Privacy Policy – Good Therapy Ltd

How We Collect Data

• Directly from you – via enquiry forms, intake forms, email, phone, or during therapy sessions.

• From referrers (e.g., GPs, insurers, or referral partners).

• Through our websites (forms, cookies, analytics).

• Via email marketing sign-ups.

​

Legal Grounds for Processing

We rely on:

• Consent – e.g., for marketing communications.

• Contract – to provide psychological services.

• Legitimate Interests – e.g., to ensure service quality, respond to enquiries.

• Legal Obligation – e.g., tax compliance, safeguarding duties.

• Vital Interests – e.g., sharing information to protect life or safety.

• Special Category Data – processed under Article 9(2)(h) UK GDPR (provision of health care).

​

Sharing Your Data

We may share your data with trusted third parties, including:

• Clinical Associates – associates delivering therapy within Plum Psychology practice ( under Good Therapy Ltd).

• Supervisors – anonymised or limited information may be discussed for professional supervision.

• Practice Management & IT Systems – WriteUpp (client notes), Heidi Health AI Notetaker, Zoom (online sessions), Xero (accounting), Mailerlite (email marketing), Wix (website hosting), Click-Up (referral management).

• Professional Support – Accountant, VAs, marketing team, website designer, IT support.

• Referral Partners – where you have been referred via a GP, insurer, or partner organisation.

• Legal, safeguarding, or emergency services – where required by law or to protect safety.

​

All third parties are bound by Data Processing Agreements or confidentiality contracts.

​

Third-party Links

Our websites may link to other sites. We are not responsible for their privacy practices. Please review their privacy policies.

​

Security Measures

• Secure, encrypted cloud storage (WriteUpp).

• SSL encryption, password protection, role-based access.

• Regular backups, audit trails, and data minimisation.

• All personal data incidents, including near misses, are recorded and investigated.

• Breach notification process in place; ICO and affected individuals will be informed where required.

​

Special Category Data

We process special category health data in line with:

• Article 9(2)(h) UK GDPR – provision of health care and treatment.

• Professional codes of practice (HCPC).

• Additional safeguards including encryption, access restrictions, and anonymisation where possible.

​

Children’s Data

We do not provide services directly to children or process children’s data.

​

Your Rights

You have the right to:

​

• Be informed

• Access your data

• Rectify inaccurate or incomplete data

• Erase your data (subject to clinical/legal obligations)

• Restrict processing

• Data portability

• Object to processing (including marketing)

• Withdraw consent at any time

​

Requests will be responded to within one month. Some rights may be limited if records must be retained for legal or clinical reasons.

​

Use of Automation and AI

We use automation and AI for:

• Clinical note support (Heidi Health AI Notetaker - where your explicit consent is given)

• Practice management (WriteUpp reminders, scheduling)

• Email marketing and website analytics

Safeguards:

• DPIAs completed for AI tools

• AI tools set to internal-only learning where possible

• No significant clinical or legal decisions made solely by AI

• Sensitive client data only entered into AI tools with appropriate safeguards

​

Data Retention

• Clinical records: 7 years after last contact (HCPC requirement)

• Financial records: 6 years (legal requirement)

• Marketing data: until consent is withdrawn

• Website analytics/cookies: up to 3 years or until withdrawn

​

Complaints

If you are unhappy with how we handle your data, please contact us at hello@plum-psychology.com.

You also have the right to complain to:
Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
www.ico.org.uk

​

You may also raise concerns with the HCPC (Health and Care Professions Council).

 

Updates

We may update this policy from time to time and will publish the latest version on our websites.