PRIVACY POLICY

Last updated: August 2026

This Privacy Notice explains how Cecelia Bayliss-Conway, trading as CBC Psychotherapy, collects, uses, stores and protects your personal information when you enquire about, receive or have previously received psychotherapy services.

I take the privacy and confidentiality of clients seriously and process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018.

This Privacy Notice should be read alongside your Therapy Agreement.

1. Who is responsible for your information?

Cecelia Bayliss-Conway is the data controller for personal information processed in connection with CBC Psychotherapy.

Practice: CBC Psychotherapy
Telephone: 07904 173 075
Email: cbc.psychotherapy@gmail.com

If you have any questions about how your information is processed, please contact me using the details above.

2. What information do I collect?

Depending on the nature of your therapy, I may collect and process the following information:

Identification and contact information

This may include:

  • your name;

  • preferred name;

  • pronouns;

  • date of birth or age;

  • telephone number;

  • email address;

  • address;

  • emergency contact details; and

  • information about how you prefer to be contacted.

Health and clinical information

Where relevant to providing therapy, this may include:

  • information about your mental health;

  • information about your physical health where relevant to therapy;

  • presenting difficulties;

  • relevant personal, family or relationship history;

  • previous or current treatment;

  • medication information where clinically relevant;

  • risk information;

  • safeguarding information;

  • therapy goals;

  • clinical assessments; and

  • information discussed during therapy.

Health information is considered special category personal data under UK data protection law and is subject to additional legal protections.

Professional and treatment information

This may include:

  • appointment information;

  • session attendance;

  • clinical notes;

  • correspondence;

  • referrals;

  • reports or letters;

  • information received from other professionals where relevant and appropriately obtained;

  • information relating to your insurer or funding arrangements; and

  • records of concerns, complaints or incidents where necessary.

Financial information

Where you pay for therapy directly, I may process information necessary to administer payments and maintain appropriate financial records.

Where therapy is funded through an insurer, I may process information such as:

  • insurer name;

  • authorisation number;

  • policy number;

  • approved number of sessions; and

  • information required for invoicing.

I do not routinely retain full payment card details.

3. How do I collect your information?

I may collect information:

  • directly from you during enquiries, assessment and therapy;

  • through forms that you complete;

  • through telephone calls;

  • by email;

  • through appointment communications;

  • through referrals;

  • from your insurer where relevant;

  • from another healthcare professional where you have authorised this or where there is another lawful basis for doing so; and

  • from information that you provide during therapy.

I aim to collect only information that is relevant and necessary for the provision and safe management of therapy.

4. Why do I use your information?

I use your information where necessary to:

  • respond to enquiries;

  • arrange and manage appointments;

  • provide psychotherapy;

  • assess your needs;

  • maintain appropriate clinical records;

  • monitor and manage risk;

  • safeguard you or others where necessary;

  • communicate with you about your therapy;

  • liaise with other professionals where appropriate;

  • administer insurance claims and payments;

  • meet professional and legal obligations;

  • maintain appropriate professional standards;

  • deal with complaints or concerns;

  • manage and protect my practice; and

  • comply with legal, regulatory and professional requirements.

I do not use your information for unrelated purposes without an appropriate lawful basis.

5. What are my lawful bases for processing your information?

UK data protection law requires me to have a lawful basis for processing personal information.

Depending on the circumstances, I may rely on:

  • Contract – where processing is necessary to provide the agreed therapeutic service and manage our contractual relationship.

  • Legitimate interests – where processing is necessary for legitimate interests relating to the safe and effective management of my professional practice, provided those interests are not overridden by your rights.

  • Legal obligation – where I am required to process information to comply with a legal requirement.

  • Vital interests – where processing is necessary to protect someone's life in an emergency.

  • Consent – where consent is the appropriate legal basis for a particular activity.

Health information and other special category information require an additional legal condition under UK data protection law. I will rely on the applicable conditions for processing health information in the context of providing healthcare/psychotherapy and meeting relevant legal and professional obligations.

I do not rely on consent as the legal basis for all clinical processing. This is important because withdrawing consent does not necessarily mean that information which I am legally or professionally required to retain can be deleted.

6. Confidentiality

Information you share during therapy is treated as confidential within the professional and legal framework applicable to psychotherapy.

There are circumstances in which information may need to be shared without your consent.

These may include situations where:

  • there is a serious and significant risk of harm to you or another person;

  • there is a safeguarding concern;

  • disclosure is required by law or court order;

  • disclosure is necessary to comply with another legal or professional obligation; or

  • disclosure is otherwise permitted by law and considered necessary and proportionate.

Where possible, I will discuss disclosure with you beforehand.

There may, however, be circumstances where it would not be safe, appropriate or legally permissible to inform you before information is shared.

7. Who may have access to your information?

Your information is kept within a limited circle of confidentiality.

Depending on the circumstances, information may be accessed by:

Me

I am responsible for the management of your clinical records and the administration of my practice.

My clinical supervisor(s)

I receive regular professional supervision. Relevant aspects of my clinical work may be discussed in supervision.

I aim to anonymise information wherever possible and avoid sharing information that identifies you unless this is necessary for safe and appropriate supervision.

Trusted professional arrangements

In exceptional circumstances, such as my death or incapacity, my supervisor(s) may need limited access to practice information for the purposes of contacting clients, managing appointments, ensuring appropriate continuity and/or securely managing records.

Other professionals or organisations

Information may be shared with another healthcare professional, your GP, insurer, safeguarding service, emergency service or another relevant organisation where:

  • you have given permission;

  • this is necessary for your care and there is an appropriate lawful basis;

  • there is a serious risk to you or another person;

  • safeguarding requires it; or

  • I am legally required or permitted to do so.

