Your information, handled with care.

Who I am

Eastside Therapy London (ESTL) is the private psychotherapy practice of Alicia Williams, UKCP-registered systemic psychotherapist (registration 2011187845). I am registered with the Information Commissioner's Office as a data controller, registration ZB856740. Contact: alicia@estl.uk.

What information I collect

• Contact details you provide (name, email, phone) when you enquire, book, or request a guide from this site. A guide request is used to send you the guide, and nothing else. I do not run a mailing list.
• Intake information, completed before therapy begins: your full name, date of birth, home address, phone number and email; the address you will normally join online sessions from, if that is not your home; your GP's name, surgery address and telephone number; an emergency contact's name, relationship to you and telephone numbers.
• A record of the consents you give: which version of the documents you signed, the name you signed with, the date, and an image of your signature if you choose to draw one.
• Assessment and session information, including the clinical notes I keep as part of providing therapy. This is special category (health) data.
• Appointment bookings (name, email, phone, appointment time and anything you choose to tell me when booking).
• Payment records: the invoices and receipts I issue, and the date, amount and reference of the bank transfers you make for sessions. I do not take card payments, so I hold no card details.
• Correspondence between us, such as emails, texts and letters exchanged before, during or after therapy.
• Audio or video recordings of sessions, only with your separate, optional, written consent. Declining never affects your therapy.
• Website analytics: this site uses Vercel's cookieless, privacy-respecting page-view counting. There are no advertising or tracking cookies; the booking calendar uses only the strictly necessary browser storage it needs to function.

Why I collect it and my lawful basis

Your health and therapy information is classified as special category data under UK GDPR, which means it receives the highest level of legal protection. I process it on the following lawful bases:

• To respond to enquiries and arrange sessions (legitimate interests / steps prior to entering a contract).
• To provide therapy safely and effectively (contract; for health data, Article 9(2)(h), the provision of health or social care by a registered professional bound by confidentiality).
• To meet legal and professional obligations, including record-keeping and safeguarding.
• Session recordings: your explicit consent (Article 9(2)(a)), withdrawable at any time.

Confidentiality, and who I share your information with

I do not sell your data, and I never share it with anyone for marketing. Beyond the service providers listed further down, no other third party receives your information without your explicit written consent.

What you share in therapy is confidential. There are specific, limited situations where I may need to share information:

• If I believe you or someone else is at serious risk of harm.
• Where the law requires disclosure (for example, safeguarding children or vulnerable adults, or a court order).
• Clinical supervision: like all UKCP-registered therapists, I discuss aspects of my work with a clinical supervisor. This is done without identifying details wherever possible, and my supervisor is bound by the same confidentiality obligations.

Wherever possible I will discuss any disclosure with you first.

The technology I use, and who processes your data

Like most modern practices I rely on a small number of trusted service providers ("data processors"), each used for a specific purpose and bound by data-protection agreements:

• Microsoft. Email and secure document storage for practice records.
• Zoom. Online therapy sessions. Sessions are not recorded to Zoom's cloud.
• Cal.com. Appointment scheduling. Cal.com is GDPR compliant, SOC 2 and ISO 27001 certified, and transfers from the UK are made under the UK's Data Privacy Framework extension.
• FormSubmit. Relays messages from this website's contact forms to my email.
• Vercel. Hosts this website and provides the cookieless visit statistics described above.

I do not sell your data or share it with anyone for marketing. No other third parties receive your information without your explicit written consent.

Where data is stored

Session recordings, whether audio or video, are held in encrypted storage on my own devices and deleted within three months of the session (sooner once reviewed in supervision). They do not form part of your clinical record. Clinical notes and practice records are held on encrypted, password-protected devices and in secured Microsoft cloud storage protected by two-factor authentication.

How long I keep information

• Clinical notes and case records: 7 years from the end of therapy (or until age 25 for clients who were minors), in line with UKCP guidance.
• Session recordings: a maximum of 3 months, or sooner once reviewed in supervision.
• Invoices, receipts and payment records: 6 years from the end of the tax year they relate to, which is the period HMRC requires.
• Correspondence: 7 years from the end of therapy, alongside the clinical record.
• Enquiries from people who do not become clients: deleted after 6 months.

At the end of the retention period, records are permanently and securely deleted.

Your rights

Under UK GDPR, you have the right to:

• Access. Request a copy of the personal data I hold about you.
• Rectification. Ask me to correct inaccurate or incomplete information.
• Erasure. Ask me to delete your data where there is no lawful reason to continue holding it.
• Restriction. Ask me to limit how I use your data while a concern is being resolved.
• Portability. In limited circumstances, ask for certain data in a portable format.
• Object. Object to processing based on legitimate interests.
• Withdraw consent. Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of anything processed before you withdrew.

To exercise any of these rights, email me at alicia@estl.uk. I will respond within one month.

How to raise a concern

If you are unhappy with how I have handled your personal information, you have the right to complain to the Information Commissioner's Office: ico.org.uk or 0303 123 1113. I would always welcome the chance to put something right directly first, so please do come to me before you go to them.

Changes to this notice

I review this notice when my systems or practices change, and at least annually. Last reviewed: September 2026. Next review due September 2027.