This privacy policy explains how Angelika Grechnaya ("I", "me", "the practice") collects, uses and protects your personal information when you book or attend therapy sessions or use this website. I act as the data controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Information I collect
- Contact details: name, email address, telephone number.
- Appointment details: date, time, session type (online or in-person), and any notes you provide when booking.
- Clinical information: information you share during sessions and brief written session notes, which are treated as special category health data.
- Payment information: payments are processed by a third-party provider (Stripe). I do not see or store your full card details; I only receive confirmation of payment and a reference.
- Technical data: limited technical information (such as IP address and browser type) collected when you use the website, to keep it secure and functioning.
2. Special category (health) data
Information about your mental health and wellbeing is "special category" data under UK GDPR and is treated with additional care. It is only accessed by me, kept securely, and used solely for the purpose of providing therapy and meeting my professional obligations.
3. Lawful bases for processing
- Contract (Art. 6(1)(b)): to arrange and provide therapy sessions you have booked.
- Legitimate interests (Art. 6(1)(f)): to manage the practice, keep clinical records, and communicate with you about your appointments.
- Legal obligation (Art. 6(1)(c)): where I am required to keep records or disclose information by law.
- Explicit consent (Art. 9(2)(a)): for processing special category health data as part of therapy.
- Provision of health care (Art. 9(2)(h)): where processing health data is necessary for the provision of therapy by a regulated professional.
4. How I use your data
Your data is used to arrange and deliver therapy sessions, keep appropriate clinical notes, take payment, contact you about appointments, and comply with my professional and legal obligations (including HCPC ethical standards).
5. Sharing your data
I do not sell your data. Limited data is shared with trusted service providers acting on my instructions, including WriteUpp (practice management, clinical records and online booking), Stripe (payments), an email delivery provider (appointment communications), and secure hosting and calendar tools used to run the practice. I may share information without your consent only where required by law or where there is a serious risk of harm to you or another person, in line with my professional and legal obligations.
6. Retention
Clinical records are kept for a period consistent with professional guidance for psychological practice: typically 7 years from the end of therapy for adult clients, and longer where required by law (for example, records relating to clients seen as children). Booking and payment records are kept for as long as required to meet accounting and tax obligations. Data is securely deleted when no longer needed.
7. Security
Reasonable technical and organisational measures are in place to protect your data, including access controls, encryption in transit, and secure storage. No system is completely secure, so please avoid sharing highly sensitive information by email where possible.
8. Your rights
Under UK GDPR you have the right to:
- access the personal data I hold about you;
- request correction of inaccurate or incomplete data;
- request erasure of your data, where applicable;
- restrict or object to certain processing;
- request a copy of your data in a portable format;
- withdraw consent at any time, where processing is based on consent.
Some rights are limited where I am required to keep clinical records to meet legal or professional obligations.
9. Contact for data requests
To make a request or ask a question about your data, please contact: grechnayaa@gmail.com.
10. Complaints
If you are not satisfied with how your data has been handled, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
11. Changes to this policy
This policy may be updated from time to time. The latest version will always be available on this page.