Privacy policy
Last updated: 1 November 2026
Beyond Words Therapy Ltd ("we", "us") takes your privacy seriously. This policy explains what personal information we collect, why, how we keep it safe and your rights. We handle your information in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and guidance from the Information Commissioner's Office (ICO).
Who we are
Beyond Words Therapy Ltd is the data controller for your information. Company number 12755514. Registered with the ICO, registration ZC150349.
Contact for data protection questions: info@beyondwordstherapy.co.uk, 07790 568 480.
What we collect
Contact details: name, address, email, phone number
Date of birth, and for young people, parent or carer details
Information about your health and wellbeing shared in assessment and sessions, and clinical notes
GP details and an emergency contact
Insurance or funding details, and payment records
Messages you send us, including through the website contact form
Website usage data collected by Squarespace (see Cookies)
Health information is "special category" data and receives extra protection.
Why we use it, and our lawful basis
To provide therapy and keep clinical records – contract (Article 6(1)(b)); special category data processed for the provision of health care by a registered professional under a duty of confidentiality (Article 9(2)(h) and Schedule 1, Part 1 of the Data Protection Act 2018).
To respond to enquiries – legitimate interests (Article 6(1)(f)), or steps before a contract at your request.
To take payment and keep financial records – contract and legal obligation (Article 6(1)(c)).
To share information with your insurer – contract, with your agreement.
To protect you or others in an emergency – vital interests (Articles 6(1)(d) and 9(2)(c)) or substantial public interest (safeguarding).
We do not use your information for marketing without your consent, and we never sell it.
Confidentiality and when we might share information
Sessions are confidential. We would only share information without your consent if:
there is a serious risk of harm to you or someone else
there is a safeguarding concern about a child or adult at risk
we are required to by law or a court order
Wherever possible and safe, we will talk to you first.
We also share limited information with:
your health insurer, if you are using insurance, with your agreement
our clinical supervisor, without information that identifies you
trusted service providers who process data on our behalf under contract, such as our website host (Squarespace), email provider, secure notes system and accountant
Some providers, such as Squarespace, may store data outside the UK. Where this happens, we make sure appropriate safeguards are in place, such as UK adequacy regulations or the ICO's International Data Transfer Agreement.
How long we keep it
Clinical records for adults: 7 years after therapy ends
Clinical records for children and young people: until their 25th birthday, or 7 years after therapy ends, whichever is later
Financial records: 6 years, as required by HMRC
Enquiries that don't lead to therapy: up to 12 months
After this, records are securely destroyed.
How we keep it safe
Clinical notes are stored in encrypted form. Paper records, if any, are kept locked. Devices are password-protected and encrypted, and access is limited to those who need it.
Your rights
You have the right to:
access a copy of your information
correct inaccurate information
ask us to delete your information, where we are not required to keep it
restrict or object to how we use it
receive your information in a portable format
withdraw consent at any time, where we rely on consent
To use any of these rights, email info@beyondwordstherapy.co.uk. We will respond within one month. There is usually no charge.
Cookies
Our website is hosted by Squarespace, which uses essential cookies to run the site and, if you agree, analytics cookies to help us understand how it's used. You can choose your cookie settings in the banner on your first visit and change them in your browser at any time.
Complaints about data
If you're unhappy with how we've handled your information, please tell us first. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint or 0303 123 1113.
Changes to this policy
We review this policy regularly. The date at the top shows when it was last updated.