Privacy Policy

This privacy policy explains how Achieve Wellbeing Therapy collects, uses and protects your personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Controller: Cheryl Burgess, Achieve Wellbeing Therapy
Email:
ICO Registration Number: C1490384
Website: https://achievewellbeingtherapy.co.uk

What Information We Collect

When you contact us through the website enquiry form, we collect your name, email address, telephone number (if provided) and any information you include in your message. We do not collect sensitive personal data through the website contact form. If you share sensitive information about your health or circumstances in your message, this is treated with the utmost confidentiality in line with our therapeutic and legal obligations.

When you visit the website, standard technical data may be collected automatically, including your IP address, browser type, pages visited and time spent on the site. This is used solely for website analytics and security purposes.

How We Use Your Information

We use the information you provide to respond to your enquiry, arrange an initial consultation and, if you proceed with therapy, to manage the therapeutic relationship. We do not use your personal information for marketing purposes without your explicit consent. We do not sell, rent or share your personal data with third parties except where required by law or where you have given explicit consent.

Legal Basis for Processing

We process your personal data on the following legal bases under UK GDPR:

Legitimate interests – to respond to your enquiry and manage client communications.
Contract – to fulfil our obligations as part of the therapeutic relationship.
Legal obligation – where we are required to retain or disclose information by law.
Vital interests – in circumstances where there is a serious risk to your safety or the safety of others, we may be required to share information with relevant authorities. This is in line with the BACP Ethical Framework and our duty of care.

Special Category Data

Information about your health, mental health or other sensitive matters shared during therapy is classified as special category data under UK GDPR. This data is processed under Article 9(2)(h) of UK GDPR (processing necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care treatment). All therapeutic records are held securely and in strict confidence in accordance with BACP ethical guidelines.

How Long We Keep Your Data

Enquiry data from people who do not proceed with therapy is deleted within 12 months of the last contact. Therapeutic records for clients are retained for a minimum of 7 years following the end of therapy, in line with professional body guidance and insurance requirements. After this period, records are securely destroyed. If you are under 18, records are retained until your 25th birthday or for 8 years after the end of therapy, whichever is longer.

Data Security

Your data is stored securely. Email communications are transmitted via IMAP with SSL/TLS encryption through our hosting provider 20i. For highly sensitive information we recommend contacting us by telephone rather than email, as standard email carries inherent security limitations. We do not use unsecured platforms for storing client information.

Cookies

Our website uses cookies. Please see our Cookie Policy for full details of what cookies we use and how to manage them.

Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right of access – you can request a copy of the personal data we hold about you.
Right to rectification – you can ask us to correct inaccurate data.
Right to erasure – you can ask us to delete your data, subject to our legal and professional obligations to retain certain records.
Right to restrict processing – you can ask us to limit how we use your data.
Right to data portability – you can ask for your data in a portable format.
Right to object – you can object to certain types of processing.
Right to withdraw consent – where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, please contact us at . We will respond within one calendar month.

Complaints

If you have concerns about how we handle your data, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.

Third Party Services

This website is hosted by 20i. Analytics data may be processed by third party tools. The website uses Complianz or CookieYes for cookie consent management. We do not share personal data with these services beyond what is technically necessary for their operation.

Changes to This Policy

We may update this privacy policy from time to time. The current version will always be available on this page. Last updated: June 2026.