1. Privacy Notice

Last reviewed: July 2026

Respecting your privacy and maintaining confidentiality are fundamental to psychotherapy. This Privacy Notice explains how I collect, use, retain and protect your personal information and your rights under UK data protection law. Throughout these documents, ‘personal information’ means information that identifies you, or could reasonably be used to identify you.

Who is responsible for your information?

Francoise Higson, 1 Cowcross Street, London EC1M 6DR
Website: https://centrallondontherapist.com
Email: francoise@centrallondontherapist.com
ICO Registration: ZB634038

I am a Registered Member of the BACP and a Member of the UKCP and act as the Data Controller.

Depending on the nature of our work together, I may collect personal information such as your name, contact details, correspondence, appointment records, payment information and, where appropriate, information you choose to share during therapy.

I use this information to respond to enquiries, provide psychotherapy, manage appointments, maintain appropriate clinical records, comply with legal and professional obligations and administer my practice.

Lawful bases

Different lawful bases apply depending on the purpose for which personal information is processed. These include contract, legal obligation and legitimate interests where appropriate. Because psychotherapy involves health information, I also process special category personal information in accordance with the conditions permitted by UK data protection law for the provision and management of health or social care services.

Confidentiality

Information shared in therapy is confidential except where disclosure is required by law or necessary because of a serious safeguarding or safety concern. Personal information is never sold or used for marketing.

Electronic communications

If you contact me by email or through my website, please avoid including more personal information than is necessary in your initial enquiry. While I take appropriate steps to protect electronic communications, no internet-based communication can be guaranteed to be completely secure.

Clinical Will

My Clinical Will authorises a trusted psychotherapist to contact clients if I become unable to practise through serious illness, incapacity or death. They would access only the minimum information necessary and remain bound by professional and legal duties of confidentiality.

Security

I take appropriate technical and organisational measures to protect personal information. While no electronic system can ever be completely secure, I take reasonable steps to reduce the risk of unauthorised access, loss or misuse.

Service providers

I use carefully selected third-party providers to deliver website content and functionality together with services such as website hosting, secure email, secure video consultations (where applicable) and payment processing. Personal information is shared only where this is necessary to provide my services, comply with legal obligations or where you have requested it. Where providers process personal information on my behalf, appropriate contractual and legal safeguards apply.

International transfers

Where a provider transfers personal information outside the United Kingdom, I take reasonable steps to ensure appropriate safeguards recognised under UK data protection law are in place.

Children

My services are intended primarily for adults. Where I work with a child or young person, personal information is handled in accordance with the same principles described in this notice.

Data breaches

If a personal data breach occurs that is likely to result in a risk to individuals’ rights and freedoms, I will respond in accordance with UK data protection law, including notifying the Information Commissioner’s Office and affected individuals where required.

Retention

Clinical records are normally retained for seven years after therapy ends unless a longer or shorter period is required by law or justified by the circumstances. Please see the Data Retention Policy.

Your rights

You have the right to request access to your personal information, ask for inaccurate information to be corrected and, in certain circumstances, request that information be erased, restricted or transferred. You may also object to certain processing and have the right to complain to the Information Commissioner’s Office.

Automated decision-making

I do not use automated decision-making or profiling in relation to your personal information. Any decisions affecting you are made personally by me.

Review

This document is reviewed at least annually and sooner where changes in legislation, ICO guidance or professional practice require.

 

 

2. Data Retention Policy

Last reviewed: July 2026

I retain personal information only for as long as reasonably necessary to provide psychotherapy safely and professionally and to meet legal, professional and insurance obligations.

Record	Usual Retention Period
Initial enquiries	Normally up to 12 months
Clinical notes	Normally seven years after therapy ends*
Attendance records	Normally seven years after therapy ends*
Accounting records	Normally six years or longer if required by law
Routine administration	Deleted when no longer required

*Unless a longer or shorter period is required by law or justified by the circumstances.

This document is reviewed at least annually.

 

 

3. Cookie Policy

Last reviewed: July 2026

At the time this policy was last reviewed, no analytics or advertising cookies were identified. The website currently uses only essential technical functionality together with third-party resources necessary for website presentation. If non-essential cookies are introduced in future, this policy will be updated and consent obtained where required.

This document is reviewed at least annually.

 

 

4. Questions, Concerns and Complaints

Last reviewed: July 2026

If you have any questions or concerns about how your personal information is handled, please contact me in the first instance at francoise@centrallondontherapist.com. I encourage you to contact me first so that I have the opportunity to investigate and respond.

I will investigate concerns promptly, keep you informed of progress where appropriate and respond without undue delay. I will acknowledge receipt of any data protection complaint within 30 days of receiving it, keep you informed of progress where appropriate, investigate it without undue delay and inform you of the outcome as soon as reasonably practicable. If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office.

Further information about the Information Commissioner’s Office is available at https://ico.org.uk.

This document is reviewed at least annually.