Privacy Policy
Beginning therapy often involves sharing deeply personal information. Protecting your privacy and maintaining your confidentiality are fundamental to the therapeutic relationship. This Privacy Policy explains how Calm Harbour Therapy collects, uses, stores and protects your personal information.
Last Updated: July 2026
Introduction
Calm Harbour Therapy is committed to protecting your privacy and handling your personal information lawfully, fairly and transparently.
This Privacy Policy explains what personal information is collected, why it is collected, how it is used, how it is stored, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
As a registered child, adolescent and adult psychotherapist, I am also bound by the ethical frameworks of the British Association for Counselling and Psychotherapy (BACP) and the UK Council for Psychotherapy (UKCP). These professional standards place confidentiality and the protection of personal information at the heart of therapeutic practice.
Data Controller
Nicholas Dommett
Calm Harbour Therapy
Email: nick_therapy@protonmail.com
ICO Registration Number: ZB599438
What Personal Information Do We Collect?
Therapy Enquiries
When you contact Calm Harbour Therapy by telephone, email or through the website, I may collect:
your name
telephone number
email address
preferred appointment times
a brief description of the reason you are seeking therapy
any other information you choose to provide.
This information enables me to respond to your enquiry and determine whether I am able to offer an appropriate service.
Initial Assessment
If we arrange an initial consultation, I may collect information including:
date of birth
home address
GP details
emergency contact details
family circumstances
education or employment information
relevant medical history
current medication
previous psychological support
presenting difficulties
safeguarding information where appropriate.
During Therapy
If we undertake therapy together, confidential clinical records will be created and maintained.
These records may include:
assessment information
session notes
therapeutic formulations
treatment plans
correspondence
appointment history
invoices and payment records
risk assessments where appropriate.
Where artwork, creative materials or photographs of therapeutic work form part of the clinical record, these will be stored securely and retained in accordance with this Privacy Policy.
Some of this information constitutes Special Category Data, relating to physical and mental health, which receives additional protection under UK GDPR.
Working with Children and Young People
Where therapy involves a child or young person, I may also collect relevant information from parents or carers, schools, GPs or other professionals where appropriate and with consent, unless another lawful basis applies.
Parents or those with parental responsibility may receive information relating to appointments and administrative matters where appropriate. However, the confidentiality of therapeutic work with children and young people will be respected in accordance with their age, maturity, capacity to understand, professional ethical guidance and applicable law. Each situation will be considered individually in the child’s best interests.
How Your Information is Used
Your personal information is used to:
respond to enquiries
assess whether therapy is appropriate
provide psychological therapy
communicate regarding appointments
maintain accurate clinical records
issue invoices and manage payments
meet professional, ethical and legal obligations
manage safeguarding concerns where necessary
administer and improve the practice.
Your personal information is never sold or used for marketing purposes.
Lawful Basis for Processing
Under UK GDPR, organisations must identify the lawful basis upon which personal information is processed.
Calm Harbour Therapy relies upon the following lawful bases.
Contract (Article 6(1)(b))
Processing is necessary to take steps before entering into a therapeutic agreement and to provide therapy once treatment begins.
Legitimate Interests (Article 6(1)(f))
Processing is necessary for the safe administration of the practice, maintaining clinical records, arranging appointments, undertaking professional supervision and ensuring continuity of care.
Legal Obligation (Article 6(1)(c))
Information may be processed or disclosed where required by law, including safeguarding legislation or a court order.
Special Category Data (Article 9(2)(h))
Information relating to physical and mental health is processed because it is necessary for the provision of health care and psychological therapy.
Confidentiality
Everything discussed within therapy is treated confidentially.
There are, however, limited circumstances where confidentiality may need to be broken. These include:
where there is a serious risk of harm to yourself or another person
where there are safeguarding concerns regarding a child or vulnerable adult
where disclosure is required by law or court order
where disclosure is necessary for the prevention or detection of serious crime.
Wherever possible, any proposed disclosure will be discussed with you beforehand.
Professional Supervision
In accordance with the professional requirements of the BACP and UKCP, I regularly discuss my clinical work with an experienced clinical supervisor.
Clients are discussed anonymously wherever possible using first names or identifying codes only.
Supervisors are professionally bound by the same standards of confidentiality.
Who May Receive Your Information?
Your information will not normally be shared without your knowledge or consent.
However, where appropriate, information may be shared with:
your GP
psychiatrists or other healthcare professionals
schools or educational settings
social care professionals
legal representatives
safeguarding agencies.
This will normally occur with your consent unless there is another lawful basis requiring or permitting disclosure.
Third-Party Service Providers
Calm Harbour Therapy uses carefully selected third-party providers to support the safe administration of the practice.
