About me
I am Magdalena Kedziora, trading as Empathic Solutions Therapy. I am the data controller responsible for the personal information used in my psychotherapy practice.
I am registered with the Information Commissioner’s Office.
Email: magdalena@empathicsolutionstherapy.com
Website: https://empathicsolutionstherapy.com
ICO registration reference: ZB572282
This notice applies to people who enquire about therapy, current and former clients, and anyone whose details are supplied to me as an emergency contact.
What information I use
Depending on your contact with me, I may use:
- contact and identifying information;
- GP and emergency-contact details;
- information relevant to assessing and providing psychotherapy, including information about your health, history and personal circumstances;
- assessment information and clinical notes;
- appointment, correspondence and payment records;
- your therapeutic agreement and recording preference;
- audio recordings where you have separately consented to recording for clinical supervision.
Most information is provided directly by you. Occasionally, I may receive relevant information from a referrer, another professional or somebody contacting me because of a concern about your welfare.
If you give me another person’s details as an emergency contact, please let them know and direct them to this notice. I use emergency-contact details only where reasonably necessary in connection with your safety or continuity of care. My lawful basis for holding these details is my legitimate interest in providing a safe and responsibly managed service.
Why I use information and my lawful bases
Enquiries and arranging therapy
I use contact and enquiry information to respond to you, arrange an initial consultation and take steps towards entering into a therapeutic agreement.
My lawful basis is that this is necessary to take steps at your request before entering into a contract.
Providing and administering psychotherapy
I use personal information to:
- assess whether I can provide appropriate psychotherapy;
- provide and manage our therapeutic work;
- keep appropriate clinical and administrative records;
- arrange sessions and payments;
- receive clinical supervision;
- manage safety, safeguarding and continuity of care.
For ordinary personal information, my lawful basis is that the processing is necessary to perform our therapeutic contract.
Information about health, religious or philosophical beliefs, racial or ethnic background, sexuality and other particularly sensitive matters is known as special-category information. Where this information is necessary for psychotherapy, I process it for the provision and management of health care or treatment under Article 9(2)(h) of the UK GDPR and the corresponding provisions of the Data Protection Act 2018. I am subject to professional and legal duties of confidentiality.
Audio recordings
Where you have separately agreed to audio recording for clinical supervision, I rely on your consent under Article 6(1)(a) and your explicit consent under Article 9(2)(a) of the UK GDPR.
Agreeing to recording is optional and declining will not affect your access to therapy. You may withdraw your consent to future recording at any time. Withdrawing consent does not affect the lawfulness of any processing that took place before it was withdrawn.
Legal, professional and financial responsibilities
I may use relevant information where necessary to:
- maintain financial and tax records;
- respond to a data-protection request or complaint;
- manage a safeguarding or legal matter;
- notify or cooperate with my insurer or professional bodies;
- establish, exercise or defend legal claims.
Depending on the circumstances, my lawful basis is compliance with a legal obligation or my legitimate interests in responsibly managing and protecting my professional practice. Where sensitive information is involved, I also rely on an appropriate special-category condition, including the legal-claims condition where relevant.
Do you have to provide information?
You are not generally under a legal obligation to provide personal information to me. However, I may be unable to offer or continue psychotherapy safely and appropriately if you do not provide information reasonably necessary for assessment, communication, payment or the therapeutic work.
Who I may share information with
Information disclosed in psychotherapy is treated confidentially, subject to the limits explained in the therapeutic agreement.
Where necessary and proportionate, information may be shared with:
- my clinical supervisor;
- a trusted professional colleague responsible for contacting current clients if I become unexpectedly unable to practise;
- providers supporting secure storage, email, website administration and payments;
- my accountant, insurer, legal adviser or professional bodies;
- health, emergency or safeguarding services where there is a serious concern about safety;
- a court, public authority or another person where disclosure is legally required or otherwise lawfully justified.
