This privacy policy explains how I collect, use, store and protect personal information in my therapy practice, including on my website: www.horizon-psychotherapy.co.uk.

This policy is updated from time to time to reflect changes in my practice, legal requirements, professional guidance or the systems I use. It was last updated on 17th June 2026.

OWNER AND DATA CONTROLLER

Liesbet Starkey-Smets (Lis Starkey-Smets / Horizon Counselling & Psychotherapy)

ICO registration reference ZA333754

Telephone: 07857 478766,

Email: lis@horizon-psychotherapy.co.uk

This Privacy Notice applies to people who contact me about therapy, current and former clients, and visitors to my website.

WHAT PERSONAL DATA DO I COLLECT?

When you contact me, I may collect:

• your name
• your email address
• your phone number
• the information you choose to share in your enquiry
• any preferences around contact, availability or therapy format

If we arrange an initial call or begin therapy, I may also collect:

• your address
• your date of birth
• your GP details
• emergency contact details, where appropriate
• relevant health, mental health or wellbeing information
• information about your personal history, relationships, work, identity, family, circumstances and reasons for seeking therapy
• brief clinical notes
• attendance, payment and appointment information
• correspondence between us

Some of this information may be classed as special category data under UK data protection law. This includes information about health, mental health, sexuality, ethnicity, religion or other sensitive areas where these are relevant to therapy.

I only collect information that is necessary for providing therapy safely, ethically and professionally.

By visiting this website, the following data may also be collected:

• Technical Data: your internet protocol (IP) addresses, browser type and version, browser plug-in types and versions, time zone setting and location, operating system and platform and other technology on the devices you use to access this site
• Usage Data: information about how you use my website
• Cookie Data: information gathered by the use of cookies in your web browser.

A cookie is a small file placed on your computer’s hard drive to enable websites to identify your computer as you view different pages on the site. Cookies allow websites and applications to store your preferences in order to present content, options or functions that are specific to you. They also enable me to see information like how many people use the website and what pages they tend to visit.

This website uses cookies to analyse web traffic using an analytics package.

Aggregated usage data helps me improve the website structure, design, content and functions.

Cookies do not provide me with access to your computer or any information about you, other than that which you choose to share with me. You can use your web browser’s cookie settings to determine how this website uses cookies. If you do not want this website to store cookies on your computer or device you should set your web browser to refuse cookies. However, please note that doing this may affect how this website functions. Some pages and services may become unavailable to you. Unless you have changed your browser to refuse cookies this website will issue cookies when you visit it.

HOW I USE YOUR INFORMATION

I use your personal information to:

• respond to enquiries
• arrange initial calls and appointments
• provide therapy
• keep appropriate clinical records
• manage payments, invoices and appointments
• communicate with you about sessions
• meet legal, professional and ethical responsibilities
• manage risk, safeguarding or emergency situations where necessary
• maintain insurance, tax and accounting records
• to analyse usage of the website
• respond to data protection requests or complaints

I do not sell your personal information.

LAWFUL BASIS FOR USING YOUR INFORMATION

Under UK GDPR, I need a lawful basis for using personal information.

For different parts of my work, I may rely on different lawful bases under Article 6 UK GDPR. For example, I may rely on contract where processing is needed to arrange or provide therapy, legitimate interests where I need to run my practice safely and keep appropriate records, and legal obligation where I need to keep or share information to comply with the law.

• contract: where information is needed to arrange and provide therapy
• legitimate interests: where I need to use information to run my practice safely, respond to enquiries, keep appropriate records and protect both you and me
• legal obligation: where I need to keep or share information to comply with the law

Where I process special category data, such as information about health or mental health, I must also identify and document an applicable condition under Article 9 UK GDPR. Where required, I must also meet the relevant conditions and safeguards under the Data Protection Act 2018.

