Privacy notice
David Monks
About this notice
This notice explains how David Monks looks after personal information: what we collect, why we hold it, who we may share it with and the rights you have over it.
It covers everyone we hold information about, including people who enquire without becoming clients, current and former clients, and people connected to our work such as family members or referrers.
Who we are
David Monks is the data controller for the information described in this notice. Controller is the legal term for the organisation that decides how and why personal information is used.
Questions about this notice, or about your information, go to David Monks. The quickest route is email: davidmtherapy@gmail.com.
If you need to write to us by post, contact us by email or phone and we will give you the address to use.
We are registered with the Information Commissioner's Office (ICO), the UK's data protection regulator. Our registration number is ZA427827.
Who this covers
We hold different amounts of information about different people. For most website visitors it is very little; for clients it includes the records we make in the course of our work together. This notice covers:
- people who contact us with an enquiry
- current and former clients
- family members, partners and other people who appear in our records
- people who refer clients to us, and professionals we work alongside
- visitors to our website
The information we hold
What we hold depends on your relationship with us. It can include:
- your name and contact details
- appointment and payment records
- what you share with us during our work together, and the notes we make about that work
- correspondence such as emails, letters and messages
We collect what the work needs and no more.
We ask clients for an emergency contact. We use those details only in a genuine emergency and never contact that person for any other reason.
Where information comes from
Most of the information we hold comes directly from you: when you get in touch, complete a form, or talk with us during our work together.
Why we use information, and our lawful bases
The law requires a valid reason, called a lawful basis, for every use of personal information. This section lists each purpose we use information for and the basis we rely on. We have reviewed and confirmed each one.
Handling enquiries. Reading and replying when you contact us, and keeping a record of that exchange for a reasonable period. Our confirmed legal basis for this purpose is Consent (Article 6(1)(a)); Article 9(2)(g) with Schedule 1 condition 17 (counselling).
Assessing whether we can help. Initial conversations and intake questions that help us decide together whether our service is right for you, including when the best answer is a referral elsewhere. Our confirmed legal basis for this purpose is Contract (Article 6(1)(b)); Article 9(2)(h) health or social care with Schedule 1 condition 2.
Providing the service itself. Running sessions, keeping in touch about the work and doing what we have agreed with you. Our confirmed legal basis for this purpose is Contract (Article 6(1)(b)); Article 9(2)(h) health or social care with Schedule 1 condition 2.
Managing appointments. Booking, rearranging and cancelling sessions and, where used, sending reminders. Our confirmed legal basis for this purpose is Contract (Article 6(1)(b)).
Taking payment. Invoicing, processing payments, issuing receipts and keeping the financial records the law requires. Our confirmed legal basis for this purpose is Contract (Article 6(1)(b)).
Keeping clinical records. Making and keeping session notes, assessments and related correspondence so the work is documented safely and professionally. Our confirmed legal basis for this purpose is Contract (Article 6(1)(b)); Article 9(2)(h) health or social care with Schedule 1 condition 2.
Clinical supervision. Discussing our client work with a clinical supervisor, as our profession expects, keeping identifying details to the minimum the discussion needs. Our confirmed legal basis for this purpose is Legitimate interests (Article 6(1)(f)); Article 9(2)(h) health or social care with Schedule 1 condition 2.
Handling complaints. Receiving, looking into and responding to complaints, and keeping a record of what happened. Our confirmed legal basis for this purpose is Legitimate interests (Article 6(1)(f)).
Responding to data rights requests. Handling requests to see, correct or delete information, including checking who is asking. Our confirmed legal basis for this purpose is Legal obligation (Article 6(1)(c)).
Legal claims. Using records if a dispute arises, for example a fee dispute, an insurance matter or a court order for notes. Our confirmed legal basis for this purpose is Legitimate interests (Article 6(1)(f)); Article 9(2)(f) establishing, exercising or defending legal claims.
Tax and accounting. Keeping invoices and financial records, filing returns and sharing what is needed with our accountant and HMRC. Our confirmed legal basis for this purpose is Legal obligation (Article 6(1)(c)).