I will not routinely share your therapy information with family members, employers, friends or other third parties without an appropriate legal and professional basis.

 

8. Microsoft 365, Outlook and Teams

I currently use Microsoft 365 services, including Microsoft Outlook and Microsoft Teams, for appropriate practice administration and, where agreed, online therapy. I also use Bilateral Base for EMDR sessions.

These systems may process information such as:

  • your name;

  • email address;

  • appointment information;

  • communications;

  • documents; and

  • information required to provide online sessions.

Microsoft's and Bilateral Base’s systems incorporate security measures designed to protect information. I also take reasonable steps to secure my own devices, accounts and files, including appropriate passwords and access controls.

I do not intentionally store unnecessary clinical information in ordinary email correspondence.

Where Microsoft Teams or Bilateral Base is used for therapy, sessions are not routinely recorded.

9. Emails and text messages

I may use email, telephone and/or text messaging to communicate with you about appointments and the administration of therapy.

Electronic communication has some inherent privacy and security risks.

I therefore aim to keep clinical information out of routine text messages and emails wherever possible.

Please let me know if you have particular communication or privacy requirements.

You are responsible for ensuring that the contact details and devices you provide are reasonably secure and accessible only to appropriate people.

 

10. Clinical records

I maintain appropriate records of therapy because accurate records are necessary for safe, ethical and professional practice.

Records may include brief session notes, assessment information, risk information, correspondence and administrative information.

I aim to keep records:

  • accurate;

  • relevant;

  • proportionate;

  • secure; and

  • limited to what is necessary.

I do not routinely make audio or video recordings of therapy sessions.

 

11. How long do I keep your information?

I retain personal and clinical information only for as long as it is necessary for the purposes for which it was collected, taking into account legal, professional, insurance and regulatory requirements.

As a general policy, clinical records will normally be retained for seven years after the end of therapy, unless there is a specific reason why a different retention period is appropriate.

Financial records may be retained for the period required by HMRC and other applicable legal requirements.

Information may be retained for longer where this is necessary because of a legal claim, complaint, safeguarding matter, professional requirement or another legitimate legal or regulatory reason.

When information is no longer required, it will be securely deleted or destroyed.

 

12. Keeping your information secure

I take reasonable technical and organisational measures to protect personal information against:

  • unauthorised access;

  • accidental loss;

  • destruction;

  • alteration;

  • inappropriate disclosure; and

  • other forms of unlawful or unauthorised processing.

Electronic information is stored using password-protected systems and devices.

Paper information, where used, is stored securely and access is restricted.

I regularly review the security arrangements used within my practice and will take appropriate action if a data security incident occurs.

 

13. Data breaches

If a personal data breach occurs, I will assess it in accordance with UK data protection requirements.

Where a breach is likely to result in a risk to your rights and freedoms, I will take the appropriate steps, which may include notifying the Information Commissioner's Office (ICO) and/or informing you where legally required or appropriate.

 

14. Your rights

Under UK data protection law, you may have rights including:

Right of access

You can ask for a copy of the personal information I hold about you.

This is commonly referred to as a Subject Access Request (SAR).

Right to rectification

You can ask me to correct information that is inaccurate or incomplete.

Right to erasure

In certain circumstances, you may ask for personal information to be deleted.

This right is not absolute. For example, I may be required to retain information because of legal, professional, insurance or regulatory requirements.

Right to restriction

In certain circumstances, you can ask me to restrict how your information is processed.

Right to object

In certain circumstances, you may have the right to object to processing based on legitimate interests.

Right to data portability

In certain circumstances, you may have the right to receive personal information you have provided to me in a structured, commonly used and machine-readable format.

Not all of these rights apply in every circumstance, particularly where information is being processed to comply with legal or professional obligations.

If you wish to exercise a data protection right, please contact me using the details at the beginning of this notice.

 

15. Requests for access to therapy notes

You may ask to access personal information held about you.

Requests for access to therapy records will be considered in accordance with UK data protection law and professional guidance.

Where appropriate, I may discuss the request with you before providing information, particularly where disclosure of certain information could have a significant impact on your wellbeing or another person's privacy.

Any information relating to another identifiable person may need to be removed or withheld where appropriate.

 

16. Complaints about data protection

If you have concerns about how I have handled your personal information, please contact me first so that I have an opportunity to understand and address your concern.

You also have the right to complain to the Information Commissioner's Office (ICO).

The ICO is the UK's independent supervisory authority for data protection.

ICO
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

Further information about making a complaint is available from the ICO.

 

17. Professional complaints

Concerns about the therapeutic service may also be raised through the appropriate professional complaints process.

I am a member of the British Association for Counselling and Psychotherapy and the National Counselling and Psychotherapy Society and work in accordance with the applicable BACP and NCPS ethical and professional requirements.

 

18. Changes to this Privacy Notice

I may update this Privacy Notice from time to time to reflect changes in:

  • legislation;

  • professional requirements;

  • the services I provide;

  • technology used within my practice; or

  • how personal information is processed.

The most recent version will be made available to clients.

Where a significant change affects how your information is processed, I will take reasonable steps to bring this to your attention.

19. Contact

If you have questions about this Privacy Notice or how your information is processed, please contact:

Cecelia Bayliss-Conway
CBC Psychotherapy
Telephone: 07904 173 075
Email: cbc.psychotherapy@gmail.com

Privacy Notice last updated: August 2026