Woodward Therapies Privacy Notice
Last updated: 04/09/2026
This privacy notice explains how I collect, use, store and protect personal information in my therapy practice.
I am Ben Woodward, a psychotherapist providing online therapy. I am the data controller for personal information I collect through Woodward Therapies.
This means I am responsible for deciding how personal information is used and for keeping it safe.
If you have any questions about this privacy notice, or about how your information is handled, you can contact me at:
Email:Ben@woodwardtherapies.co.uk
Phone: 07570026138
Website: www.woodwardtherapies.co.uk
This privacy notice applies to people who contact me about therapy, current and former clients, and visitors to my website.
Information I Collect.
I may collect and use the following information.
When you contact me, I may collect:
· Your name
· Your email address
· Your phone number
· The information you choose to share in your enquiry
· Any preferences around contact, availability or therapy format
If we arrange an initial call or begin therapy, I may also collect:
· Your address
· Your date of birth
· Your GP details
· Emergency contact details, where appropriate
· Relevant health, mental health or wellbeing information
· Information about your personal history, relationships, work, identity, family, circumstances and reasons for seeking therapy.
· Clinical records
· Attendance, payment and appointment information
· Correspondence between us
Some of this information may be classed as special category data under UK data protection law. This includes information about health, mental health, sexuality, ethnicity, religion or other sensitive areas where these are relevant to therapy.
I aim to collect only information that is relevant and necessary for providing therapy and managing my practice safely, ethically and lawfully.
How I Use Your Information
I use your personal information to:
· Respond to enquiries
· Arrange initial calls and appointments
· Provide therapy
· Keep appropriate clinical records
· Manage payments, invoices and appointments
· Communicate with you about sessions
· Meet legal, professional and ethical responsibilities
· Manage risk, safeguarding or emergency situations where necessary
· Maintain insurance, tax and accounting records
· Respond to data protection requests or complaints
*I do not sell your personal information.
Lawful basis for using your information.
Under the UK GDPR, I must have a lawful basis under Article 6 for processing personal information. The bases I use will depend on the purpose of the processing:
· Contract (Article 6(1)(b)): where processing is necessary to take steps at your request before entering into a therapy agreement, or to provide therapy under that agreement.
· Legitimate interests (Article 6(1)(f)): where processing is necessary to run a safe and effective professional practice, maintain appropriate records, protect the security of my systems, respond to enquiries where appropriate, and protect the legitimate professional or legal interests of you or the practice. I consider the impact on your rights and interests when relying on this basis.
· Legal obligation (Article 6(1)(c)): where I must process or disclose information to comply with a legal requirement.
· Vital interests (Article 6(1)(d)): in a rare emergency where processing is necessary to protect someone’s life.
For special category data, including health an mental health information, I primarily rely on Article 9(2)(h) of the UK GDPR because processing is necessary for the provision of health care or treatment. This is supported by Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018 and by the professional duty of confidentiality that applies to my work.
Where necessary to establish, exercise or defend legal claims, I may rely on Article 9(2)(f). In a rare emergency, Article 9(2)(c) may apply where processing is necessary to protect vital interests and the person concerned is physically or legally incapable of giving consent.
Where I ask for consent for a specific activity, I will explain what I am asking for, why consent is appropriate, and how you can withdraw it. Consent is not the general legal basis for providing therapy.
Confidentiality
Therapy is confidential, but confidentiality is not absolute. I will not share what you tell me unless there is a lawful, ethical or safeguarding reason to do so, and where possible I will limit any sharing to the minimum information necessary.
There are some limits to confidentiality. I may need to share information if:
· I believe there is a serious risk of harm to you or someone else
· There is a safeguarding concern involving a child, vulnerable adult or person at risk
· I am required to do so by law, court order or legal process
· Disclosure is necessary to prevent or detect a serious crime
· There is a medical emergency and information is needed to protect life
· I need to consult my clinical supervisor, while protecting your identity as far as possible
Where possible and appropriate, I would aim to discuss this with you before sharing information. However, I may not be able to do so if this would increase risk, prejudice safeguarding action, undermine the purpose of the disclosure, or would otherwise not be possible.
Supervision
I receive regular clinical supervision to support safe and effective practice.
In supervision, I may discuss aspects of client work to support safe and effective practice. I aim to minimise identifying detail where possible and appropriate, and my supervisor is also bound by confidentiality and professional standards.
Clinical Notes and Records
I keep clinical records to support safe and ethical therapy. These are usually factual, proportionate and relevant to the work.
Clinical records may include:
· Session dates
· Brief themes discussed
· Relevant risk, safeguarding or clinical information
· Agreed actions or important decisions
· Contact and administrative information
*I do not aim to keep a full transcript of sessions.
