Privacy Notice
How Thinking Free handles and protects your information
1. Who is responsible for your information?
John R. D. Taylor, trading as Thinking Free, is the data controller for personal information collected and used in connection with enquiries, appointments and therapeutic services.
Thinking Free is registered with the Information Commissioner’s Office (ICO).
This privacy notice explains what information I collect, why I collect it, how it is stored, when it may be shared, how long it is retained and your rights in relation to it.
2. Legal framework
Thinking Free handles personal information in accordance with the UK GDPR and Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, together with other applicable UK data-protection law.
3. The information I may collect
- your name and contact details
- date of birth where relevant
- emergency contact information where appropriate
- GP details
- appointment dates and attendance information
- assessment forms and information
- therapy notes
- relevant background information
- broad medical, health and medication information relevant to therapy
- information about mental or emotional health
- relationship or psychosexual information where relevant to the work
- clinically or administratively relevant correspondence
- consent and client-agreement records
- information you ask me to send to another healthcare professional
I aim to collect only information that is relevant and reasonably necessary for the work we are undertaking.
4. Special-category information
Therapy may involve information concerning physical or mental health, relationships, sex life or sexual orientation. Under UK data-protection law, some of this is special-category personal data and receives additional protection.
For ordinary personal information, my principal lawful bases are that processing is necessary to take steps at your request before entering a contract, to provide the therapeutic service you have booked, and for proportionate legitimate interests such as secure professional record keeping and dealing with complaints, insurance matters or legal claims. I may also process information where necessary to comply with a legal obligation.
For special-category information used in therapy, I normally rely on your explicit consent. Where relevant, special-category information may also be processed where necessary for the establishment, exercise or defence of legal claims, safeguarding, vital interests or another condition provided by law.
You may withdraw consent where processing is based on consent. This does not make earlier lawful processing unlawful, although in some circumstances withdrawing consent may mean I can no longer provide a therapeutic service that depends on that information.
5. Why I use your information
- responding to your enquiry
- arranging appointments
- assessing whether the therapy I provide is appropriate for you
- providing psychotherapy, counselling, clinical hypnotherapy or related therapeutic services
- keeping an appropriate clinical record
- communicating with you about appointments
- processing payments
- maintaining professional and insurance records
- providing information to another professional where you have asked me to do so
- professional supervision
- safeguarding where necessary
- complying with legal obligations
- establishing, exercising or defending legal rights or claims
I do not use client information for direct marketing, promotional email, newsletters or marketing text messages.
6. Is providing information compulsory?
You are not generally under a statutory obligation to provide personal information to Thinking Free. However, I need enough information to respond to an enquiry, manage a booking, assess suitability and provide therapy safely. If necessary information is not provided, I may be unable to offer or continue the service.
7. How clinical records are stored
My practice is deliberately paper-based wherever possible.
Clinical records are principally kept as paper records in locked filing cabinets in my private home office. Access is limited to me.
Information identifying a client is stored separately from the main clinical notes wherever practical, with both sets of records kept securely locked.
I do not routinely keep electronic clinical records on my computer, laptop, mobile phone or cloud-storage services.
8. Email
My professional email is hosted by IONOS. Emails may temporarily contain personal information when you contact me or when I respond to you.
I do not retain client emails indefinitely. Where correspondence needs to form part of the clinical record, I may print it and place it in the paper client file. The electronic version is then deleted when it is no longer required.
You should avoid sending detailed or highly sensitive clinical or medical information by ordinary email unless this has been agreed.
9. Website enquiries
The Thinking Free website provides a contact form intended only for your name, email address, optional telephone number and a brief enquiry.
Please do not use the contact form to provide detailed medical, psychological, psychosexual or other sensitive information.
Contact-form submissions are not intentionally stored in a website database. They are sent to me by email and are then handled according to the email arrangements described in this notice.
10. Acuity Scheduling
Thinking Free uses Acuity Scheduling to manage appointments. Acuity may hold your name, email address, telephone number, appointment date and time, basic appointment information, and confirmation that you have accepted the applicable Terms and Privacy Notice.
I do not use Acuity to store therapy notes, assessment information or detailed clinical information.
Once your work with Thinking Free has ended, information held within Acuity is deleted when it is no longer reasonably required for appointment administration.
11. Payments
Payments may be processed using PayPal, including through a PayPal card reader. PayPal processes payment information under its own data-protection arrangements.
If you pay by direct bank transfer, your bank and my bank will hold the transaction information generated through the banking system.
Thinking Free does not provide clinical information to PayPal, banks, accountants or bookkeepers. Financial records retained for accounting purposes are limited to what is necessary for financial and legal administration.
12. Telephone, text and WhatsApp
Clients may contact me by telephone, text message or WhatsApp for practical communication relating to appointments or occasional brief queries.
I do not normally store client telephone numbers in my phone under identifying client names.
Text messages are deleted once they have been actioned unless information contained within them needs to form part of the clinical record. Where appropriate, that information may be printed and placed on the paper file.
WhatsApp conversations are deleted when the therapeutic contact has ended and are not intentionally backed up to Google Drive or iCloud. WhatsApp and telecommunications providers operate under their own privacy arrangements.
13. Zoom and online therapy
Online therapy may take place through Zoom. Sessions are not routinely recorded.
If you choose to record a session yourself, the security, storage and confidentiality of your copy becomes your responsibility.
If you ask me to make a recording, the recording is temporarily created on my password-protected laptop, uploaded temporarily to the Thinking Free website so that you can access it, and the local recording and website copy are deleted as soon as practicable and in any event within 24 hours. I do not retain a permanent copy.
