Privacy Policy

1. Who is responsible for your information?

therapyforyou is operated by Lisa Marini, BABCP Accredited Cognitive Behavioural Therapist, providing private Cognitive Behavioural Therapy (CBT) exclusively online.

Lisa Marini is the data controller responsible for personal information processed in connection with therapyforyou.

I am registered with the Information Commissioner's Office (ICO) in relation to my data protection obligations.

For questions about your personal information, this Privacy Policy or the exercise of your data protection rights, please contact:

Email: hello@therapyforyou.io

2. Professional status and confidentiality

I am an Accredited Cognitive Behavioural Therapist with the British Association for Behavioural and Cognitive Psychotherapies (BABCP) and practise in accordance with applicable BABCP professional standards, including the Standards of Conduct, Performance and Ethics.

Information disclosed in therapy is treated confidentially, subject to the usual professional, legal, safeguarding and safety-related limits of confidentiality.

Data protection obligations operate alongside my professional duty of confidentiality.

3. What information do I collect?

Depending on how you use therapyforyou, I may collect information including your name and surname, email address, telephone number where provided, information submitted through the website contact form, information provided when arranging a consultation or therapy appointment, appointment and scheduling information, payment and transaction information, correspondence, information relating to your use of the website, cookie and analytics preferences and information you provide during assessment or therapy.

Technical information may also be processed when you use the website, such as browser or device information, IP-related technical information, website requests, pages visited and security or diagnostic information.

I aim to collect only information that is relevant and reasonably necessary for the purposes described in this Privacy Policy.

4. Health information and special category data

As therapyforyou provides psychological therapy, information you provide may include information relating to your mental or physical health.

Health information is special category personal data under UK data protection law and receives additional protection.

Where health information is necessary for assessment, treatment, clinical record keeping or the provision of therapy, I generally process it under Article 9(2)(h) UK GDPR, together with Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018, where applicable, in connection with the provision and management of health treatment and subject to professional confidentiality obligations.

In particular circumstances, another condition under Article 9 UK GDPR and the Data Protection Act 2018 may apply, for example where processing is necessary in connection with safeguarding, legal claims or another legal obligation.

You should not include detailed or unnecessary sensitive clinical information in an initial website enquiry, contact form or free consultation scheduling form.

5. Why I use your information and my lawful bases

The lawful basis used depends on why the information is being processed.

Where I rely on legitimate interests, those interests include operating and protecting the website and my professional practice, maintaining appropriate security, preventing misuse, resolving disputes and protecting my legal rights. I consider whether those interests are balanced against the rights and interests of the individuals concerned.

Where processing is based on consent, you may withdraw that consent at any time.

6. Contact form

If you contact me through the therapyforyou website contact form, I may collect your name, surname, email address and the information contained in your message.

This information is used to respond to your enquiry and, where appropriate, discuss therapy or arrange a consultation.

The website contact form is intended for general and administrative enquiries and should not be used to provide detailed clinical, medical or other highly sensitive information.

Messages submitted through the contact form may be transmitted using Resend, which provides email-delivery infrastructure for the website.

7. Calendly

therapyforyou uses Calendly to schedule free consultations.

When you use Calendly to arrange a free consultation, information processed may include your name, email address, consultation date and time and other information you choose to provide when scheduling.

For scheduling information processed on my instructions, Calendly generally acts as a data processor on behalf of therapyforyou. Calendly may also process certain information for its own purposes where it acts as an independent data controller.

Please avoid entering unnecessary clinical or health information into Calendly consultation scheduling fields.

Calendly has its own privacy notice explaining how it processes personal information.

8. Payment processing

Payments for therapy services are processed using Stripe.

When you make a payment, Stripe may process information including your name, email address, billing information, payment details and transaction information.

therapyforyou does not need to receive or store your complete payment-card information.

Depending on the processing involved, Stripe may act as a data processor on behalf of therapyforyou or as an independent data controller for purposes such as fraud prevention, security, compliance and the fulfilment of Stripe's own legal obligations.

Stripe has its own privacy information explaining how it processes personal information.

9. Therapy records and clinical information

If you become a therapy client, information provided during assessment and therapy may form part of your clinical record.

Clinical records may include information about presenting difficulties, relevant personal or medical history, assessment, formulation, treatment, therapy progress, risk or safeguarding matters and correspondence relevant to your care.

Clinical information is kept confidential and is not routinely disclosed to third parties.

Information may, however, be disclosed where you have authorised this, where disclosure is required or permitted by law, where necessary to establish or defend legal rights, or where I reasonably consider disclosure necessary in connection with a serious safeguarding or safety concern.

Where appropriate, clinical matters may also be discussed in professional clinical supervision. Information shared for supervision is limited to what is reasonably necessary and supervision is subject to professional confidentiality requirements.

10. Clinical record retention

Clinical records are retained securely for 7 years from the end of therapy.

The retention period may be extended where there is a legal, professional, regulatory, safeguarding, insurance or other legitimate requirement to retain particular information for longer.

At the end of the applicable retention period, information will be securely deleted or destroyed unless there is a lawful reason for continuing to retain it.

11. Other records and retention

Different types of information may be retained for different periods.

Where a specific period cannot reasonably be determined in advance, I use appropriate legal, professional, regulatory and practical criteria to determine how long information should be kept.

