Toll Cottage Therapy
Psychotherapuetic Counselling

Your privacy is important to us. 
This notice explains how Toll Cottage Therapy collects, uses, stores, and protects your personal information. Please read it carefully. If you have any questions, contact page.

1. Who We Are
Toll Cottage Therapy  is a sole practice providing psychotherapy based in Northamptonshire.
 

Data Controller
Name: Elizabeth Davis
Email: tollcottagetherapy@icloud.com
Phone: 07879 701594
As data controller, Elizabeth is responsible for deciding how and why your personal data is used, and for ensuring it is handled lawfully and securely.

2. What Personal Data We Collect
Depending on the nature of your contact with us, we may collect and hold the following:
   •    Your name, date of birth, address, phone number, and email address
   •    Emergency contact details
   •    Referral information and your reason for seeking therapy or supervision
   •    Medical and mental health history relevant to your care
   •    Session notes, assessments, and clinical records
   •    Correspondence with you (including emails and letters)
   •    Appointment and attendance records
   •    Billing and payment records
Some of this information — including details about your physical or mental health — is classified as special category data under UK data protection law. It receives a higher level of protection and is only processed where we have a specific legal basis to do so.

3. How We Collect Your Data
We collect your personal data in the following ways:
   •    Directly from you — through enquiry forms, intake assessments, and during sessions
   •    From referrers — such as your GP or another healthcare professional, where you have given consent
   •    Through your use of our services — including appointment and session records

4. Our Legal Basis for Processing
The legal basis for processing personal data is:

Consent – where you voluntarily provide your information through website contact forms, email, telephone, or other means of communication.
Contract – where processing is necessary to provide counselling or psychotherapy services, manage appointments, and fulfil our agreement with you.
Legal Obligation – where processing is required to comply with applicable laws, regulations, safeguarding requirements, or professional obligations.
Legitimate Interests – where processing is necessary for the effective administration, security, and operation of the practice, provided these interests do not override your rights and freedoms.

Special category personal data, including information relating to health and wellbeing, is processed only where permitted under UK data protection law and where appropriate safeguards are in place

5. Who We Share Your Data With
We treat your information as strictly confidential. We will not share your personal data with any third party without your knowledge, except in the following circumstances:
   •    Clinical supervisor: We discuss clinical work with a qualified supervisor as part of our professional obligations. This is done on an anonymised or pseudonymised basis wherever possible. Our supervisor is bound by the same professional duties of confidentiality.
   •    Your GP or referrer: In exceptional circumstances — such as where we have significant concern for your safety or the safety of others — we may share relevant information with your GP or referring professional. Where possible, we will discuss this with you first.
   •    Legal or regulatory obligation: Where we are required by law to disclose information — for example, to prevent serious harm, or in response to a court order.
   •    Professional indemnity insurer: In the event of a complaint or claim, limited information may be shared with our insurer on a strictly confidential basis.
We do not sell, rent, or share your personal data for marketing purposes.
Zoom: We use Zoom for online therapy sessions. Zoom may process connection data (such as IP address and device information) as part of delivering the service. We use Zoom in compliance with its data processing terms. You can review Zoom's privacy policy at https://zoom.us/privacy. Sessions are not recorded without your explicit consent.

6. How Long We Keep Your Data
We retain personal data only for as long as necessary. Our standard retention periods are:
   •    Adult clinical records: Seven years from the date of last contact
   •    Records where the client was a minor: Until their 25th birthday, or seven years from last contact — whichever is longer
   •    Financial and billing records: Six years (in line with HMRC requirements)
   •    Enquiries that did not proceed to therapy: One month from last contact, then securely deleted
After the relevant retention period, records are securely destroyed. Paper records are shredded; digital records are permanently deleted.

7. How We Keep Your Data Secure
We take the security of your personal data seriously. Our measures include:
   •    Password-protected and encrypted devices
   •    Secure, locked storage for any paper records
   •    Using only secure, reputable platforms for digital communication and session delivery
   •    Limiting access to your data to those who need it for your care
In the unlikely event of a data breach that is likely to affect your rights and freedoms, we will notify you and the Information Commissioner's Office (ICO) as required by law.

8. Your Rights
Under UK data protection law, you have the following rights in relation to your personal data:
Right of Access (SAR): Request a copy of the personal data we hold about you. We will respond within one calendar month.
Right to Rectification: Ask us to correct inaccurate or incomplete data we hold about you.
Right to Erasure: Ask us to delete your data where there is no longer a lawful reason to hold it. Note that professional retention obligations may apply to clinical records.
Right to Restrict Processing: Ask us to limit how we use your data — for example, while a dispute is being resolved.
Right to Object: Object to processing carried out on the basis of legitimate interests.
Right to Data Portability: Request your data in a structured, commonly used format where processing is based on consent or contract.
To exercise any of these rights, please contact Rachel at mailto:rachel@humannurture.co.uk. We will acknowledge your request within 30 days and respond without undue delay. There is no charge for making a request.
Our full Subject Access Request Policy is available on request.

9. Complaints
If you are unhappy with how we have handled your personal data, you have the right to complain to the Information Commissioner's Office (ICO):
   •    Website:  www.ico.org.uk 
   •    Phone:  0303 123 1113 
   •    Post:Wycliffe House, Water Lane, Wilmslow, SK9 5AF
You may also raise a concern with us directly using our Complaints Procedure, which is available on this website and on request.

10. Changes to This Notice
We review this Privacy Notice annually and update it whenever there is a change in how we process data or in the law. The current version is always available on this page. Where changes are significant, we will take reasonable steps to inform you directly.

This notice was last reviewed June 2026.