Once you have downloaded or received the recording, you are responsible for keeping your copy secure and confidential.
14. Letters and reports
If you ask me to write to your GP or another professional, I will normally obtain your written consent before sharing information.
A temporary electronic copy of a letter may be created on my computer for this purpose. Once the document has been printed for the client record and transmitted appropriately, the electronic copy is deleted from my computer.
15. Sharing information and confidentiality
Therapy is confidential. I do not routinely share client information with other people or organisations.
Information may be shared with your GP or another professional where you have asked me to do so and given appropriate consent; in anonymised form during professional supervision; where disclosure is required by law or court order; where there is a safeguarding concern; where there is a serious risk of harm; or where disclosure is otherwise necessary and lawful to protect vital interests or meet a professional or legal responsibility.
Where reasonably possible, I will discuss disclosure with you before it occurs unless doing so would create additional risk, prejudice a safeguarding matter or conflict with a legal requirement.
16. Professional supervision
I undertake professional supervision as part of responsible clinical practice. Clinical situations may be discussed in supervision, but clients are not normally identified. Only the minimum information necessary for effective supervision is used.
17. Children and young people
Thinking Free is primarily an adult practice, although I may occasionally work with clients under the age of 18. I generally prefer to work with young people aged 13 and over, although younger children may occasionally be seen where appropriate.
Where a client is under 18, I normally obtain appropriate consent from a person with parental responsibility and also explain the therapeutic arrangement to the young person in a way suited to their age and understanding. Where appropriate, I will seek the young person’s own agreement to the therapeutic work.
Confidentiality and its limits will be explained to both the young person and parent or person with parental responsibility. The young person’s privacy and data-protection rights remain relevant and will be considered according to their age, understanding and circumstances.
18. How long information is retained
Adult clinical records are normally retained for seven years after therapy ends, reflecting professional and insurance requirements. After that period, records are securely destroyed unless there is a lawful reason why they need to be retained for longer.
For clients who were under 18 during therapy, records may need to be retained for longer where insurance requirements, limitation periods or other legal considerations make this necessary. Records relating to children will therefore be reviewed before destruction rather than automatically destroyed solely because seven years have elapsed.
Appointment information held in Acuity, ordinary emails, texts and WhatsApp communications are deleted sooner when they are no longer necessary. Temporary Zoom recordings made at a client’s request are deleted within 24 hours after being made available for transfer.
19. Destruction of records
Paper clinical records that have reached the end of their retention period are securely destroyed by shredding and may subsequently be burned.
Electronic information is permanently deleted when it is no longer required, subject to the practical operation of relevant service-provider systems and any legal requirement to retain it.
20. Security
- locked physical filing cabinets
- restricted access to records
- separation of identifying information and clinical notes where practicable
- password protection on computers
- biometric and password protection on mobile devices
- avoiding routine electronic storage of clinical notes
- prompt deletion of temporary electronic files
- limited collection of information through online systems
- deletion of communications when no longer required
21. Third-party service providers and international processing
Thinking Free may use third-party services including IONOS, Acuity Scheduling, PayPal, Zoom, WhatsApp/Meta, and banking and telecommunications providers.
Some of these providers may process or store information outside the United Kingdom. Where this occurs, I use established providers and rely on the data-protection arrangements and transfer safeguards applicable to their services. Information about the privacy and international-transfer arrangements of individual providers is available through their own privacy notices.
22. Automated decision-making
Thinking Free does not use automated decision-making or profiling to make decisions about whether you receive therapy or how your therapy is provided.
23. Your data-protection rights
- the right to be informed about how your information is used
- the right to request access to your personal information
- the right to have inaccurate information corrected
- the right to request erasure in certain circumstances
- the right to request restriction of processing
- the right to object to certain processing
- the right to data portability where applicable
- the right to withdraw consent where processing is based on consent
Some rights are not absolute. For example, I may need to retain information where there is a lawful reason to do so, including the establishment or defence of legal claims.
Your right to object: where I rely on legitimate interests as a lawful basis, you have the right to object to that processing. I will consider your objection and stop the processing unless there are compelling legitimate grounds to continue or the processing is needed for legal claims.
To exercise your rights, contact John R. D. Taylor at Thinking Free, Craven Clinic, Mount Pleasant, High Street, Skipton, BD23 1JZ, or email john@thinkingfree.co.uk.
24. Data-protection complaints
If you think Thinking Free has not handled your personal information properly, you can make a data-protection complaint directly to me by email or post using the contact details above.
I will acknowledge receipt of a data-protection complaint within 30 days, take appropriate steps to investigate it without undue delay, keep you reasonably informed of progress, and tell you the outcome without undue delay.
You also have the right to complain to the Information Commissioner’s Office (ICO). Information is available at www.ico.org.uk.
25. Cookies and similar technologies
The Thinking Free website currently uses only essential browser storage needed for the operation and security of the website and to remember that you have acknowledged the privacy and cookie notice. Thinking Free does not currently use advertising cookies, behavioural tracking cookies or analytics cookies.
The website may load content or functionality from established third-party providers. Those providers may process technical connection information under their own privacy arrangements. If Thinking Free introduces optional analytics, advertising or other non-essential cookies in future, they will not be activated until an appropriate consent mechanism has been provided.
You can remove stored website data at any time using the privacy or site-data controls in your browser. If you clear the stored privacy preference, the notice may appear again on your next visit.
26. Changes to this notice
This notice will be reviewed periodically and updated where the practice, technology or legal requirements change. The current version will be published on the Thinking Free website.