I share only the information reasonably necessary for the particular purpose. Where appropriate and possible, I will discuss a disclosure with you beforehand. I do not sell client information or use it for marketing.
Audio recordings and supervision
Where you have consented, sessions may be audio-recorded for clinical supervision.
Recordings are used only for supervision and associated clinical reflection. They may be listened to by me and by my clinical supervisor within confidential supervision. They are deleted when no longer required for that purpose and ordinarily within six months of being made. Exceptionally, deletion may be temporarily suspended if a recording is reasonably required for an active complaint, legal claim, insurance matter or regulatory process.
If you withdraw consent, I will stop making future recordings. Any recording still held will be deleted unless there is a specific legal or regulatory reason why it must temporarily be preserved.
How information is protected
I take appropriate measures to protect personal information against unauthorised access, accidental loss, alteration or disclosure. Electronic client records are stored in individually password-protected files within secure cloud storage. Clinical information is kept separately from direct contact details, and access is restricted to those who need it for a legitimate professional purpose.
Service providers and international transfers
I use third-party providers for secure cloud storage, email and website hosting. Some of these providers may store or process personal information outside the United Kingdom. Where this happens, appropriate safeguards recognised under UK data-protection law are used.
How long information is kept
I keep information only for as long as it is reasonably required.
- Enquiries that do not lead to therapy: ordinarily six months after the last meaningful contact.
- Therapeutic agreement, assessment, relevant correspondence and clinical notes: ordinarily three years after the final session.
- Audio recordings: deleted when no longer required for supervision and ordinarily within six months of recording.
- Financial and tax information: for the period required by tax law.
- Complaints, safeguarding, insurance or legal matters: for as long as reasonably necessary to address the matter.
Ordinary deletion may be suspended if I become aware of a complaint, legal claim, safeguarding matter, insurance issue or regulatory process for which the information is reasonably required. Information will be reviewed when the matter has concluded.
Your data-protection rights
Depending on the information involved and my lawful basis for using it, you may have the right to:
- obtain a copy of your personal information;
- have inaccurate or incomplete information corrected;
- request erasure of information;
- request restriction of its use;
- receive certain information in a portable format;
- withdraw consent where processing is based on consent.
These rights are not absolute. For example, information may sometimes need to be retained for legal, safeguarding or professional reasons.
I will respond to a valid rights request without undue delay and normally within one month. If data-protection law allows me more time, I will tell you and explain why.
Your right to object
Where I rely on legitimate interests, you have the right to object to the use of your personal information.
I will stop the relevant processing unless I can demonstrate compelling legitimate reasons to continue or the information is required for the establishment, exercise or defence of legal claims.
To exercise a right, contact me using the email address at the beginning of this notice.
Automated decision-making
I do not use solely automated decision-making or profiling to make decisions about prospective or current clients.
Website enquiries and cookies
If you contact me through my website, I use the information you provide to respond to your enquiry and, where appropriate, arrange an initial consultation. Please avoid including detailed sensitive or clinical information in your first message.
My website uses cookies that are necessary for its operation and security. Where non-essential cookies, such as analytics cookies, are used, they will be placed only with your consent. You can manage your choices through the website’s cookie banner or cookie settings.
Data-protection concerns and complaints
If you are concerned about how I have collected, used, stored, shared or deleted your personal information, please email:
magdalena@empathicsolutionstherapy.com
Where possible, please use the subject line “Data protection complaint.” Your complaint will still be recognised if you do not use those exact words or raise it verbally.
I will:
- acknowledge your complaint within 30 days;
- take appropriate steps to investigate it without undue delay;
- keep you informed of progress where necessary;
- explain the outcome without undue delay.
You may also complain to the Information Commissioner’s Office:
Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF Telephone: 0303 123 1113
This data-protection complaints process is separate from complaints about my clinical or professional service. Information about professional complaints is available in the FAQ section of my website.
Reviewing this notice
I will review this notice periodically and update it if my working practices, service providers or legal obligations change. The date of the current version appears at the beginning.