These include:
Squarespace – website hosting and online enquiry forms
Microsoft 365 – secure email, document storage and practice administration
Starling Bank – processing bank transfer payments
Google Analytics – anonymous website usage statistics.
These organisations process personal information securely and only in accordance with applicable data protection legislation.
Some providers may process information outside the United Kingdom. Where this occurs, appropriate safeguards, including adequacy regulations or approved international transfer mechanisms, are used where required.
Website Cookies
The Calm Harbour Therapy website is hosted by Squarespace.
If you complete an online enquiry form, the information you provide is transmitted securely and processed by Squarespace before being forwarded securely to Calm Harbour Therapy.
For more information about Cookies, please read our Cookies Policy.
Email and Online Communication
Email is used for arranging appointments, responding to enquiries and other administrative communications.
Although Calm Harbour Therapy takes appropriate steps to protect personal information, email is not always a completely secure method of communication. Microsoft 365 provides encryption, secure storage and multi-factor authentication to help safeguard information. Nevertheless, there remains a small risk that emails could be intercepted, delayed or accessed by unintended recipients.
Please avoid sending highly sensitive or detailed personal information by email unless it is necessary to do so.
By choosing to communicate with Calm Harbour Therapy by email, you acknowledge and accept the inherent risks associated with electronic communication.
If you have concerns about using email, alternative methods of communication can be discussed.
How Your Information is Kept Secure
Protecting your information is taken extremely seriously.
Personal information is stored using encrypted and password-protected systems.
Microsoft 365 is used for email, document storage and practice administration. Access is protected using multi-factor authentication (2FA).
Sensitive clinical documents are stored securely within Microsoft Personal Vault, providing an additional layer of encryption and authentication.
Clinical notes are pseudonymised wherever possible using client identification numbers rather than names.
Access to personal information is restricted solely to Nicholas Dommett.
Appropriate technical and organisational measures are in place to reduce the risk of unauthorised access, accidental loss, destruction or disclosure of personal information.
How Long Information is Kept
Enquiry information that does not result in therapy will normally be deleted within twelve months.
Clinical records are normally retained:
for seven years after therapy ends where clients were aged 18 or over when therapy commenced
until the client’s twenty-fifth birthday where therapy began before the age of 18.
These retention periods reflect professional guidance, insurance requirements and legal limitation periods.
Following expiry of the retention period, records are securely destroyed.
Secure Disposal of Information
Once the applicable retention period has expired, personal information is securely destroyed.
Electronic records are permanently deleted from Microsoft 365 and associated secure storage using appropriate deletion procedures.
Any paper records, where applicable, are cross-shredded or disposed of through a confidential waste disposal service.
This applies to all personal information, including clinical notes, correspondence and any other records relating to your therapy.
Personal Data Breaches
Although every reasonable effort is made to protect your personal information, no system can ever be completely risk free.
Calm Harbour Therapy has procedures in place to identify, investigate and respond to any suspected personal data breach.
Where a breach is likely to result in a risk to your rights and freedoms, it will be reported to the Information Commissioner's Office (ICO) without undue delay and, where legally required, within 72 hours of becoming aware of the breach.
Where a breach is likely to result in a high risk to your rights and freedoms, you will also be informed as soon as reasonably practicable.
Your Rights
Under UK GDPR you have the right to:
request access to the personal information held about you
request correction of inaccurate information
request restriction of processing in certain circumstances
object to processing where appropriate
request transfer of your information where applicable
request erasure where legally appropriate
withdraw consent where consent is the lawful basis for processing
lodge a complaint with the Information Commissioner’s Office (ICO).
Subject Access Requests are normally responded to within one calendar month.
Clinical records are written with the understanding that clients have the right to request access to the personal information held about them under UK GDPR
Your Responsibilities
To help ensure that your personal information remains accurate and secure, you are encouraged to:
inform Calm Harbour Therapy if your contact details change
consider carefully the amount of personal or sensitive information included in emails or voicemail messages
notify Calm Harbour Therapy if you believe any information held about you is inaccurate.
Where another person (for example, a parent or guardian) contacts Calm Harbour Therapy on your behalf, personal information will only be shared where appropriate and in accordance with professional, ethical and legal obligations.
Complaints
If you have concerns regarding how your personal information has been handled, please contact Calm Harbour Therapy in the first instance.
If you remain dissatisfied, you have the right to complain to:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Website: https://www.ico.org.uk
Changes to this Privacy Policy
This Privacy Policy may be reviewed periodically to reflect changes in legislation, professional guidance or the operation of Calm Harbour Therapy.
The most recent version will always be available on request and on the practice website.