Where I ask for your consent for something specific, I will explain what I am asking for and whether you can withdraw that consent. Consent is not the only lawful basis available under data protection law, and I will only rely on it where it is appropriate to do so.

CONFIDENTIALITY

Therapy is confidential, but confidentiality is not absolute. I will not share what you tell me unless there is a lawful, ethical or safeguarding reason to do so, and where possible I will limit any sharing to the minimum information necessary.

There are some limits to confidentiality. I may need to share information if:

• I believe there is a serious risk of harm to you or someone else
• there is a safeguarding concern involving a child, vulnerable adult or person at risk
• I am required to do so by law, court order or legal process
• disclosure is necessary to prevent or detect a serious crime
• there is a medical emergency and information is needed to protect life
• I need to consult my clinical supervisor, while protecting your identity as far as possible

Where possible and appropriate, I would aim to discuss this with you before sharing information. However, I may not be able to do so if this would increase risk, prejudice safeguarding action, undermine the purpose of the disclosure, or would otherwise not be possible.

SUPERVISION

In order to work ethically as a psychotherapist, I use clinical supervision to support safe and effective practice.

In supervision, I may discuss aspects of client work to support safe and effective practice. I aim to minimise identifying detail where possible and appropriate, and my supervisor is also bound by confidentiality and professional standards.

CLINICAL NOTES AND RECORDS

I keep brief clinical notes to support safe and ethical therapy. These are usually factual, proportionate and relevant to the work.

Clinical records may include:

• session dates
• brief themes discussed
• relevant risk, safeguarding or clinical information
• agreed actions or important decisions
• contact and administrative information

I do not aim to keep a full transcript of sessions.

HOW LONG I KEEP INFORMATION

I keep information only for as long as necessary for the purpose for which it was collected. Retention periods may vary depending on the type of record, the nature of the work, legal and professional requirements, and whether the work involved a child or young person. As a general guide:

• enquiry information may be deleted if we do not begin therapy, usually within 6-12 months.
• client records are kept for seven years from the date of the final therapy session.
• financial records may be kept for the period required for tax and accounting purposes
• emails, messages and administrative records are reviewed periodically and deleted when no longer needed.

There may be times when I need to keep records for longer, for example where there are safeguarding, legal, insurance, complaint-related or professional-body reasons. I keep my retention periods under review and aim to make sure they remain justified and proportionate.

WHERE YOUR INFORMATION IS STORED

Your information may be stored in the following systems:

• Website: horizon-psychotherapy.co.uk (WordPress)
• Email: lis@horizon-psychotherapy.co.uk (Outlook, on personal laptop and mobile phone – both are password protected)
• Practice management or client records: paper records, stored in a locked filing cabinet when not in my possession. Clients’ first names plus surname initial, and their email address and/or telephone number are stored on a secure online Clinical Will website (Clinical Will App) which is password protected. See Clinical Will section below for more details.
• Online sessions: Microsoft Teams – first names only are used as meeting title
• Payments / invoicing: TSB bank account for clients choosing to pay by bank transfer. Clients also have the option to pay by cash. Client codes are used in my accounting spreadsheet to keep data anonymised
• Phone / messages: Client first name and initial, phone number and messages are stored when they send an SMS or WhatsApp message. These are deleted periodically when no longer needed.

I use appropriate technical and organisational measures to keep information secure. This includes password protection, device security, two-factor authentication, restricted access and secure storage.

Where I use external providers, they may process data on my behalf. I aim to use reputable providers with appropriate data protection and security arrangements.

If a personal data breach occurs, I will assess the risks and take appropriate steps to contain and investigate it. Where required by data protection law, I will notify the Information Commissioner’s Office and any affected individuals within the applicable time limits.

ONLINE THERAPY

If we work online, sessions will take place using Microsoft Teams. I will take the necessary steps to protect confidentiality from my side, and I ask that you also choose a private space where you cannot easily be overheard or interrupted.

