Privacy Policy

Northwest Psychotherapies Limited (“we”, “us”, “our”) provides psychological therapies including High-Intensity Cognitive Behavioural Therapy (CBT), EMDR Therapy, counselling, supervision and coaching.

We collect and process personal data that you provide directly to us or that is provided by a referrer (e.g., GP, insurer, solicitor) with your knowledge, to arrange and deliver therapy:

• Identity & contact data: name, date of birth, address, email, phone, emergency contact.

• Booking & account data: appointments, services booked, attendance, cancellations, payments (amounts, method; card details are handled by our payment provider — we do not store full card numbers).

• Health & therapy data (special category data): presenting concerns, assessment notes, treatment plans, progress notes, outcome measures (e.g., anxiety/depression scales), GP/healthcare details, and any wellbeing check-in forms you complete.

• Referrer/insurer details (if applicable).

• Website/Cookie data: device, IP, pages visited, and similar analytics or preference cookies. See Cookies below.

We may also receive information from third parties where lawful and relevant to your care (e.g., GP, NHS services, insurers, solicitors, employers/organisations, or family members with your permission).

We use your data for the following purposes under the UK GDPR/EU GDPR lawful bases:

1. Providing therapy and managing your care (assessments, treatment, scheduling, communications, clinical records).

   • Lawful basis: Contract (to provide services you request).

   • Special category condition: Provision of health or social care and management of healthcare systems; associated UK safeguards under the Data Protection Act 2018.

2. Communicating with you about your bookings (confirmations, reminders, re-scheduling) and responding to enquiries.

   • Lawful basis: Contract and/or Legitimate interests (efficient client service).

3. Clinical governance and safety (supervision, incident management, safeguarding).

   • Lawful basis: Legitimate interests; Vital interests (where necessary to protect life).

   • Special category condition: Provision of health care.

4. Referrals or coordination with other professionals at your request (e.g., GP letters).

   • Lawful basis: Consent or Contract.

   • Special category condition: Explicit consent where required.

5. Billing, accounting and taxation.

   • Lawful basis: Legal obligation (finance/tax laws) and Contract.

6. Service improvement and website analytics (understanding site usage, fixing issues).

   • Lawful basis: Legitimate interests (running and improving our services). Where non-essential cookies are used, we ask for consent via the cookie banner first.

7. Marketing (optional).

   • Lawful basis: Consent (you can withdraw at any time).

We will always identify both a lawful basis and, for health information, a special category condition before processing, and maintain an Appropriate Policy Document where required by the DPA 2018.

We share data only when necessary:

• Therapists and clinical supervisors engaged by Northwest Psychotherapies Limited (bound by professional confidentiality and contracts).

• Service providers (processors) who host our website, manage bookings, send emails, process payments, provide secure storage/IT, or analytics — for example Wix.com Ltd. (website, bookings, forms), email and calendar providers, and payment processors (e.g., Stripe/PayPal). These providers process data under our instructions and contracts.

• Other health/social care professionals or organisations where we coordinate care at your request or where necessary for your vital interests.

• Insurers, solicitors, or referrers involved in funding or arranging treatment (where applicable).

• Regulators, safeguarding bodies, or law enforcement where we are legally required or permitted to do so.

Our website and bookings are hosted on Wix. Personal data may be stored or accessed outside the UK/EEA. Where this happens, transfers are protected using Standard Contractual Clauses and additional safeguards implemented by Wix and/or our other providers.

• Clinical records (adults): typically 7 years from the date of your last contact, unless a longer period is required by professional, legal or contractual obligations.

• Clinical records (children/young people): typically until age 25 (or 26 if 17 at last contact), unless a longer period is required.

• Bookings/admin, billing and tax records: 6–7 years as required by finance/tax law.

• Enquiry emails/forms: normally 12–24 months if you do not proceed, or incorporated into your clinical record if you do.

We review retention regularly and securely delete or anonymise data when it is no longer needed. 

You have rights under the UK GDPR/EU GDPR, including to:

• Access your data;

• Correct inaccurate data;

• Erase data (in certain circumstances);

• Restrict or object to processing;

• Data portability (for data you provided to us, where processing is by consent or contract and automated);

• Withdraw consent at any time where we rely on consent;

• Complain to the UK Information Commissioner’s Office (ICO) or your local EU supervisory authority.

UK ICO: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, ico.org.uk, 0303 123 1113. ICO

To exercise your rights, please contact us using the details in the contact page. We may need to verify your identity before responding.

Our website uses essential cookies (for security and functionality) and may use analytics and preference cookies. Non-essential cookies are used only with your consent, which you can manage via our cookie banner or browser settings. 

We provide services to clients of all ages. Where a client is under 16, we will normally seek parental responsibility involvement/consent as appropriate to the child’s best interests and applicable professional guidance. We explain privacy information in an age-appropriate way.

We apply technical and organisational measures appropriate to the risk, including secure systems, role-based access, encryption in transit, regular updates, and staff/associate confidentiality and training. 

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects about you.

We may update this notice from time to time. The latest version will always be available on our website, with the effective date shown at the top.