Privacy Policy

What we collect

• Contact details you provide (name, email, phone, address, occupation, date of birth).
• Information shared during enquiry or therapy sessions, and clinical notes necessary for delivering counselling and psychotherapy services.
• Health information relevant to your care, including medication details.
• Details of your GP or doctor.
• Emergency contact and next-of-kin details.

Why we collect it

To provide and manage therapy services, respond to enquiries, maintain clinical records as required by our professional body (BACP), meet our professional and legal obligations, and — where there is a serious risk to your safety or the safety of others — to contact your named emergency contact, next-of-kin, or GP.

Lawful basis

We process your data on the basis of your consent, the performance of our service contract with you, our legitimate interests in running the practice, and our legal obligations. Special category (health) data, including medication information, is processed for the provision of health and social care under Article 9(2)(h) UK GDPR, and in situations involving a risk to life or serious harm, to protect the vital interests of you or another person under Article 9(2)(c) UK GDPR.

Third-party data

Where you provide details of a next-of-kin, emergency contact, or GP, you confirm you have their permission to share their information with us. We use these details only to contact them in an emergency or, with your consent, as part of coordinating your care. We will inform such individuals of how their data is held on request.

Third-party processors

Sessions are delivered via secure video platforms (Microsoft Teams and Google Meet). These providers process data on our behalf under their own privacy terms. If you accept marketing cookies, Meta Platforms Ireland Limited receives the website visit and booking events described under 'Cookies and website analytics'. If you contact us on WhatsApp, WhatsApp Ireland Limited processes your phone number and messages under its own privacy policy. We do not sell your data to anyone.

Protecting our forms from bots

Every form on this site is protected by Cloudflare Turnstile, a privacy-preserving alternative to CAPTCHA provided by Cloudflare, Inc. When you submit a form, Turnstile carries out a background check to confirm you are a person rather than an automated script. To do this, Cloudflare processes technical information such as your IP address, browser and device characteristics, and a short-lived challenge token.

This check is strictly necessary to keep the practice's contact routes usable and does not set advertising or tracking cookies. Turnstile is not used to profile you, and Cloudflare does not use the data for advertising. Most visitors are verified invisibly and never see a challenge. Cloudflare's own privacy notice explains their processing in full.

So that genuine messages are never lost to an over-zealous filter, we keep a short technical log of form attempts: which form was used, whether it was accepted or turned away, the browser's user-agent string, and a one-way hashed fingerprint of the network address (the address itself is never stored). Repeated failed attempts from the same fingerprint are paused for a few minutes to absorb automated traffic. No names, email addresses or message content appear in this log, and it is visible only to Mark.

Cookies and website analytics

Strictly necessary cookies keep the site working and remember your cookie choice. Nothing else runs until you say yes.

If you accept analytics cookies, we use Google Analytics 4 (Google Ireland Limited) to understand which pages help people and where the booking process loses them. Google Consent Mode v2 is in place, so analytics and advertising storage stay switched off by default. IP addresses are anonymised, Google Signals and ad personalisation are disabled.

If you accept marketing cookies, we use the Meta Pixel (Meta Platforms Ireland Limited) to measure whether our Facebook and Instagram ads lead to intro-call bookings. It records the pages you view on this site and, if you book an intro call, a 'Schedule' event. It receives no name, email address, message content, or anything said in a counselling session, and Meta's automatic event collection and advanced matching are switched off. Meta may link what it receives to your Facebook or Instagram account under its own privacy policy. Nothing is sent to Meta unless you have accepted marketing cookies, and you can withdraw that at any time using 'Cookie Settings' in the footer.

Alongside this we keep a first-party record of the same anonymous events on our own systems, so the practice can see the booking funnel without relying on Google. These records contain only the page path, the service or price option viewed, the traffic source, and a random session identifier that is discarded when you close your browser. Page addresses are stripped of anything after the path, and no name, email address, message content, or IP address is stored.

We do not use session recording, replay, or heatmap tools of any kind, and the Meta Pixel described above is the only advertising tool we use. Booking is handled by Calendly, whose own privacy terms apply to the details you enter into their calendar; we pass Calendly only the traffic source and the service you selected.

You can change or withdraw your choice at any time using "Cookie Settings" in the footer. If you decline analytics, nothing is recorded about your visit in either system.

Contacting us by WhatsApp

You can contact us by WhatsApp on the practice's UK mobile number, 07731 969 401, which is linked from our website and shown on some directory profiles. WhatsApp messages are end-to-end encrypted. We use this number only to arrange intro calls and appointments, and we ask that you keep anything personal for the call itself.

Group work interest list

If you register interest in future group work, we collect only your first name (optional), your email address, and — if you choose one — which theme interests you most. The lawful basis is your consent, given by ticking the box on that form. This information is used for one purpose only: to email you when a group is forming. It is deleted twelve months after you sign up, or once a group has run, whichever comes first. It is never shared with anyone, never added to a mailing list, and never used for any other marketing. You can ask us to remove your entry at any time by emailing mark@greatthriving.com.

Data retention

Clinical records are retained in line with professional and legal requirements, then securely deleted. Group work interest details are deleted after twelve months or once a group has run. WhatsApp conversations are deleted once they are no longer needed to arrange your sessions.

Your rights

You have the right to access, correct, delete, restrict or object to the processing of your data, and to data portability. To exercise any of these rights, or to raise a concern, contact us at mark@greatthriving.com.

Complaints

You have the right to lodge a complaint with the ICO at ico.org.uk or by calling 0303 123 1113.