Online platforms may process technical information such as IP address, device information or connection data. Please also check the privacy notice of the platform we use if you would like more detail.

OUTDOOR THERAPY

If we meet outdoors, I will discuss confidentiality with you in advance. Outdoor therapy can be discreet, but it cannot guarantee the same level of privacy as a private therapy room. We will agree how to manage the possibility of seeing other people, being overheard, or needing to pause the conversation.

AI TOOLS, TRANSCRIPTION AND RECORDING

I do not record, transcribe or use AI tools to process therapy sessions.

I may use digital tools for general practice administration, writing, planning or education. Where I do, I aim to avoid putting identifiable client material into tools that are not appropriate for confidential clinical information, and I take data protection and confidentiality into account when choosing how to use those tools.

WEBSITE VISITORS AND COOKIES

When you visit www.horizon-psychotherapy.co.uk some technical information may be collected automatically, such as your IP address, device type, browser type, pages visited and the time of your visit. This may happen through website hosting, security, analytics or cookie tools.

My website uses WordPress. Technical information may also be processed by the website hosting, security, analytics or cookie service providers I use.

You can usually control cookies through your browser settings. If I use cookies or similar technologies that are not strictly necessary, I will make sure the website provides the level of notice, choice or consent required by law. In some cases, current UK rules may allow limited exemptions for certain analytics or functionality cookies, but only where the legal conditions for those exemptions are met.

SHARING YOUR INFORMATION

I will not share your personal information unless there is a clear reason to do so. Depending on the circumstances, I may share limited information with the following people or organisations where this is necessary, proportionate and lawful:

• my clinical supervisor
• professional advisers, such as an accountant, insurer or legal adviser
• my professional body, if required in relation to a complaint or ethical matter
• safeguarding services, emergency services or your GP, where there is serious risk or safeguarding concern
• a court or legal authority, if required by law
• an appointed clinical executor if I die or become unable to contact clients myself
• trusted digital service providers who process data on my behalf

Where I share information, I aim to share only what is relevant and necessary for that purpose. If I or one of my providers transfers personal information outside the UK to a separate organisation, I will only do so where the law allows it and an appropriate transfer mechanism or other safeguard is in place where required.

CLINICAL WILL

I have arrangements in place so that clients can be contacted by my Clinical Will Executor if I die or become seriously incapacitated.

I am part of a small group of therapists who act as one another’s Clinical Will Executor. This means that they have access to the minimum information needed to contact current clients and manage records appropriately. My Clinical Will Executor is bound by confidentiality, and will only access information if necessary.

YOUR RIGHTS

Under UK data protection law, you have rights over your personal information. These may include the right to:

• be informed about how your data is used
• access a copy of your personal information
• ask for inaccurate information to be corrected
• ask for information to be deleted in some circumstances
• restrict or object to certain processing
• complain about how your information has been handled

Some rights are not absolute and may depend on the circumstances. For example, I may need to keep some information for legal, professional, safeguarding, insurance or complaint-related reasons, and there may be limits on what can be disclosed where information includes third-party data or where a relevant exemption applies.

If you would like to exercise your rights, please contact me using the details above. I will respond to a request about your rights within one month, unless data protection law permits an extension because the request is particularly complex or because you have made several requests. If I extend the response period, I will let you know and explain why.

DATA PROTECTION CONCERNS AND COMPLAINTS

If you have a concern about how I have handled your personal information, you can make a data protection complaint by contacting me using the details in this notice. I will acknowledge your complaint as soon as reasonably possible and take appropriate steps to investigate it without undue delay.

Please include:

• your name
• what your concern is about
• what you would like me to look into
• how you would prefer me to respond

I will investigate your complaint as appropriate, keep you informed where necessary, and tell you the outcome without undue delay.

If you are not satisfied with my response, or if you would prefer to contact the UK regulator directly, you can contact the Information Commissioner’s Office:

Website: www.ico.org.uk

Telephone: 0303 123 1113