Last updated: 15 July 2026

This Privacy Policy determines how the information collected by SafeSpace Psychotherapy, including www.safespacepsychotherapy.co.uk specifically, is processed. It also provides the reasons why we must collect certain personal data about you.

We take care of your personal data and undertake to guarantee its confidentiality and security.

1. Who I Am

Website: safespacepsychotherapy.co.uk

Data Controller: Lucy Palmer / SafeSpace Psychotherapy

Contact email: hello@safespacepsychotherapy.co.uk

Lucy Palmer is a BACP registered psychotherapist and complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and relevant professional confidentiality obligations.

SafeSpace Psychotherapy is registered with the Information Commissioner’s Office (ICO).
ICO registration number: ZC174219

2. The Type of Personal Data I Collect

a) Website or Directory Enquiries

If you contact me through my website, therapist directories, or by email, I collect the information you choose to provide. This may include:

• Name
• Email address
• Phone number (if provided)
• Message content

This information is processed in order to respond to your enquiry. It is securely received via my email provider and accessed only by me.

b) Therapy Clients

If you become a client, I collect personal data necessary to provide psychotherapy services. This may include:

• Contact details
• GP details and emergency contact information
• Session notes
• Relevant personal and health information

This includes special category data (health information) under UK GDPR.

c) Website Analytics

If you consent to analytics cookies, I use Google Analytics (via Google Tag Manager) to collect information about how visitors anonymously use my website. This may include:

• Pages visited
• Time spent on pages
• Approximate location derived from IP address
• Device and browser information

This information helps me understand website usage and improve the website.

d) Links to Third-Party Websites

This website contains links to external websites, including therapist directories and professional organisations. If you click these links, you leave my website and the privacy policies of those websites apply.

3. Lawful Bases for Processing (UK GDPR)

I process personal data under the following lawful bases:

Article 6(1)(b) – Contract

To provide psychotherapy services you have requested and to manage appointments and related administration.

Article 6(1)(c) – Legal obligation

To meet legal, professional, insurance, and financial obligations.

Article 6(1)(f) – Legitimate interests

To respond to enquiries, maintain website security, manage my practice, and improve website performance.

For special category data (including health information), I rely on:

Article 9(2)(h) – Provision of health or social care or treatment.

Article 9(2)(f) – Establishment, exercise, or defence of legal claims where necessary.

Where processing is based on consent, such as non-essential analytics cookies, consent can be withdrawn at any time.

4. How Your Data Is Used

Your personal data may be used to:

• Respond to enquiries
• Provide psychotherapy services
• Maintain appropriate clinical records
• Manage appointments and payments
• Maintain professional and legal records
• Improve website performance
• Meet professional, legal, and regulatory obligations

I do not sell, rent, or trade personal data.

5. Data Storage and Security

I take appropriate steps to protect your personal data, including:

• Password-protected devices
• Secure email access
• Restricted access to clinical records
• Secure storage of paper and digital records

While no system can guarantee absolute security, reasonable technical and organisational measures are in place to protect confidentiality and personal data.

6. Retention of Data

Enquiries that do not become clients are retained for up to 18 months, after which they are securely deleted, unless there is a legitimate reason to retain them for longer.

Clinical records are retained for 7 years after the end of therapy, in line with professional, insurance, and legal guidance.

Financial records are retained in accordance with HMRC requirements.

7. Sharing of Data

Your data is only shared where necessary and appropriate, including:

• With my clinical supervisor (with identifying details removed wherever possible)
• With my accountant or HMRC where required for financial record-keeping
• With legal or regulatory bodies where required by law

Any professionals involved in supporting my practice are subject to their own confidentiality and data protection obligations.

Website and technology services used include:

• Hostinger (website hosting)
• Google Analytics and Google Tag Manager (only where consent has been provided)

Some service providers may process data outside the UK. Where personal data is transferred internationally, appropriate safeguards are used, such as approved international transfer mechanisms or other protections recognised under UK data protection law.

8. Cookies and Analytics

This website uses cookies.

Essential cookies required for the operation and security of the website may be used without consent.

Non-essential cookies, including Google Analytics cookies, are only set if you provide consent through the cookie banner.

You can manage or delete cookies through your browser settings at any time.

9. Your Rights

Under UK GDPR, you may have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request erasure in certain circumstances
• Restrict processing
• Object to processing
• Request data portability where applicable
• Withdraw consent where processing is based on consent

To exercise your rights, please contact:

hello@safespacepsychotherapy.co.uk

If you have concerns about how I handle your personal data, please contact me first so that I can try to address your concerns.

You also have the right to make a complaint to the Information Commissioner’s Office (ICO):

www.ico.org.uk

10. Automated Decision-Making

I do not use automated decision-making or profiling when processing your personal data.

11. Children's Data

This website is intended for adults seeking psychotherapy. I do not knowingly collect personal data from children through this website.

12. Contact

If you have any questions about this Privacy Policy or how your personal data is handled, please contact:

Lucy Palmer

hello@safespacepsychotherapy.co.uk

Privacy Policy