Professional body requirements. Meeting the requirements of our professional membership, such as holding insurance, engaging in supervision or cooperating with a conduct process. Our confirmed legal basis for this purpose is Legitimate interests (Article 6(1)(f)).
Keeping our website secure. Security logging, blocking attacks and preventing spam, which involves technical details such as IP addresses. Our confirmed legal basis for this purpose is Legitimate interests (Article 6(1)(f)).
Health and other sensitive information
Some kinds of information get extra legal protection, including anything about health, sex life or sexual orientation, race or ethnic origin, religious or philosophical beliefs, and biometric data. The law calls this special category data. Therapy involves health information by its nature, so much of what clients share with us falls into this group.
To use special category information we need both a lawful basis and a further specific condition, and we treat it with particular care.
For the health information involved in providing our service, we rely on the condition for health and social care (Article 9(2)(h) UK GDPR, with Schedule 1 of the Data Protection Act 2018). This applies because the information is used for care provided under the responsibility of a professional who owes a duty of confidentiality.
Clinical records
We keep clinical records of our work with clients, typically session notes, assessments and relevant correspondence. Records help us provide safe, consistent care. They are stored securely, access is limited to the people who genuinely need it, and they are kept for the periods set out in our retention policy before being securely destroyed.
Supervision
Like most therapy professionals, we have regular clinical supervision, where aspects of client work are discussed with an experienced supervisor. Supervision protects the quality and safety of the work. Our supervisor is bound by the same expectations of confidentiality that we are, and we share the minimum needed for the discussion, avoiding identifying details wherever possible.
Safeguarding and exceptional disclosures
What clients share with us is confidential, and we protect that confidence carefully. There are a small number of situations where the law or someone's safety can require us to share information without consent:
- when we believe a child or an adult is at serious risk of harm
- when we believe there is an immediate risk to someone's life
- when a court orders us to disclose information, or a legal duty requires it
Wherever it is safe and possible we talk to the person concerned before sharing anything, and we only ever share the minimum needed with the appropriate authority.
Who we share information with
We never sell personal information, and we never share client information for anyone else's advertising.
Services that process information for us
Like almost every modern practice, we use carefully chosen services to run day to day, for example email, secure storage, booking or payment tools. These providers act on our instructions under contracts that require them to protect your information, and they are not allowed to use it for their own purposes. We keep a record of every service we use and review it regularly.
Information leaving the UK
The information we hold is stored and processed in the UK. If that ever changes, we will update this notice and put a recognised safeguard in place first.
How long we keep information
We keep different kinds of records for different lengths of time, and we do not keep anything longer than we need to. Clinical records are generally kept for a set period after the work ends, in line with professional guidance and insurance requirements. Our retention policy sets out each category, the period that applies and the reason for it. You are welcome to ask us for a copy.
How we protect information
We take the security of your information seriously. The measures we use are proportionate to the sensitivity of what we hold, and include keeping devices and accounts protected, limiting access to the people who need it, and storing records securely whether they are digital or on paper. No system is perfectly secure, but we work to keep risks low and we review these measures regularly.
Your rights
You have rights over your personal information. In summary:
- Access. You can ask for a copy of the information we hold about you.
- Correction. You can ask us to correct information that is inaccurate or incomplete.
- Deletion. You can ask us to delete information. This right has limits: for example, we may need to keep clinical records for a period even after such a request, and we will always explain our reasons.
- Restriction. You can ask us to pause our use of information while something is resolved.
- Objection. You can object to particular uses of your information. For marketing, we simply stop.
- Portability. In some circumstances you can ask for information you gave us in a reusable format, or for it to be sent to another provider.
- Withdrawing consent. Where we rely on your consent, you can withdraw it at any time.
To use any of these rights, contact us at davidmtherapy@gmail.com. We normally respond within one month. If a request is complex we can extend that by up to two further months, and we will tell you within the first month if so. There is normally no charge.
Before sharing records we make sure a request really comes from you, or from someone genuinely authorised to act for you. For a current client, replying through the contact details we already hold is often enough; occasionally we may ask for more.
Raising a concern
If you are unhappy with how we have handled your information, please tell us. Contact David Monks at davidmtherapy@gmail.com and we will do our best to put things right. Our complaints procedure explains what happens next.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at any time. You can do this at ico.org.uk/make-a-complaint. We would welcome the chance to address your concern first, but you do not have to come to us before going to the ICO.
