Privacy Policy
Chantal Kennedy Psychotherapy
Last updated: October 2026
1. Introduction
Your privacy and confidentiality are important to me. This privacy policy explains how I collect, use, store and protect your personal information when you visit my website, contact me or engage in psychotherapy.
I am committed to handling your personal information responsibly and in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the ethical framework of the British Association for Counselling and Psychotherapy (BACP).
Data Controller: Chantal Kennedy
Practice: Chantal Kennedy Psychotherapy
Email: hello@chantalkennedy.com
Website: www.chantalkennedy.com
I am responsible for deciding how and why your personal information is processed.
2. Information I collect
Depending on your interactions with me, I may collect:
Your name, email address, telephone number and preferred method of contact.
Information you provide through my website contact form or by email.
Information relevant to arranging and providing psychotherapy, including personal history, emotional wellbeing and mental health.
Relevant administrative and financial information, including appointment and payment records.
Brief clinical notes relating to our therapeutic work.
Information shared during psychotherapy may include sensitive personal information, legally described as special category data, which requires additional protection.
I only collect information that is reasonably necessary for providing my services and managing my practice.
3. How I use your information
I use personal information to:
Respond to enquiries about psychotherapy.
Arrange initial consultations and ongoing appointments.
Provide psychotherapy safely and professionally.
Maintain appropriate clinical and administrative records.
Manage payments and financial records.
Meet relevant legal, ethical and professional obligations.
Your information will not be used for marketing purposes without your separate consent.
I do not sell your personal information to third parties.
4. Lawful basis for processing your information
Under UK data protection legislation, I must have a lawful basis for processing personal information.
Depending on the circumstances, these may include:
Contract: Where processing is necessary to arrange or provide psychotherapy services.
Legitimate interests: Where processing is necessary to respond to enquiries and manage my practice, provided these interests do not override your rights.
Legal obligation: Where information must be retained or disclosed to comply with the law.
Vital interests: In exceptional circumstances where processing is necessary to protect someone's life.
Information relating to your mental or physical health receives additional legal protection.
Where I process special category information, I must also identify an appropriate condition under Article 9 of the UK GDPR and, where required, the Data Protection Act 2018. The applicable condition will depend on the nature and purpose of the processing, including the provision of confidential therapeutic services.
5. Confidentiality
Confidentiality is central to psychotherapy.
Information you share with me will be treated as confidential and handled in accordance with my professional and ethical obligations.
There are, however, limited circumstances in which confidentiality may need to be broken, including:
Where there is a serious risk of harm to you or another person.
Where there are significant safeguarding concerns involving a child or vulnerable adult.
Where disclosure is required by law or a valid legal order.
Wherever possible and appropriate, I would aim to discuss any necessary disclosure with you beforehand.
As part of my professional practice, I undertake regular clinical supervision. Client material may be discussed within supervision to support safe and ethical practice. Identifying information is minimised wherever possible, and supervision is subject to professional confidentiality.
The limits of confidentiality are explained further in my client agreement, which is provided before our initial consultation.
6. How your information is stored and protected
I take appropriate steps to protect your personal information against unauthorised access, loss, misuse or disclosure.
Client information and clinical records are stored using [insert your actual secure storage arrangements].
Access to records is restricted, and appropriate security measures are used to protect sensitive information.
Where third-party services are used for email, video consultations, website hosting or administrative purposes, I take reasonable steps to ensure that appropriate data protection safeguards are in place.
7. How long I keep your information
I retain personal information only for as long as necessary for the purposes for which it was collected, including professional, legal and insurance requirements.
Enquiries that do not lead to therapy: Held up to 6 months.
Clinical records: Kept for 7 years from when the therapy has ended.
Financial records: Retained in accordance with applicable tax and accounting requirements.
Once information is no longer required, it will be securely deleted or destroyed.
8. Sharing your information
I do not routinely share your personal information with third parties.
Information may be shared where necessary with:
Professional supervisors, subject to confidentiality.
Service providers who support the secure operation of my practice.
Relevant professionals or authorities where you have agreed to a disclosure.
Appropriate authorities where disclosure is legally required or necessary for safeguarding.
Any disclosure will be limited to information reasonably necessary for the particular purpose.
9. Website and cookies
My website is hosted by Squarespace.
Squarespace may collect certain technical information, such as browser details, device information and website usage data, and may use cookies necessary for the operation of the website.
Additional cookies or analytics technologies may be used depending on the website settings.
Where consent is legally required for non-essential cookies, visitors will be given an appropriate choice.
You can also manage cookies through your browser settings.
Further information is available in Squarespace's own privacy and cookie documentation.
10. International data transfers
Some technology providers may process or store information outside the United Kingdom.
Where personal information is transferred internationally, I take steps to ensure that appropriate safeguards are in place, in accordance with applicable data protection legislation.
11. Your rights
Under UK data protection legislation, you have a number of rights concerning your personal information.
These may include the right to:
Request access to the personal information I hold about you.
Ask for inaccurate information to be corrected.
Request deletion of information in certain circumstances.
Request restrictions on how your information is processed.
Object to certain types of processing.
Request transfer of your information where applicable.
Withdraw consent where consent is the lawful basis for processing.
These rights are subject to certain legal exceptions, including obligations relating to professional record-keeping.
If you would like to exercise any of these rights, please contact me at hello@chantalkennedy.com.
12. Concerns or complaints
If you have any questions or concerns about how your personal information is handled, please contact me in the first instance.
You also have the right to raise a complaint with the Information Commissioner's Office (ICO), the UK's independent data protection regulator.
Information Commissioner's Office
Website: www.ico.org.uk
13. Changes to this policy
I may update this privacy policy from time to time to reflect changes in legislation, professional guidance or the way I operate my practice.
The most recent version will always be available on my website.