Privacy policy
How I collect, use and protect your personal information, written in plain English. Therapy involves sensitive information, so I take this seriously.
Last updated 30 October 2026
Who I am
This website and the therapy service are run by Ben White, trading as Ben White Therapy. I am the data controller for the personal information described here, which means I decide how it is used and I am responsible for protecting it, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Contact me about anything in this policy at benwhitetherapy@gmail.com or on 07498 520 911. Practice addresses: 1st Floor, Mare Street Wing, St Joseph’s Hospice, Mare Street, London E8 4SA; Unit 10, Print Village, 58 Chadwick Road, London SE15 4PU; 64 Grove Vale, London SE22 8DT.
What I collect
If you contact me or book an intro call
- Your name, email address and, if you give it, your phone number.
- Your preferences, such as how you'd like me to reply, the best time to call, and whether you'd like to meet in person or online.
- Anything you choose to tell me in a message, including what you'd like help with. This may include information about your health, which the law treats as special category data.
- Booking details (date and time of your intro call) if you book online.
If we work together
- Contact details and, if you agree to share them, your GP's details and an emergency contact.
- Brief session notes and any questionnaires we complete together. These contain health information.
- Records of sessions attended, invoices and payments.
When you visit this website
- Your cookie choice, stored on your own device.
- Standard technical information processed by the website host to deliver pages securely (such as IP address and browser type). I do not use this to identify you.
- If you allow analytics, anonymised information about which pages are visited. See cookies.
The self‑check questionnaires on the Resources page are scored entirely in your browser. Your answers are never sent to me or stored.
Why I use it (lawful bases)
| Purpose | Lawful basis |
|---|---|
| Replying to your enquiry and arranging an intro call | Steps you've asked me to take before entering into a contract (Article 6(1)(b)). Any health information you include is processed with your explicit consent (Article 9(2)(a)), which you give with the checkbox on the form. |
| Providing therapy and keeping clinical notes | Contract (Article 6(1)(b)). Health information is processed for the provision of health care by a professional bound by confidentiality (Article 9(2)(h) and Data Protection Act 2018, Schedule 1, paragraph 2). |
| Invoices, payments and tax records | Legal obligation (Article 6(1)(c)). |
| Keeping records to meet professional and insurance requirements, and to respond to any complaint or claim | Legitimate interests (Article 6(1)(f)) and, for health information, the establishment or defence of legal claims (Article 9(2)(f)). |
| Sharing information to protect you or someone else from serious harm | Vital interests or legal obligation (Article 6(1)(d) or (c)), and safeguarding of individuals at risk (Data Protection Act 2018, Schedule 1, paragraph 18). |
| Loading embedded content and, if used, analytics | Consent, given through the cookie banner (Article 6(1)(a) and the Privacy and Electronic Communications Regulations). |
Where I rely on consent, you can withdraw it at any time by contacting me. Withdrawing consent doesn't affect anything done before you withdrew it. I do not make any decisions about you by automated means, and I never sell your information or use it for advertising.
Confidentiality and its limits
What you share in therapy is confidential, in line with the BACP Ethical Framework for the Counselling Professions. I discuss my work in regular clinical supervision, which is a requirement of my accreditation; I do this without sharing your name or anything that would identify you.
In rare situations I may need to share information without your consent: if I believe you or someone else is at serious risk of harm, or if the law requires it (for example, in relation to terrorism, money laundering or a court order). Wherever it's possible and safe, I will talk to you first.
Who I share it with
I use a small number of trusted services to run the practice. They process information only on my instructions and are bound by data protection agreements:
| Service | What it does | Where |
|---|---|---|
| Vercel Inc. | Hosts this website | USA / global |
| Formspree Inc. | Delivers messages from the forms on this website to my email | USA |
| Acuity Scheduling (Squarespace Inc.) | Online booking calendar for intro calls | USA |
| Google LLC | Email (Gmail), and, only if you allow them, embedded maps and videos (Google Maps, YouTube) and analytics | USA / global |
| My bank | Receives payments you make by bank transfer | UK |
| Video platform | Secure online sessions, using a platform we agree together | Varies |
I may also share information when required by law, with my professional indemnity insurer or legal adviser if there's a complaint or claim, or with your GP or emergency services in the situations described above.
Transfers outside the UK
Some of these services store information in the United States. Where that happens, transfers are protected by the UK–US data bridge (the UK Extension to the EU–US Data Privacy Framework) where the provider is certified, or by the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.
How long I keep it
| Information | How long |
|---|---|
| Enquiries and intro call details, if we don't go on to work together | Up to 12 months, then deleted |
| Client records and session notes | 7 years after our work ends, in line with professional and insurance guidance, then securely destroyed |
| Invoices and payment records | As long as HMRC requires (currently around 6 years) |
| Your cookie choice | 12 months on your own device, then you're asked again |
Keeping it secure
I keep notes to the minimum needed and store them securely, with access restricted to me. This website uses HTTPS throughout, its fonts are hosted on this site rather than by a third party, and embedded content from other companies only loads after you allow it.
Your rights
Under UK GDPR you have the right to:
- Access the personal information I hold about you.
- Ask me to correct anything that's inaccurate or incomplete.
- Ask me to delete your information, where I don't need to keep it for a legal or professional reason.
- Ask me to restrict how I use it, or object to my using it.
- Receive your information in a portable format (data portability).
- Withdraw consent at any time, where I rely on it.
To use any of these rights, email benwhitetherapy@gmail.com. There's no charge, and I'll respond within one month. I may need to confirm your identity first.
Complaints
If you're unhappy with how I've handled your information, please tell me first so I can try to put it right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or call 0303 123 1113.
Cookies
This website uses only the storage it needs to work, plus optional embedded content and analytics if you allow them. The cookie policy lists exactly what is used. You can change your choice at any time in Cookie settings.
Changes to this policy
I review this policy regularly and will update the date at the top when it changes. If a change affects how I use information you've already given me, I'll let you know.
This service is for adults aged 18 and over. Please don't send information about anyone else without their permission.