AI tools and automated processing
We do not currently use AI tools with client information. If that changes, we will update this notice first and explain what tool is involved and why.
Marketing
We do not send marketing emails or texts. If you hear from us, it is about your care or something you have asked about.
Our website
Our website collects a small amount of technical information about visits, such as the pages viewed and the browser used, which keeps the site working and secure. Our cookie and storage technologies policy explains what runs on the site and the choices you have.
If you use a form on our site, what you enter comes to us so we can respond. Form messages are treated with the same care as any other enquiry, so please share only what you are comfortable sending this way.
We use analytics to understand how the site is used. Your choices about analytics, and how to change them, are explained in our cookie and storage technologies policy.
Changes to this document
We keep this notice under review and update it when our practice or the law changes. The version number, the date it took effect and the date of the next planned review are shown at the end. If we make a significant change, we will draw attention to it rather than changing things quietly.
Your retention schedule
| Record | Period starts | How long | Reason | Source | Disposal |
|---|---|---|---|---|---|
| adult clinical records | The first psychotherapy session. | 20 years | This covers my professional life and anything shorter | Practical expectations | secure digital deletion |
Services handling information
| Provider | Product | Purpose | Information | Hosting | Transfers | Safeguard |
|---|---|---|---|---|---|---|
| Truly Empowered | Website | Information about my practice | uk | no transfer |
Purposes and confirmed legal bases
| Purpose | Legal basis | Your explanation |
|---|---|---|
| Managing appointments | Contract (Article 6(1)(b)) | Booking and moving sessions is part of providing the service you agreed. |
| Assessing whether you can help someone | Contract (Article 6(1)(b)); Article 9(2)(h) health or social care with Schedule 1 condition 2 | Deciding whether you can help is a step the person asked for before you agree to work together. Health details also need the health or social care condition, which applies because you owe your clients a duty of confidentiality. It does not need an appropriate policy document. |
| Keeping clinical records | Contract (Article 6(1)(b)); Article 9(2)(h) health or social care with Schedule 1 condition 2 | Keeping notes is part of providing therapy safely. Health details also need the health or social care condition, which applies because you owe your clients a duty of confidentiality. It does not need an appropriate policy document. |
| Handling complaints | Legitimate interests (Article 6(1)(f)) | Looking into a complaint fairly is a legitimate interest of your practice. |
| Handling enquiries | Consent (Article 6(1)(a)); Article 9(2)(g) with Schedule 1 condition 17 (counselling) | |
| Defending or bringing legal claims | Legitimate interests (Article 6(1)(f)); Article 9(2)(f) establishing, exercising or defending legal claims | Keeping records so you can respond to a possible claim is a legitimate interest. The legal claims condition covers any health details used for it, and needs no appropriate policy document. |
| Taking payment | Contract (Article 6(1)(b)) | Taking payment is part of the agreement between you and your client. |
| Meeting professional body requirements | Legitimate interests (Article 6(1)(f)) | Meeting the requirements of your professional body is a legitimate interest of your practice. |
| Providing the therapy or service itself | Contract (Article 6(1)(b)); Article 9(2)(h) health or social care with Schedule 1 condition 2 | Therapy is the service you have agreed to provide. Health details also need the health or social care condition, which applies because you owe your clients a duty of confidentiality. It does not need an appropriate policy document. |
| Responding to data rights requests | Legal obligation (Article 6(1)(c)) | Data protection law requires you to respond when someone asks for their information. |
| Discussing work in supervision | Legitimate interests (Article 6(1)(f)); Article 9(2)(h) health or social care with Schedule 1 condition 2 | Discussing your work in supervision is a normal part of safe practice. Health details also need the health or social care condition, which applies because you owe your clients a duty of confidentiality. It does not need an appropriate policy document. |
| Tax and accounting | Legal obligation (Article 6(1)(c)) | Tax law requires you to keep financial records. |
| Keeping your website secure | Legitimate interests (Article 6(1)(f)) | Keeping your website and its forms secure is a recognised legitimate interest. |