Effective date: 28 September 2026
Data controller: Christina Fisher
Email: christina@tyvenic.com
ICO Registration Number: ZC277872
1. Introduction
This Privacy Notice explains how your personal data is collected, used, stored, and protected when you access our counselling and psychotherapy services. Understanding how your personal information will be being stored and processed, and the safeguards that are in place, can be important in deciding whether to begin therapy, and this notice is designed to help you make that decision.
2. Personal information we process
Contact form information
If you submit an enquiry through the website your name, email and message will be transmitted securely to Google Workspace, where it will be stored in order for me to respond to your message.
- Legal basis and purpose: Requested pre-contractual steps (Article 6(1)(b))
- Storage and retention: Stored securely in Google Workspace (encrypted, MFA) and retained for up to 30 days, after which it is deleted.
Administrative and contact information
In order to arrange therapy sessions your contact details, session dates and times, and email communications are stored within a secure Google account. These are not shared with anyone else, unless I die or suffer long-term incapacity where your contact details and session times will be passed to my clinical trustee so that they can inform you.
- Legal basis and purpose: Contract performance (Article 6(1)(b)) to schedule and manage your therapy.
- Storage and retention: Stored securely in Google Workspace (encrypted, MFA) and kept for 7 years after the end of therapy, and then permanently deleted.
Financial information
In order to take payment, issue refunds and comply with tax and accounting requirements, invoices containing your name and number of sessions, bank transaction records, and payment details may stored.
- Legal basis and purpose: Contract performance (Article 6(1)(b)) and legal obligation (Article 6(1)(c)) for tax and accounting.
- Storage and retention: Stored in FreeAgent and online business banking, retained for 6 years plus the current tax year as per HMRC guidelines.
Clinical session notes
In order to maintain a safe, ethical practice I take brief session notes which contain key themes, which may include relevant health and wellbeing information. This are not shared with anyone else, unless I die or suffer long-term incapacity where they will be passed to my clinical trustee for management.
- Legal basis and purpose: Provision of health care under professional confidentiality (Article 9(2)(h)).
- Storage and retention: Stored securely in Google Workspace (encrypted, MFA) and kept for 7 years after the end of therapy and then permanently deleted.
Session audio recordings
If you consent, I may collect and store session audio recordings for the purposes of my professional skill development. These are not shared with anyone else. This is optional and if you do not give your consent you will received the same standard of psychotherapy.
- Legal basis and purpose: Explicit consent (Article 9(2)(a)) for professional skill development.
- Storage and retention: Stored securely offline (encrypted, password-protected), kept for up to 6 months then permanently deleted.
3. Summary of data processing activities
| Data category | Legal basis | Security and storage | Retention period |
|---|---|---|---|
| Administrative data | Art. 6(1)(b) performance of contract | Google Workspace (encrypted, MFA) | 7 years after therapy ends |
| Financial data | Art. 6(1)(b) contract and Art. 6(1)(c) legal obligation | FreeAgent and Starling Bank | 6 years plus current tax year |
| Clinical session notes | Art. 9(2)(h) provision of health care | Google Drive (encrypted, MFA) | 7 years after therapy ends |
| Session audio recordings | Art. 9(2)(a) explicit consent | Google Drive (encrypted, MFA) | Maximum of 6 months |
4. Data security measures
- Your information is protected using industry-standard measures, including multi-factor authentication, encryption at rest and in transit, and strong authentication for banking functions.
- Your information is only accessible to me, except in the event of my death or incapacity where my clincial trustee would be given access in order to contact you and manage my records.
5. Your data protection rights
You have rights under data protection law, including the right to access, correct, or request deletion of your information. However, in some circumstances where the retention of your records is necessary for legal or ethical purposes it may not be possible to remove all your data.
If you have any questions or would like to exercise your rights, please contact me by email.