Privacy Notice

30.10.2026

This notice explains how I collect, use and protect your personal information when you contact me or work with me for therapy, coaching or supervision.

Who I am

Yvonne Mountford Therapy Ltd (company number 17363587) is the data controller for your information. This means I decide how your information is used and I am responsible for keeping it safe.

  • Address: Suite 8, Marple House, 39 Stockport Road, Marple, SK6 6BD

  • Email: yvonnemountfordcbt@gmail.com

  • Phone: 07798 907726

  • ICO registration number: ZB939998

If you have any questions about this notice or your information, please contact me using the details above.

What information I collect

Contact and practical details: your name, date of birth, address, email, phone number, GP details, emergency contact, and, for insurance clients, your insurer, membership number and authorisation code.

Health and clinical information: the reasons you are seeking support, your history, questionnaire and outcome measure scores, risk assessments, safety plans, session notes, letters and reports. This is special category data under UK GDPR and is treated with extra care.

Payment information: invoices and payment records. If you choose to keep a card on file, card details are held by Stripe, not by me.

Communications: emails, messages sent through the client portal, and any journal entries you choose to share with me.

Enquiries: if you contact me but do not go on to start sessions, I keep only the details needed to respond to your enquiry.

Children and young people

I work with children from age 7. I collect information from the young person and from their parents or carers. I also record the details of parents, carers or other professionals, such as social workers, who are involved in a young person's care. Where a young person is able to understand and make decisions about their own care, I will involve them in decisions about how their information is shared, including with their parents.

Why I use your information and the legal basis

I use your information to provide therapy, coaching or supervision, keep accurate clinical records, manage appointments and payments, keep you safe, and meet my professional and legal obligations.

Under UK GDPR, my legal bases are:

  • Contract (Article 6(1)(b)): to provide the service we have agreed.

  • Legal obligation (Article 6(1)(c)): for example, keeping financial records for HMRC.

  • Legitimate interests (Article 6(1)(f)): for example, responding to enquiries and running my practice.

  • Health and social care (Article 9(2)(h)): for your health information, as I am a BABCP accredited therapist bound by a duty of confidentiality, under the Data Protection Act 2018, Schedule 1, Part 1, paragraph 2.

  • Safeguarding (Data Protection Act 2018, Schedule 1, Part 2, paragraph 18): where I need to share information to protect a child or adult at risk.

I do not use your information for marketing, and I never sell it.

Confidentiality and when I may share information

What you share with me is confidential. I will usually only share information with your agreement, for example with your GP, school or insurer.

I may need to share information without your consent if:

  • there is a serious risk of harm to you or someone else

  • there is a safeguarding concern about a child or adult at risk

  • I am required to by law or a court order

Wherever it is safe to do so, I will talk to you before sharing anything.

Clinical supervision: like all accredited therapists, I have regular supervision to make sure my work is safe and effective. I discuss my work anonymously, without names or identifying details. Sessions are only ever recorded for supervision with your written consent.

Insurers and funders: if your sessions are funded by an insurer or organisation such as Rehab Network, I share the information needed for billing and, where required, progress reports. I will always tell you what is shared.

How your information is stored

Your records are held in My-Therapy-Suite, a secure practice management system designed for UK therapists. This includes your contact details, appointments, forms, session notes, invoices and portal messages. All records are stored on servers in the United Kingdom, encrypted both in transit and when stored. My-Therapy-Suite staff cannot read your records in day to day operation.

Any paper notes are kept locked away and digitised or securely destroyed. Archived records are kept in encrypted, password-protected storage.

Use of AI

I use AI tools to help write up session notes. Currently these are Heidi Health and the note-taking tools within My-Therapy-Suite, provided by Anthropic and, as a backup, OpenAI. Where information is processed outside the UK, it is protected by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. These providers do not keep your information after processing it and are not allowed to use it to train AI models. I review all notes myself, and AI is never used to make decisions about your care.

Online sessions

Online sessions take place through the secure video platform in My-Therapy-Suite or Google Meet. Sessions are not recorded unless you have given written consent for supervision. Recordings are only accessible to me and are deleted once used.

Card payments

If you choose to keep a card on file, your card details are held securely by Stripe. I never see or store your full card number.

Who helps me run the practice

A small number of trusted organisations help me provide my service. Each only uses your information on my instructions and is bound by a written agreement to keep it safe.

  • My-Therapy-Suite: client records, appointments, portal, messaging, video and invoicing (UK hosted)

  • Heidi Health: AI assisted session note writing

  • Stripe: card payments

  • Healthcode: sending invoices to health insurers

  • Xero: business accounts and invoices

  • Google: email and calendar (calendar entries use initials only)

  • My practice assistant: appointments, invoicing and admin, under a data processing agreement

  • My accountant: financial records only, never clinical information

How long I keep records

  • Adult clinical records: 7 years after our last contact

  • Children and young people’s clinical records: until their 25th birthday, or 7 years after our last contact, whichever is later

  • Financial records: 6 years, as required by HMRC

  • Enquiries that do not lead to sessions: up to 12 months

  • Supervision recordings: deleted once used for supervision

Your rights

You have the right to:

  • ask for a copy of the information I hold about you

  • ask me to correct anything that is wrong

  • ask me to delete your information, where I am not required to keep it

  • ask me to limit how I use it, or object to how I use it

  • ask for your information to be transferred to someone else

To make a request, contact me using the details above. I will respond within one month. There is usually no charge.

Some rights are limited for clinical records, for example I must keep records for the periods above, and I may not be able to share information that would put you or someone else at risk.

How to complain

If you are unhappy with how I have handled your information, please talk to me first so I can try to put it right.

You also have the right to complain to the Information Commissioner's Office (ICO):

  • Website: ico.org.uk

  • Phone: 0303 123 1113

Changes to this notice

I review this notice regularly and will update it if anything changes. The date at the top shows when it was last updated.