Privacy Policy

C. ROTHWELL THERAPY PRIVACY POLICY

Last updated: 28/09/2026

Data Controller

Caroline Rothwell, trading as C. Rothwell Therapy, is the Data Controller.

Personal Data Collected

Contact details: name, email, phone number. Health and therapy information: information you provide during your assessment and therapy, and written notes I make during or after sessions. Payment information: transaction records (no card details stored). Website technical and analytics data: My website uses IONOS SiteAnalytics, which processes technical information such as the time of a visit, browser and device details, pages requested and anonymised IP addresses to provide website statistics.

If you contact me through my website contact form, the name, contact details and message you provide are sent directly to my C. Rothwell Therapy email inbox, hosted by IONOS, so that I can respond to your enquiry.

I also retain relevant correspondence with clients, including emails about appointments, cancellations and payments.

Purpose and Legal Basis

To arrange and provide therapy and related services, I process personal information where necessary to perform my contract with you or to take steps at your request before entering into a contract (Article 6(1)(b) UK GDPR). Where I process health information or other special category data in connection with providing health care or treatment, I rely on Article 9(2)(h) UK GDPR, together with the relevant provisions of the Data Protection Act 2018, where applicable.

I also process personal information where necessary to comply with legal obligations (Article 6(1)(c) UK GDPR) and for my legitimate interests in administering and operating my therapy practice, including managing enquiries, correspondence and routine business records (Article 6(1)(f) UK GDPR), provided those interests are not overridden by your rights and freedoms.

Providing Your Personal Information

I need certain personal information from you in order to assess your needs, arrange appointments and provide therapeutic support. If you choose not to provide information that is necessary for these purposes, I may be unable to offer or continue providing the relevant service.

Client Eligibility

My therapy services are available only to adults aged 18 or over. If someone under 18 contacts me, I will use the information provided only as necessary to respond to the enquiry and will not offer them therapy. 

Data Sharing

I do not disclose your therapy information to other people or organisations unless required by law, necessary for safeguarding, or with your explicit consent where appropriate. I use service providers to operate my practice, including IONOS for current business email, Yahoo Mail for retained correspondence with former clients, and Apple iCloud Drive for storing clinical records and client paperwork. These providers process or store information as part of delivering their services. I do not sell your personal information.

International Transfers

Some of the service providers I use may process or store personal information outside the UK. Where personal information is transferred internationally, the relevant provider uses appropriate safeguards as required by applicable data protection law, such as adequacy arrangements or approved contractual safeguards. Further information about these safeguards is available from the relevant service provider or can be requested from me.

Data Retention

Clinical records are retained for a minimum of 8 years. I retain financial records for the period required by HMRC, normally at least five years after the relevant tax return submission deadline, and longer where legally required. If you enquire about therapy but do not become a client, I delete your enquiry and contact details when you tell me you do not wish to proceed, or after three unsuccessful attempts to contact you, unless I need to retain particular information for a legal or safeguarding reason.

Security Measures

I take reasonable steps to protect your personal information. Client records are stored digitally in iCloud and accessed through my password-protected or fingerprint-protected laptop and iMac. Therapy sessions are not audio- or video-recorded. My Apple Account and business email account are protected by two-factor authentication. Correspondence with former clients is also retained in my previous business Yahoo Mail account, which is protected by two-step verification.

Your Rights

Under UK data protection law, you have rights in relation to your personal information. Depending on the circumstances, these may include the right to access your personal information, request correction or erasure, restrict its processing, object to certain processing, and request data portability. Where I process your personal information on the basis of legitimate interests, you have the right to object to that processing in certain circumstances.

Where I rely on your consent for a particular use of your personal information, you may withdraw that consent at any time. This does not affect the lawfulness of any processing carried out before consent was withdrawn.

To exercise your rights, contact: caroline@crothwelltherapy.com.

If you are dissatisfied with how I handle your personal information, you have the right to complain to the Information Commissioner’s Office (ICO). You can find information about making a complaint at https://ico.org.uk/make-a-complaint/.

Automated Decision-Making

I do not use automated decision-making or profiling to make decisions about clients or prospective clients.

Changes to this Policy

I may update this policy at any time. The latest version will be posted on my website with the revision date.