Best Self Therapy : Wirral
Privacy Policy

Privacy Policy

(Psychotherapeutic Counselling & Hypnotherapy Private Practice)

 

1. Introduction

This privacy notice explains how I collect, use, store and protect your personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the British Association for Counselling and Psychotherapy (BACP) Ethical Framework.

 

I am committed to protecting your privacy and handling your personal information in a safe, transparent, and respectful way.

If you have any questions about this privacy policy or how your data is handles, you can contact me at hello@bestselftherapy.co.uk

 

2. Data Controller

I am the data controller responsible for your personal data.

​

Name: Delyth Cole

Practice name: Best Self Therapy : Wirral

Address: Wellness, 66 Argyle Street, Birkenhead, Wirral CH41 6AF

Email: hello@bestselftherapy.co.uk

Phone: 07743 440664

​

 

3. What information I Collect

I may collect and process the following personal information:

 

a) Personal Identification Data

• Name, address, email address, and phone number

• Date of birth & Emergency contact details

• session details - time/date etc

• GP details

• payment information (where applicable)

• information you provide via my website contact form

 

b) Special Category (Sensitive) Data

As a psychotherapeutic counsellor and hypnotherapist, I may collect sensitive personal data, including:

• Mental and emotional health information

• Relevant medical information

This data is essential for providing safe and effective therapy. 

​

Please note - I do not always hold any clinical notes, narrative reports ... my records consist mainly of an administration log of dates and times.

​

Joint confidentiality and third party data (for couples therapy) ... the attendance log identifies both participants. Under the UK GDPR - I cannot release a joint record to one party without the written consent of both individuals, as doing this would breach the privacy rights of the other party.

​​

Automated Decision Making (ADM) : I do not use any automated decision making or profiling tools in the provision of your therapy. 

 

4. How I Collect Your Data

Your data may be collected:

• Directly from you (e.g. enquiry forms, assessments, sessions)

• Via email, phone, text message, or online platforms

• Through referral information (with your consent)

 

5. Legal Basis for Processing

Under UK GDPR, I rely on the following lawful bases:

• Contract – to provide therapeutic services and manage appointments

• Processing – for administrative purposes, record keeping, and the safe and effective running of my practice. 

• Consent – where required, particularly for special category data

• Legal obligation – where I am required to comply with legal or regulatory requirements.

• Legitimate interests – including 'Recognised Legitimate Interests' under the Data Use & Access Act 2025 specifically for safeguarding vulnerable individuals and responding to emergencies.

 

6. How I use your information

Your personal data is used to:

• Provide psychotherapy and hypnotherapy services

• Maintain clinical administrative records in line with BACP guidelines

• Communicate with you about appointments and therapy matters

• Ensure safe and ethical practice

 

I will never sell your data or use it for marketing without your explicit consent.

 

7. Confidentiality and Its Limits

Confidentiality is a core part of my practice. However, there are limits where I may need to share information, including:

• If there is a serious risk of harm to you or others

• If safeguarding concerns arise (children or vulnerable adults)

• If required by law or court order

• For professional supervision (anonymised)

Any disclosure will be made in line with ethical and legal obligations.

 

______

​

 I may also use trusted third-party services to support my practice, such as:

- Website hosting (e.g. Wix)  

- Email providers  

- Online therapy platforms (e.g. Zoom)  

These providers process data on my behalf and are required to keep your information secure. 

 

8. Data Storage and Security

I take appropriate steps to protect your data, including:

• Secure storage of paper records in locked cabinets

• Password-protected and encrypted digital records

• Secure devices and up-to-date software

 

I only keep data for as long as necessary and in accordance with BACP guidance.

I employ a double-lock system for paper records and us a coded indexing system to ensure the clinical notes are stored separately from personal identifying information, enhancing your anonymity.

​

9. How Long I Keep Your Data

- Client records are kept for 6 years after the end of therapy  (or last session for ad-hoc clients)

- Enquiry data (if you do not become a client) is kept for 4 weeks  

 

Data is securely deleted after these periods.

 

10. Sharing Your Data

Your data will not be shared with third parties unless:

• You give explicit consent

• It is required for supervision (anonymous)

• There is a legal or safeguarding obligation

 

Any third parties used (e.g. secure booking or record-keeping systems) are GDPR compliant.

Where data is transferred outside the UK, it is done so under the 'UK-US Data Bridge" or other approved 'not materially lower protection standards as defined by the UK Secretary of State.

​

11. Your Rights

Under UK GDPR, you have the right to:

 

- Access your personal data (Subject Access Request)  If a request is broad or unclear, I may ask for clarification to help me locate the information, in such cases, one month response period will begin once clarification is received.

- Request correction of inaccurate data  

- Request erasure of your data (in certain circumstances)  

- Restrict or object to processing  

- Request transfer of your data (data portability)  

 

Please note: In some cases, access to therapy records may be limited if disclosure could cause serious harm to your mental health or that of others.

To exercise any of these rights, please contact me.

 

12. Complaints

I am registered with the ICO.

If you have any concerns about how your data is handled, please contact me first and I will aim to resolve the issue. I will acknowledge any data protection complaint within 30 days of receipt. I am committed to investigating and providing a substantive response without undue delay.

​

You also have the right to complain to the Information Commissioner’s Office (ICO):  

https://www.ico.org.uk  

 

13. Website and cookies  

My website may use cookies or similar technologies to improve functionality and understand how visitors use the site.

Where required, you will be asked for your consent before non-essential cookies are used.

​

14. Changes to This Privacy Policy

This privacy policy may be updated from time to time. The latest version will always be available upon request.

 

Latest Update: April 2026 

​(updated for compliance with the latest Data (Use and Access) Act 2025 - DUAA .. Feb 2026)

​​​​

Crisis Support & Limitations:

Please note: I am not a crisis service and cannot provide emergency support.

If you are in immediate danger, contact 999 or visit your nearest A&E