Privacy notice

This page explains what personal information I hold about you, why, and what your rights are. It is written to be read, not to be scrolled past. If anything is unclear, ask me.

Who is responsible for your information?

I am: Mandy van Zwam, a psychotherapeutic counsellor practising in Beeston, Nottingham. I am the "data controller" in the language of the law. I am registered with the Information Commissioner's Office (ICO), registration number [to be added]. You can contact me at mandy@highfieldstherapy.co.uk.

What information do I hold, and why?

If you email me

I keep your email address, your name if you give it, and whatever you write. I use it to reply to you and, if we go on to work together, as part of your record. If you join the waitlist, I keep your details until a place comes up or you ask to come off it, whichever is first. If we don't go on to work together, I delete the exchange six months after that.

If you become a client

I keep your contact details, the agreement we sign, brief notes of our sessions, and records of appointments and payments. I keep an emergency contact and your GP's details, which I would use only if I were seriously worried about your safety. I keep these because I need them to work with you safely and because my professional body and insurer require it. Session notes are brief and are written for my own use in thinking about our work.

Information about your health

Much of what you tell me in therapy is health information, which the law treats as especially sensitive. I hold it on the basis that you have asked me to provide you with therapy and it is necessary for that purpose. I do not use it for anything else.

Who else sees it?

• My clinical supervisor. I discuss my work in supervision, as every therapist must, without identifying you.
• Google, which provides the email service I use. Emails to and from me pass through and are stored on Google's systems.
• Brevo, which runs the waitlist. If you join, Brevo stores your email address on servers in the EU and sends the confirmation email and, when places open, my emails to the list. Brevo does not tell me who opened an email or clicked a link. Every email has a link to leave the list.
• Cloudflare, which hosts this website and forwards email sent to my practice address to my inbox. When you visit, Cloudflare sees your IP address and the pages you request, as any web host does. This site uses no cookies and no analytics, and I do not see who visits it.
• Nobody else, except where the law requires it or where I believe you or someone else is at serious risk, as explained in our agreement.

How long do I keep it?

Client records are kept for seven years after our work ends, which is what my insurer and professional guidance ask for, and then securely deleted. Enquiries that don't lead to therapy, including waitlist entries, are deleted six months after our last contact.

How is it kept safe?

Records are stored securely, and only I can access them.

Your rights

You can ask to see the information I hold about you, ask me to correct it, and in some cases ask me to delete it or to stop using it. You can withdraw from therapy at any time. To use any of these rights, email me. If you are unhappy with how I have handled your information, you can complain to the Information Commissioner's Office or call them on 0303 123 1113.

This website

This site sets no cookies and runs no tracking of any kind. Email links open your own email program. The waitlist form sends only your email address, to Brevo, as described above. This notice was last reviewed on the date shown at the foot of the page, and I will update it if anything changes.