How Long I Keep Information
I keep information only for as long as necessary for the purpose for which it was collected. Retention periods may vary depending on the type of record, the nature of the work, legal and professional requirements, and whether the work involved a child or young person. As a general guide:
· Enquiry information may be deleted if we do not begin therapy, usually within 6 months.
· Client records may be kept for 7 years after therapy ends, based on my retention policy.
· If the work involved a child or young person, a different retention period may apply.
· Financial records may be kept for the period required for tax and accounting purposes.
· Emails, messages and administrative records are reviewed periodically and deleted when no longer needed.
There may be times when I need to keep records for longer, for example where there are safeguarding, legal, insurance, complaint-related or professional-body reasons. I keep my retention periods under review and aim to make sure they remain justified and proportionate.
Where your Information is Stored
Your information may be stored in the following systems:
· Website / contact form: Squarespace
· Email:Ben@woodwardtherapies.co.uk
· Practice management or client records: WriteUpp
· Online sessions: Microsoft Teams
· Payments / invoicing: Bank transfer.
· Cloud storage or backup: Microsoft 365
· Phone / messages: 07570026138
I use appropriate technical and organisational measures to keep information secure. This may include password protection, device security, two-factor authentication, restricted access and secure storage.
Where I use external providers, they may process data on my behalf. I aim to use reputable providers with appropriate data protection and security arrangements.
Online Therapy
If we work online, sessions will take place using Microsoft Teams. I will take reasonable steps to protect confidentiality from my side, and I ask that you also choose a private space where you cannot easily be overheard or interrupted.
Online platforms may process technical information such as IP address, device information or connection data. Please also check the privacy notice of the platform we use if you would like more detail.
AI Tools, Transcription and Recording
I do not use public AI tools to process identifiable client information, and I do not use AI transcription or recording systems to process therapy sessions as part of routine practice.
If I propose using an AI tool, transcription tool or recording system in relation to therapy in the future, I will discuss this with you in advance and explain its purpose, what information it would process, relevant safeguards, any material risks or limitations, and any consent or other legal basis required before use.
Website Visitors and Cookies
When you visit www.woodwardtherapies.co.uk, technical information may be collected automatically, such as your IP address, device type, browser type, pages visited and the time of your visit. This may occur through website hosting, security, analytics or cookie tools.
The website is hosted by Squarespace. Squarespace and any enabled website tools may use cookies or similar technologies to make the site function, maintain security and, where enabled, understand website use. Where consent or another form of choice is required for non-essential cookies, the website will provide the appropriate control.
Sharing your Information
I will not share your personal information unless there is a clear reason to do so. Depending on the circumstances, I may share limited information with the following people or organisations where this is necessary, proportionate and lawful:
· My clinical supervisor
· professional advisers, such as an accountant, insurer or legal adviser
· My professional body, if required in relation to a complaint or ethical matter
· Safeguarding services, emergency services or your GP, where there is serious risk or safeguarding concern
· A court or legal authority, if required by law
· Trusted digital service providers who process data on my behalf
Where I share information, I aim to share only what is relevant and necessary for that purpose. If I or one of my providers transfers personal information outside the UK to a separate organisation, I will only do so where the law allows it and an appropriate transfer mechanism or other safeguard is in place where required.
Your Rights
Under UK data protection law, you have rights over your personal information. These may include the right to:
· Be informed about how your data is used
· Access a copy of your personal information
· Ask for inaccurate information to be corrected
· Ask for information to be deleted in some circumstances
· Restrict or object to certain processing
· Complain about how your information has been handled
Some rights are not absolute and may depend on the circumstances. For example, I may need to keep some information for legal, professional, safeguarding, insurance or complaint-related reasons, and there may be limits on what can be disclosed where information includes third-party data or where a relevant exemption applies.
If you would like to exercise your rights, please contact me using the details above. I will respond to a request about your rights within one month. If a request is particularly complex, or if I need to consider whether any restriction or exemption applies, I may need longer, in which case I will let you know.
Data Protection Concerns and Complaints
If you have a concern about how I have handled your personal information, you can make a data protection complaint by contacting me using the details in this notice. I will acknowledge your complaint within 30 days and take appropriate steps to look into it without undue delay.
Please include:
· Your name
· What your concern is about
· What you would like me to look into
· How you would prefer me to respond
I will investigate your complaint as appropriate, keep you informed where necessary, and tell you the outcome without undue delay.
If you are not satisfied with my response, or if you would prefer to contact the UK regulator directly, you can contact the Information Commissioner’s Office:
Information Commissioner’s Office
Website: www.ico.org.uk
Telephone: 0303 123 1113
Changes to This Privacy Notice
I may update this privacy notice from time to time to reflect changes in my practice, legal requirements, professional guidance or the systems I use.
The latest version will be available on my website.