Summary of Privacy Policy

Your Trust Matters

Everything you share in therapy is confidential, within ethical, legal, and professional limits. I handle your information carefully and ethically, so you can focus on your therapy.

Confidentiality

✅ Sessions are private. Minimal information may be discussed in supervision to ensure safe and ethical practice.

✅ I may refer to aspects of our work in case studies, training, or professional development, with all identifying details removed or changed.

✅ Confidentiality is only broken in rare circumstances where there are legal, safeguarding, or serious risk concerns, always in line with professional ethical standards.

✅ If something unexpected prevents me from continuing our work, a clinical will ensures a trusted colleague can confidentially support your next steps.

Your Rights

📅 You can access the personal information I hold about you.

✂️ You may request corrections or deletions in line with UK data protection law.

🔗 For transparency about how your data is stored, managed, and protected, you can consult the full privacy policy below.

Privacy Policy

Respecting your privacy is fundamental to ethical therapy. This policy explains how your personal information is collected, stored, used, and protected.

Confidentiality and Legal Limits

Your sessions are confidential. I will not disclose identifying information unless there is a serious concern for safety, a legal requirement, or a court order. I aim to discuss this with you first wherever possible, unless doing so would increase risk. This approach reflects ethical guidance on client confidentiality upheld by my professional body, the British Association for Counselling and Psychotherapy (BACP) Ethical Framework, and guidance from my supervision and insurance providers.

Data Controller and Contact Details

The data controller responsible for your personal information is:

Kesley Cage

Email: office@kesleycage.com

You can contact me about this policy, your personal information, or any privacy concern using the details above.

How I Use Your Information

I use personal information to:

arrange and provide counselling
communicate with you about appointments and practical matters
maintain appropriate clinical records
process payments
obtain professional supervision
manage the continuity of your care
meet professional, legal, regulatory, and insurance requirements
send service updates and related communications

For counselling, clinical records, appointment administration, and payments, the usual UK GDPR lawful bases may include performance of a contract, legal obligation, and/or legitimate interests, depending on the specific activity. I do not collect any special-category data, unless you have volunteered this information, which may be recorded only as a memory aide.

For optional mailing lists, the lawful basis is usually consent. You may withdraw consent at any time by unsubscribing.

Information Shared with Providers

I share only the information reasonably necessary for the relevant purpose. Depending on the service you use, this may include your name, contact details, appointment information, and payment information.

Personal information may be processed by Google Workspace, Cal.com, Calendly, Stripe, Monzo, WhatsApp, Substack, Canva, Mailchimp, and other providers named in this policy. These providers may process information on my behalf or independently under their own privacy policies and service terms.

International Processing

Some providers may process personal information outside the UK. Where this occurs, I rely on the safeguards and transfer mechanisms described by the relevant provider, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum, or other lawful safeguards where applicable. Further information is available in the providers’ privacy policies linked in this notice.

Session Notes and Records

I keep brief session notes to support consistent and safe care. Notes are:

factual, minimal, and limited to what is necessary
stored securely via Google Workspace with enhanced security settings, including strong passwords and multi-factor authentication
accessible only by me

Google Workspace provides security features and processes information under its own privacy policy and applicable service terms: https://policies.google.com/privacy

I may prepare case presentations for my supervisor, peers or training providers. This may involve processing some of the details of your therapy anonymously, as part of a case study presentation using slides made with a business subscription to Canva, which is a password protected design website with multi-factor verification. Canva's privacy policy is available at: https://www.canva.com/policies/privacy-policy/

Online Sessions and Service Providers

Online sessions and email communications may use Cal.com, Calendly, and Google Workspace. Website forms and contact data on this site are also managed through Google Workspace infrastructure. These providers may process personal data on my behalf or as independent organisations under their own privacy policies:

Google Workspace: https://policies.google.com/privacy
Calendly: https://calendly.com/privacy
Cal.com: https://cal.com/privacy

Supervision, Training, and Research

As part of ethical practice, I attend regular clinical supervision. Client information may be discussed confidentially in supervision with an appropriately qualified and authorised supervisor who is subject to professional confidentiality obligations. I share only the minimum information reasonably necessary for supervision and take reasonable steps to limit identifying details.

Non-identifying material from sessions may be used for training or professional development, with identifying details removed or fictionalised.

Clinical Will and Continuity of Care

A clinical will is in place: if something unexpected prevents me from continuing our work, a secure process allows a trusted colleague to contact you confidentially with appropriate support and next steps. Session records are not shared in this process.

Appointment Booking and Payments

Booking details are managed through Cal.com and Calendly. Payments are processed through Monzo or Stripe:

Stripe: https://stripe.com/privacy

Monzo: https://monzo.com/help/legal-stuff/privacy-policy

I do not store card details. Monzo and Stripe process payment information under their own privacy policies.

Messaging and Communications

Email, SMS, and phone calls may be used for practical or administrative purposes. These methods are not suitable for emergencies. By choosing to communicate in these ways, you acknowledge the associated risks, which may include delayed responses, misdirected messages, or potential interception or processing by third parties.

If I use messaging, social-media, publishing, or other online platforms, contact details stored in my phone, email account, or online address books may be processed by those platforms. This may include your name, phone number, or email address, even if you do not use the relevant platform. It may allow the platform to identify or associate us as contacts. We may also come across one another’s online activity if we use the same platforms.

WhatsApp is an online communication service that uses end-to-end encryption. Its privacy policy is available here: https://www.whatsapp.com/legal/privacy-policy

Substack is a publishing platform. Its privacy policy is available here: https://substack.com/privacy

I do not intentionally share the fact that you are a client or clinical notes with these platforms. However, they may independently process contact details in accordance with their own privacy policies.

Use of Mailing Lists

Mailing lists are managed through Mailchimp: https://mailchimp.com/legal/privacy/

If you choose to subscribe to my Substack publication, Substack may deliver its posts to your email inbox. Subscribing is optional, and you may unsubscribe at any time. Subscribing to my Substack publication is separate from engaging me for counselling and does not disclose that you are a client.

Mailing lists are strictly opt-in services. You may unsubscribe at any time. I do not intentionally reveal that you are a client.

Marketing and Third Parties

I do not sell personal information or intentionally share it with third parties for unrelated marketing purposes. Service providers may process personal information when you book appointments, make payments, join a mailing list, or communicate with me. I share only the information reasonably necessary for the relevant service.

Data Retention and Your Rights

I store your data for five years following the end of therapy in accordance with my professional and insurance requirements. After this period, your data is securely deleted.

Under UK GDPR, you may have the right to:

access the personal information I hold about you
request correction of inaccurate information
request deletion, subject to legal exceptions
request restriction of processing
object to certain processing
withdraw consent where processing is based on consent
request data portability where applicable

You can raise privacy concerns by contacting me at office@kesleycage.com. If you are unhappy with how I handle your concern, you can complain to the Information Commissioner’s Office at https://ico.org.uk

Contact me