Privacy Policy

What we collect

• Contact details you provide (name, email, phone, address, occupation, date of birth).
• Information shared during enquiry or therapy sessions, and clinical notes necessary for delivering counselling and psychotherapy services.
• Health information relevant to your care, including medication details.
• Details of your GP or doctor.
• Emergency contact and next-of-kin details.

Why we collect it

To provide and manage therapy services, respond to enquiries, maintain clinical records as required by our professional body (BACP), meet our professional and legal obligations, and — where there is a serious risk to your safety or the safety of others — to contact your named emergency contact, next-of-kin, or GP.

Lawful basis

We process your data on the basis of your consent, the performance of our service contract with you, our legitimate interests in running the practice, and our legal obligations. Special category (health) data, including medication information, is processed for the provision of health and social care under Article 9(2)(h) UK GDPR, and in situations involving a risk to life or serious harm, to protect the vital interests of you or another person under Article 9(2)(c) UK GDPR.

Third-party data

Where you provide details of a next-of-kin, emergency contact, or GP, you confirm you have their permission to share their information with us. We use these details only to contact them in an emergency or, with your consent, as part of coordinating your care. We will inform such individuals of how their data is held on request.

Third-party processors

Sessions are delivered via secure video platforms (Microsoft Teams and Google Meet). These providers process data on our behalf under their own privacy terms. We do not sell your data to anyone.

Protecting our forms from bots

Every form on this site is protected by Cloudflare Turnstile, a privacy-preserving alternative to CAPTCHA provided by Cloudflare, Inc. When you submit a form, Turnstile carries out a background check to confirm you are a person rather than an automated script. To do this, Cloudflare processes technical information such as your IP address, browser and device characteristics, and a short-lived challenge token.

This check is strictly necessary to keep the practice's contact routes usable and does not set advertising or tracking cookies. Turnstile is not used to profile you, and Cloudflare does not use the data for advertising. Most visitors are verified invisibly and never see a challenge. Cloudflare's own privacy notice explains their processing in full.

So that genuine messages are never lost to an over-zealous filter, we keep a short technical log of form attempts: which form was used, whether it was accepted or turned away, the browser's user-agent string, and a one-way hashed fingerprint of the network address (the address itself is never stored). Repeated failed attempts from the same fingerprint are paused for a few minutes to absorb automated traffic. No names, email addresses or message content appear in this log, and it is visible only to Mark.

Cookies and website analytics

Strictly necessary cookies keep the site working and remember your cookie choice. Nothing else runs until you say yes.

If you accept analytics cookies, we use Google Analytics 4 (Google Ireland Limited) to understand which pages help people and where the booking process loses them. Google Consent Mode v2 is in place, so analytics and advertising storage stay switched off by default. IP addresses are anonymised, Google Signals and ad personalisation are disabled, and we run no advertising or remarketing pixels.

Alongside this we keep a first-party record of the same anonymous events on our own systems, so the practice can see the booking funnel without relying on Google. These records contain only the page path, the service or price option viewed, the traffic source, and a random session identifier that is discarded when you close your browser. Page addresses are stripped of anything after the path, and no name, email address, message content, or IP address is stored.

We do not use session recording, replay, or heatmap tools of any kind, and we do not use advertising pixels. Booking is handled by Calendly, whose own privacy terms apply to the details you enter into their calendar; we pass Calendly only the traffic source and the service you selected.

You can change or withdraw your choice at any time using "Cookie Settings" in the footer. If you decline analytics, nothing is recorded about your visit in either system.

Group work interest list

If you register interest in future group work, we collect only your first name (optional), your email address, and — if you choose one — which theme interests you most. The lawful basis is your consent, given by ticking the box on that form. This information is used for one purpose only: to email you when a group is forming. It is deleted twelve months after you sign up, or once a group has run, whichever comes first. It is never shared with anyone, never added to a mailing list, and never used for any other marketing. You can ask us to remove your entry at any time by emailing mark@greatthriving.com.

Data retention

Clinical records are retained in line with professional and legal requirements, then securely deleted. Group work interest details are deleted after twelve months or once a group has run.

Your rights

You have the right to access, correct, delete, restrict or object to the processing of your data, and to data portability. To exercise any of these rights, or to raise a concern, contact us at mark@greatthriving.com.

Complaints

You have the right to lodge a complaint with the ICO at ico.org.uk or by calling 0303 123 1113.