12. Website hosting, email and other service providers

I use selected third-party service providers to operate therapyforyou.

These include Vercel for website hosting and Vercel Web Analytics, Resend for website email delivery, Calendly for free consultation scheduling, Stripe for payment processing and Google Analytics for optional website analytics.

These providers may process information on my behalf as data processors and, in some circumstances, may separately process information as independent data controllers.

Where a provider processes personal information on my behalf, I seek to use appropriate contractual and data-protection arrangements.

13. Cookies and similar technologies

therapyforyou uses cookies and similar storage or access technologies.

Some technologies are necessary for the website to operate or to remember your privacy choices. Other technologies are optional.

Cookie consent

The website uses a necessary storage mechanism to remember whether you have accepted or declined optional analytics.

This prevents you from having to make the same choice every time you visit the website.

Google Analytics

therapyforyou uses Google Analytics 4 (GA4) to understand general website usage and performance.

Google Analytics is treated as optional analytics and is not activated unless you have given the required consent through the website's cookie controls.

Google Analytics may use cookies including _ga and _ga_<container-id> to distinguish users and maintain session information. The default lifetime of these cookies may be up to two years, although browser restrictions and website configuration can shorten this period.

I do not use Google Analytics for behavioural advertising through therapyforyou.

Vercel Web Analytics

therapyforyou also uses Vercel Web Analytics to understand website usage and performance.

Vercel Web Analytics is designed to operate without analytics cookies and to provide aggregated, privacy-focused website statistics. It uses technical request information to generate short-lived visitor identifiers rather than persistent cross-site tracking identifiers.

For therapyforyou, Vercel Web Analytics is treated as optional analytics and is activated only in accordance with the analytics choice made through the website's privacy controls.

Calendly and external services

Calendly, Stripe and other external services may use cookies or similar technologies when you visit or interact with their own services.

Those technologies are governed by the relevant provider's own privacy and cookie information.

Changing your choice

You can accept or decline optional analytics through the website's cookie controls.

You can change or withdraw your analytics consent at any time using the cookie settings available on the website. Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

14. Sharing your information

I do not sell your personal information.

Personal information may be shared where reasonably necessary with technology providers involved in website hosting, communications, appointment scheduling, payments or analytics; professional advisers such as accountants, insurers or legal advisers; professional or regulatory organisations where appropriate; courts, regulators, law-enforcement bodies or other authorities where required or permitted by law; and relevant professionals or services where necessary to address a serious safeguarding or safety concern.

Only information reasonably necessary for the relevant purpose will be shared.

15. International transfers

Some of the technology providers used by therapyforyou are based outside the United Kingdom or may process or store information in countries outside the United Kingdom, including the United States.

Where UK personal information is transferred internationally, I take steps to ensure that an appropriate transfer mechanism or safeguard is available where required.

Depending on the provider and destination, this may include UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework / UK-US Data Bridge, the International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or another lawful mechanism permitted under UK data protection law.

Further information about the safeguards applying to a particular transfer can be requested by contacting me at hello@therapyforyou.io.

16. Security

I use reasonable technical and organisational measures designed to protect personal information against unauthorised access, misuse, loss, destruction, alteration or disclosure.

This includes seeking to use reputable technology providers, restricting access to information where appropriate and following professional confidentiality and data-protection obligations.

No website, email system or internet-based service can provide an absolute guarantee of security.

If you send information by email or through an online service, you should therefore avoid including unnecessary sensitive information.

17. Providing information

Some information is necessary for me to respond to an enquiry, arrange an appointment, enter into a therapy agreement, process payment or provide therapy safely and appropriately.

You are not generally required by law to provide personal information simply by visiting the website.

However, if you choose not to provide information reasonably necessary for a requested service, I may be unable to respond fully to your enquiry, arrange an appointment or provide therapy.

18. Automated decision-making

therapyforyou does not use personal information to make solely automated decisions that produce legal effects or similarly significant effects about therapy clients or prospective clients.

19. Your data protection rights

Depending on the circumstances and the lawful basis relied upon, UK data protection law may give you rights to request access to your personal information, request correction of inaccurate or incomplete information, request erasure, request restriction of processing, object to certain processing, request data portability and withdraw consent where processing is based on consent.

These rights are not absolute and may be subject to legal, professional or regulatory conditions and exemptions. For example, information may sometimes need to be retained despite an erasure request where there is a lawful reason to retain it.

To exercise a data-protection right, contact:

hello@therapyforyou.io

I may need to request information reasonably necessary to confirm your identity before acting on a request.

20. Data protection complaints

You have the right to raise a complaint if you believe your personal information has not been handled in accordance with data protection law.

You can make a data protection complaint directly to me by emailing hello@therapyforyou.io. Including “Data protection complaint” in the subject line may help me identify and handle the matter promptly.

I will acknowledge receipt of a data protection complaint within 30 days of receiving it.

I will take appropriate steps to investigate the complaint, keep you appropriately informed where necessary and communicate the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO). You do not need my permission to contact the ICO.

21. Changes to this Privacy Policy

This Privacy Policy may be updated from time to time to reflect changes in therapyforyou, the services provided, the technology used or applicable legal, regulatory or professional requirements.

The latest version will be published on this page together with the date it was last updated.