the following special category information to comply with

legal requirements. This information is subject to additional protection due

to its sensitive nature:

 Health information

 

13 October 2025 

I collect or use the following personal information for information updates,

marketing or market research purposes:

 Names and contact details

 Addresses

 Marketing preferences

 Personal information used for administration of the research

 Personal information used for the purpose of research

 Records of consent, where appropriate

​

I collect or use the following personal information for dealing with queries,

complaints or claims:

 Names and contact details

 Addresses

 Payment details

 Customer or client accounts and records

 Financial transaction information

 Information relating to health and safety (including incident

investigation details and reports and accident book records)

 Correspondence

 

Lawful bases and data protection rights

 

Under UK data protection law, I must have a “lawful basis” for collecting

and using your personal information. There is a list of possible lawful

bases in the UK GDPR. You can find out more about lawful bases on the

ICO’s website.

Which lawful basis I rely on may affect your data protection rights which

are set out in brief below. You can find out more about your data

protection rights and the exemptions which may apply on the ICO’s

website:

 

 Your right of access - You have the right to ask me for copies of

your personal information. You can request other information such

as details about where I get personal information from and who I

share personal information with. There are some exemptions which

 

13 October 2025 4

means you may not receive all the information you ask for. Read

more about the right of access.

 Your right to rectification - You have the right to ask me to

correct or delete personal information you think is inaccurate or

incomplete. Read more about the right to rectification.

 Your right to erasure - You have the right to ask me to delete

your personal information. Read more about the right to erasure.

 Your right to restriction of processing - You have the right to

ask me to limit how can use your personal information. Read more

about the right to restriction of processing.

 Your right to object to processing - You have the right to object

to the processing of your personal data. Read more about the right

to object to processing.

 Your right to data portability - You have the right to ask that I

transfer the personal information you gave me to another

organisation, or to you. Read more about the right to data

portability.

 Your right to withdraw consent – When I use consent as our

lawful basis you have the right to withdraw your consent at any

time. Read more about the right to withdraw consent.

 

If you make a request, I must respond to you without undue delay and

in any event within one month.

To make a data protection rights request, please contact me using the

contact details at the top of this privacy notice.

 

My lawful bases for the collection and use of your data

My lawful bases for collecting or using personal information to provide

patient care and services are:

 Consent - I have permission from you after I gave you all the relevant

information. All of your data protection rights may apply, except the

right to object. To be clear, you do have the right to withdraw your

consent at any time.

 Contract – I have to collect or use the information so I can enter into or

carry out a therapeutic services contract with you. All of your data

protection rights may apply except the right to object.

 Legitimate interests – I’m collecting or using your information because

it benefits you, my organisation or someone else, without causing an

 

13 October 2025 5

undue risk of harm to anyone. All of your data protection rights may

apply, except the right to portability. Our legitimate interests are:

 Personal data is collected in order to tailor my therapeutic services

to the individuals’ needs and specific requirements.

 

For more information on my use of legitimate interests as a lawful basis you

can contact me using the contact details set out above.

My lawful bases for collecting or using personal information for

safeguarding or public protection reasons are:

 Consent - I have permission from you after I gave you all the relevant

information. All of your data protection rights may apply, except the

right to object. To be clear, you do have the right to withdraw your

consent at any time.

 Legal obligation – I have to collect or use your information so I can

comply with the law. All of your data protection rights may apply,

except the right to erasure, the right to object and the right to data

portability.

 Vital interests – collecting or using the information is needed when

someone’s physical or mental health or wellbeing is at urgent or serious

risk. This includes an urgent need for life sustaining food, water,

clothing or shelter. All of your data protection rights may apply, except

the right to object and the right to portability.

My lawful bases for collecting or using personal information to comply with

legal requirements are:

 Legal obligation – I have to collect or use your information so I can

comply with the law. All of your data protection rights may apply,

except the right to erasure, the right to object and the right to data

portability.

My lawful bases for collecting or using personal information for information

updates, marketing or market research purposes are:

 Consent - I have permission from you after I gave you all the relevant

information. All of your data protection rights may apply, except the

right to object. To be clear, you do have the right to withdraw your

consent at any time.

My lawful bases for collecting or using personal information for dealing with

queries, complaints or claims are:

 

13 October 2025 6

 Consent - I have permission from you after I gave you all the relevant

information. All of your data protection rights may apply, except the

right to object. To be clear, you do have the right to withdraw your

consent at any time.

 Contract – I have to collect or use the information so I can enter into or

carry out a contract with you. All of your data protection rights may

apply except the right to object.

Where I get personal information from

 You;

 Referral; and

 Where relevant, family members or carers

How long I keep information

I retain personal data only for as long as necessary to fulfil the purposes for

which it was collected, including to meet legal, regulatory, tax, accounting, or

reporting requirements, and to establish, exercise, or defend legal claims. In

line with my internal retention policy and the GDPR storage limitation

principle, I generally retain personal data for up to six (6) years from the

date of our last interaction with you, unless a longer retention period is

required or permitted by applicable law.

Who I share information with:

Emergency services and local authorities only if appliable as outlined

above.

Others I may share personal information with

 Professional advisors

Duty of confidentiality

I am subject to a common law duty of confidentiality. However, there are

circumstances where I will share relevant health and social care information.

These are where:

 you’ve provided me with your consent (I have taken it as implied to

provide you with care, or you have given it explicitly for other uses);

 I have a legal requirement (including court orders) to collect, share or

use the data;

 

13 October 2025 7

 on a case-by-case basis, the public interest to collect, share and use the

data overrides the public interest served by protecting the duty of

confidentiality (for example sharing information with the police to

support the detection or prevention of serious crime);

 If in England or Wales – the requirements of The Health Service

(Control of Patient Information) Regulations 2002 are satisfied;

How to complain

If you have any concerns about my use of your personal data, you can make

a complaint to me using the contact details at the top of this privacy notice.

If you remain unhappy with how I’ve used your data after raising a complaint

with me, you can also complain to the ICO.

​

The ICO’s address:           

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint