Abbey Robb Therapies

Privacy Policy & Data Protection Complaints Procedure

Last updated: 17 June 2026

1. Introduction

I take the privacy of my clients and website visitors seriously. As a therapist, I hold particularly sensitive information, and I want you to understand clearly what I collect, why, and what control you have over it.

This policy explains how I collect, use, store and protect your personal data when you visit my website, get in touch with me, or become a client. It also sets out the process for raising a complaint about how your data has been handled, which I am required to provide under UK law from 19 June 2026 (see Section 12).

This policy applies to abbeyrobbtherapies.co.uk and to my therapy practice generally.

2. Who I Am

I am the data controller for the personal data described in this policy.

Abbey Robb Abbey Robb Therapies 290 Mare St, London, United Kingdom Practices held at South Wimbledon and Hackney, London, and online Email: abbey@abbeyrobbtherapies.co.uk Phone: 07754 292 813 ICO registration reference: ZB614836

I am registered with the Information Commissioner’s Office (ICO) as a data controller, and I am professionally registered with the Complementary and Natural Healthcare Council (CNHC), the National Council for Hypnotherapy (NCH) and the Association for Professional Hypnotherapy and Psychotherapy (APHP).

3. What Personal Data I Collect and Why

3.1 Website enquiries

If you fill in the enquiry form on my website, I collect your name, email address, phone number and any message you write, so that I can respond to you.

3.2 Email, phone and other correspondence

If you contact me by email, phone, text or in person, I keep a record of that correspondence, including your contact details and the content of our conversation, so I can follow up and keep an accurate record of our communication.

3.3 Client and clinical records

If you become a client, I keep notes from our sessions together. These notes may include details about your physical and mental health, family relationships, life history and other sensitive information you share in the course of therapy. I keep these notes because accurate clinical records are essential to providing safe, consistent and effective therapy, and because my professional bodies and insurance require it.

3.4 Newsletter sign-up

If you sign up to receive my newsletter, I collect your first name, last name and email address. This is sent and managed through Mailchimp, a third-party email platform.

3.5 Website analytics and cookies

My website uses Google Analytics to understand how visitors use the site, such as which pages are viewed and for how long. This involves the use of cookies. See Section 11 for more detail on cookies.

4. My Legal Basis for Processing Your Data

Under UK GDPR, I must have a lawful basis for everything I do with your personal data. Depending on the situation, I rely on:

Contract: to provide therapy services you have asked for, and to manage our working relationship.
Consent: for sending newsletters, and for processing health-related information shared in therapy (see Section 5).
Legitimate interests: to respond to general enquiries, maintain correspondence records, and understand how my website is used.
Legal obligation: to keep certain records for tax, insurance and professional regulatory purposes.

5. Special Category (Health) Data

Information shared during therapy sessions, including anything relating to your mental or physical health, counts as ‘special category data’ under UK GDPR. This receives extra legal protection.

I process this information on the basis of your explicit consent, given when you begin working with me, and because it is necessary for the provision of health and treatment services by a professional subject to a duty of confidentiality (UK GDPR Article 9(2)(a) and (h), and Schedule 1 of the Data Protection Act 2018). You can withdraw this consent at any time, though this would mean I could no longer continue providing therapy to you, and I would still need to retain existing records for the periods set out in Section 6.

6. How Long I Keep Your Data

Website enquiry form submissions: 12 months from the date of your enquiry, unless you become a client.
Client and clinical records: retained for as long as required by my professional body and insurer’s record-keeping guidance, generally for several years after our last contact, to allow for any future safeguarding, insurance or regulatory need. I can confirm the exact period that applies to you on request.
Email and phone correspondence: kept for as long as relevant to our working relationship, then securely deleted.
Newsletter data: kept until you unsubscribe.
Data protection complaint records: kept for 6 years from resolution, in line with general UK record-keeping practice (see Section 12).

I do not keep personal data for longer than necessary, and I review my records periodically to securely delete information I no longer need to retain.

7. Who I Share Your Data With

I do not sell your data, and I do not share it for marketing purposes. I may share limited information in the following circumstances:

With my clinical supervisor, as required by my professional bodies, normally discussed in a way that does not identify you by name.
With other professionals (such as your GP or another practitioner), but only with your consent, or where I have a safeguarding duty to do so, for example where I believe you or someone else is at risk of serious harm.
With Mailchimp, if you have signed up to my newsletter.
With Google, through Google Analytics, in an aggregated and largely anonymised form.
With my accountant or insurer, where necessary for tax or insurance purposes.
With the ICO or other authorities, if I am legally required to disclose information.

8. International Data Transfers

Mailchimp and Google Analytics may process data on servers outside the UK, including in the United States. Where this happens, these providers are required to have appropriate safeguards in place, such as the UK’s International Data Transfer Addendum or equivalent standard contractual clauses, to protect your data to a UK standard.

9. How I Protect Your Data

Clinical notes are recorded on a device protected by fingerprint authentication and encryption. Email correspondence is held in a password-protected email account. I take reasonable technical and organisational steps to protect your data against unauthorised access, loss or disclosure, including keeping devices locked, software updated, and limiting access to records to myself.

If a personal data breach occurs that is likely to put your rights and freedoms at risk, I will notify the ICO within 72 hours of becoming aware of it, and will inform you directly without undue delay if the breach is likely to result in a high risk to you.

10. Your Rights Under UK GDPR

You have the right to:

Be informed about how your data is used (this policy).
Access a copy of the personal data I hold about you.
Have inaccurate data corrected.
Ask for your data to be deleted, where this does not conflict with my legal or professional record-keeping obligations.
Restrict or object to certain processing.
Receive your data in a portable format, where technically feasible.
Withdraw consent at any time, where consent is the basis for processing.

To exercise any of these rights, contact me using the details in Section 2. I will respond within one month, as required by UK GDPR.

11. Cookies

My website uses cookies set by Google Analytics to understand how visitors use the site. As of February 2026, UK law (under the Data (Use and Access) Act 2025) allows cookies used solely for statistics or analytics purposes to be set without prior consent, provided a clear opt-out is available, and I have followed that approach. Cookies used for advertising or tracking would still require your consent, and I do not currently use any such cookies on this site.

You can control or delete cookies at any time through your browser settings, and you can opt out of Google Analytics tracking using Google’s browser add-on, available at tools.google.com/dlpage/gaoptout.

12. Data Protection Complaints Procedure

From 19 June 2026, the Data (Use and Access) Act 2025 gives you a new right to complain directly to me, as the data controller, if you believe I have mishandled your personal data, before escalating your concern to the ICO.

12.1 How to complain

You can raise a data protection complaint with me in any of the following ways:

Using the complaints form on my website.
By emailing abbey@abbeyrobbtherapies.co.uk, with ‘Data Protection Complaint’ in the subject line.
By writing to me at the address in Section 2.

Please include as much detail as you can about what happened, when, and what outcome you are hoping for. This makes it easier for me to look into your concern properly.

12.2 What happens next

I will acknowledge your complaint within 30 days of receiving it.
I will look into your complaint without undue delay, and keep you informed of progress.
I aim to resolve complaints within three months as good practice, though some matters may reasonably take longer, in which case I will explain why and keep you updated.
I will tell you the outcome of your complaint and the reasons for any decision I have made.

12.3 Escalating to the ICO

If you are not satisfied with my response, or if I have not resolved your complaint within a reasonable time, you have the right to complain to the Information Commissioner’s Office:

Website: ico.org.uk/make-a-complaint
Phone: 0303 123 1113
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

12.4 Complaint records

I keep a record of all data protection complaints I receive, including how they were handled and resolved, for 6 years, so that I can demonstrate how concerns have been dealt with.

13. Changes to This Policy

I may update this policy from time to time, for example to reflect changes in the law or in how I use your data. The ‘last updated’ date at the top of this page shows when it was last revised. I would encourage you to check back periodically.

14. Contact Me

If you have any questions about this policy or how your data is handled, please get in touch:

Abbey Robb, Abbey Robb Therapies Email: abbey@abbeyrobbtherapies.co.uk Phone: 07754 292 813 Address: 290 Mare St, London

Resources & Further Information