Privacy Policy

Last Updated: 23.10.26

Who I Am

Saskia Wills Therapy provides Cognitive Behavioural Therapy (CBT) services for adults in Guildford, Farnham, Godalming and online across the UK.

I am committed to protecting your privacy and handling your personal information responsibly in accordance with UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For the purposes of data protection law, Saskia Wills Therapy is the data controller of the personal information I collect and process in connection with my independent therapy services and this website.

Where therapy is provided through The Eaves, The Eaves may also process personal information in its capacity as a separate data controller for information it collects and processes for its own purposes, such as managing its services, premises and client relationships. The Eaves has its own privacy arrangements which apply to information it processes as a data controller.

Where information is processed by me for the purpose of providing your therapy, Saskia Wills Therapy remains responsible for that processing.

What Information I Collect:

I may collect and process the following personal information:

Name
Email address
Telephone number
Information submitted through the website contact form
Information provided during enquiries about therapy services
Information required to arrange and provide therapy services
Appointment and payment information
Clinical information relevant to the provision of therapy
Messages and documents exchanged with clients through third-party therapy platforms
Relevant consultation requests and booking information held by these platforms

Where therapy services are provided, I may also collect special category data, including information relating to physical or mental health, where necessary for therapeutic purposes.

How Your Information Is Used

Your information may be used to:

Respond to enquiries
Arrange consultations and appointments
Provide therapy services
Maintain clinical records
Communicate regarding appointments and services
Process payments
Manage questionnaires and outcome measures
Meet legal, ethical, insurance and professional obligations

I will only collect and use information that is relevant and necessary for these purposes.

Lawful Bases for Processing Your Information

I process personal information in accordance with UK data protection law. The lawful basis depends on the purpose for which the information is used.

Depending on the circumstances, I may rely on the following lawful bases under UK GDPR:

Contract or steps taken before entering into a contract: where necessary to respond to requests for therapy, arrange appointments and provide agreed services.
Legal obligation: where I need to process information to comply with applicable legal requirements, including relevant tax and accounting obligations.
Legitimate interests: where necessary for the legitimate interests of my therapy practice, such as administering my services, maintaining appropriate records and establishing, exercising or defending legal claims, provided these interests are not overridden by your rights and interests.

Where I process information about your physical or mental health, I also need an additional condition under Article 9 UK GDPR. For information necessary to provide or manage therapy, this may be the health or social care condition under Article 9(2)(h), where the applicable legal requirements and professional-confidentiality safeguards are met.

I consider the appropriate lawful basis and condition for each purpose of processing and only use information where the relevant legal requirements are satisfied.

Website Contact Forms

When you contact me through this website, the information you provide will be used to respond to your enquiry and discuss therapy services.

Please do not include detailed medical or highly sensitive personal information when making an initial enquiry through the website contact form.

Email Communication

General website and business enquiries may be managed through Google Workspace email services.

I do not routinely use email to exchange sensitive clinical documents. Where a document needs to be shared electronically, I use the relevant document-sharing facilities within My Therapy Suite or Attune, as appropriate, or arrange for the document to be provided in person.

Messages and documents relating to therapy may be exchanged and stored through Attune, as described in the Attune Platform section of this policy. Documents and clinical information may also be held in My Therapy Suite or in my own clinical records, where necessary.

Practice Management System

I use My Therapy Suite as a secure practice management system to support the administration and delivery of therapy services.

Depending on the services used, information held within My Therapy Suite may include contact details, appointment information, clinical records, questionnaires, outcome measures, payment information and other information necessary to provide and manage therapy services.

My Therapy Suite processes personal information on my behalf in accordance with its own terms and privacy arrangements. I remain responsible for determining how and why your personal information is processed for the purposes of my therapy practice.

Attune platform

I use Attune to facilitate communication with clients and the exchange of therapy-related information. This may include messages, consultation requests, booking information and documents or attachments shared in connection with therapy.

For client information processed on my behalf through Attune, I am the data controller and Attune acts as a data processor. Attune also processes certain information in its own capacity as a data controller for its platform-related purposes.

Attune states that messages and shared documents are encrypted at rest and that client data is hosted in the UK or European Economic Area (EEA). Certain service providers may process information outside these regions, subject to applicable data transfer safeguards.

Attune states that it retains client messages, booking information and consultation requests for seven years after the last booked session or last activity on the client's account. This is separate from the retention of my own clinical records.

For further information, please refer to Attune's Privacy Policy and Data Processing Agreement.

Online Therapy Sessions

Online therapy sessions are normally conducted using the video call facility within My Therapy Suite, my practice management system.

Where necessary, Google Meet may be used as a backup option. Google Meet is provided through my Google Workspace account and operates under Google's own privacy and security policies.

The use of online therapy involves third-party technology providers facilitating communication between therapist and client. Personal information processed through these services will be handled in accordance with applicable data protection requirements and the providers' relevant privacy and security arrangements.

No online communication system can be guaranteed to be completely secure, although reasonable technical and organisational measures are used to protect personal information.

Clinical Records and Retention

I maintain clinical records where necessary for the provision of therapy, including relevant assessment information, treatment plans, progress notes, questionnaires and outcome measures.

Clinical records may be held electronically in My Therapy Suite, in secure local electronic files or in paper format, depending on the nature of the record. I take appropriate measures to protect these records and restrict access to those who need it for legitimate purposes.

I retain clinical records in accordance with applicable data protection requirements, professional guidance, insurance requirements and the need to maintain records for the purposes of continuity of care and potential legal claims.

My current policy is to retain adult clinical records for seven years after the end of therapy. Records may be retained for longer where required by applicable professional or insurance requirements, or where reasonably necessary for continuity of care or the establishment, exercise or defence of legal claims. Records are securely deleted or destroyed when they are no longer required.

Information held by third-party platforms may be subject to separate retention arrangements. For example, Attune states that it retains messages, booking information and consultation requests for seven years after the last booked session or account activity. This may differ from the retention period for my own clinical records.

Sharing Information

Personal information will not be sold or shared for marketing purposes.

Information may only be disclosed:

With your consent
Where required by law
Where there is a serious concern regarding your safety or the safety of another person
Where safeguarding obligations apply
To comply with professional, ethical or regulatory requirements
To service providers who process information on my behalf where necessary to provide and administer therapy services

Any disclosure will be limited to what is necessary under the circumstances.

Cookies

This website may use cookies and similar technologies to:

Ensure website functionality
Improve website performance
Analyse website usage
Enhance user experience

You can manage cookie preferences through the website's cookie banner and your browser settings.

Your Rights

Under UK GDPR, you have the right to:

Request access to your personal information
Request correction of inaccurate information
Request deletion of personal information where appropriate
Request restriction of processing in certain circumstances
Object to certain types of processing
Lodge a complaint with the Information Commissioner's Office (ICO)

Some of these rights are subject to legal exemptions and may not apply in every circumstance.

Contact

If you have any questions about this Privacy Policy or how your personal information is handled, please contact:

Saskia Wills Therapy
Email: hello@saskiawillstherapy.co.uk

Telephone: 07395 626207

Complaints

If you are dissatisfied with how your personal information has been handled, you have the right to contact the Information Commissioner's Office (ICO).

https://ico.org.uk

​Privacy Policy