Privacy notice

York Therapy Clinic Ltd
Last updated 15 November 2026

This notice explains how we use personal information when you enquire about our services, arrange appointments, receive care or use our website. It covers our enquiry, matching, administration and clinic-managed record systems, and explains how independent practitioners are involved.

Who we are and how to contact us

York Therapy Clinic Ltd is registered in England and Wales, company number 16801445. Our registered office and postal address for privacy correspondence is Grainger Suite, Regent Centre, Gosforth, Newcastle upon Tyne, NE3 3PF. This is a correspondence address, not an appointment location.

For privacy questions or requests, contact the Clinic Director at enquiries@yorktherapyclinic.co.uk or write to the address above.

We are responsible for information used to operate the clinic and the systems we manage. Our practitioners are independent professionals who make their own clinical decisions and may keep separate records for their professional purposes. Contact us if you are unsure who handles particular information; we can help identify the relevant practitioner. 

Information we collect

Depending on your contact with us, we may hold your name and contact details; information about the support you are seeking; appointment, contact and location preferences; enquiry messages and correspondence; clinical information recorded during assessment or therapy; and invoices and payment records. If you contact us about a child or another person, we may receive information about you and that person.

We obtain information directly from you and, where relevant, from parents or carers, practitioners, referrers or other people involved in arranging or supporting care. We also collect website information through the technologies explained below. Please provide only a brief outline in an initial enquiry, rather than a detailed clinical history.

Why we use information

• To respond to enquiries, explore suitable practitioners and arrange requested services.

• To manage appointments, service communications, invoices and payments, and support assessment and care.

• To manage clinical records, risk and safeguarding matters, complaints and relevant professional or legal responsibilities.

• To operate and protect our website and systems, understand website use and manage online advertising, according to the settings and permissions that apply.

Enquiries are stored in our WordPress website system and sent to our enquiry inbox, hosted through Hostinger. Client records are also held in WriteUpp. Payments are made by bank transfer to York Therapy Clinic Ltd.

Using and sharing your information

Legal grounds for using information

Where you request or enter into a contract with us, we use information necessary to take those requested steps and perform that contract. Where this basis does not apply, such as certain arrangements involving a child or another person, we rely on our legitimate interests in responding to requested support and administering appropriate services, after considering the interests and rights of the people concerned.

We rely on legal obligations where a specific law requires processing. We may rely on legitimate interests for proportionate system security, administration and handling complaints or legal claims where another basis does not apply. Where consent is required, including for relevant website tracking or particular disclosures, we seek it and explain how to withdraw it.

Health information needs an additional legal condition. For healthcare and its administration, the proposed condition is Article 9(2)(h) of the UK GDPR with the relevant Data Protection Act 2018 condition, subject to the required professional responsibility and confidentiality safeguards. Other uses, such as specific safeguarding or legal-claims processing, require the condition appropriate to the circumstances.

Matching you with a practitioner

To explore a suitable match, we may forward your full enquiry, including any health information you include, to potential independent practitioners. An administrator may contact you first if clarification is needed. You can contact us before sending an enquiry if you would like to discuss what information is needed or how it will be shared.

Who can access information

The Clinic Director and administrative team can access information in our enquiry and clinic systems. This includes independent virtual assistants, some based in the UK and some in India or the Philippines. Shared clinical records in WriteUpp are also accessible to the treating practitioner, the Director and administrators. Clinical-note access by administrators is intended for necessary risk or safeguarding support, authorised by the Director, rather than day-to-day administration.

We use suppliers for services such as email, clinical records and online consultations. Practitioners may use Zoom, Microsoft Teams, WhatsApp Video, Google Meet or FaceTime. The platform used for your appointment should be explained when it is arranged. We do not record or transcribe client calls or therapy sessions.  Any transcriptions made automatically (such as those from built in AI transcription tools) are deleted following transfer of record into notes or immediately following the session.

Other disclosures and confidentiality

We may share relevant information with your GP when necessary for care or at your request. We seek consent for routine disclosures of clinical information outside the arrangements explained in this notice. Practitioners use anonymised information in clinical supervision. Employers, businesses or sponsors receive information needed for invoicing, or other information agreed with you; paying for care does not automatically entitle them to clinical details.

Confidentiality has limits. Relevant information may be shared without consent where necessary and lawful to address serious risk or safeguarding concerns, or to meet a legal obligation. Any disclosure should be limited to what is needed for the circumstances.

Storage retention and your choices

Overseas access and storage

Some of our administrative contractors access information from India and the Philippines. Remote access can involve a transfer outside the UK, even when the underlying system is hosted elsewhere. Suppliers may also process information outside the UK according to their service arrangements.

Some administrative support is provided by independent contractors based in India and the Philippines. They can access enquiry information, including health information included in messages. They may also access clinical records for risk or safeguarding purposes where authorised by the Clinic Director.

We have completed a transfer risk assessment for this overseas access. We are still finalising the contractual transfer safeguards; these arrangements are not yet complete for every overseas contractor.

For information about overseas access and the safeguards currently in place, including copies of any applicable transfer safeguards, contact the Clinic Director at Stuart@yorktherapyclinic.co.uk.

How long we keep information

• Enquiries that do not progress to assessment or care: proposed deletion 5 years after the last meaningful contact, in case of documented complaint, safeguarding matter or legal obligation.

• Adult clinical records: proposed retention for seven years after the last clinical contact, subject to confirmation of applicable professional, insurance, contractual and legal requirements.

• Children’s clinical records: proposed retention for seven years after the last clinical contact, subject to confirmation of applicable professional, insurance, contractual and legal requirements.

• Invoices, payment records and other categories: proposed retention for seven years after the last clinical contact, subject to confirmation of applicable professional, insurance, contractual and legal requirements.

Relevant information from an enquiry that becomes part of an assessment or care record follows the clinical-record schedule. Unnecessary duplicates may be removed sooner. Complaints, safeguarding matters, legal claims and other justified requirements may affect retention. 

Some practitioners also keep records separately from York Therapy Clinic’s systems. Where a practitioner independently controls those records, they are responsible for providing privacy information, including how long records are retained and how deletion requests are handled. You can contact your practitioner for details, or contact us for help identifying the appropriate person.

Children and young people

We handle information about children and young people with particular care. Information may come from the young person, parents or carers, referrers and practitioners. Consent, parental involvement and confidentiality depend on the circumstances, the young person’s understanding and applicable law; parents are not automatically entitled to all clinical information. The practitioner should explain the arrangements relevant to the work, including safeguarding limits. 

Website cookies analytics and advertising

We use Google Analytics and Google Ads. We use Complianz to manage cookie preferences. These tools can involve information about devices, identifiers and website interactions. Our cookie notice should explain the technologies actually used, their purposes, providers and durations.

Where consent is required, the relevant technologies should run only after you consent. You can change or withdraw your choices through [cmplz-document type=”cookie-statement” region=”uk”]. We do not send newsletters or other marketing emails; our direct messages relate to enquiries, appointments and care.

Your rights and contacting us

Your information rights

Depending on the circumstances and the legal basis involved, you may ask to access your personal information, correct inaccurate information, erase information, restrict its use or receive information in a portable format. These rights have limits; for example, we may need to retain records for a justified professional or legal purpose.

Your right to object: you can object to processing based on legitimate interests. We will consider your objection and explain whether we have grounds to continue. Where processing relies on consent, you can withdraw that consent; withdrawal does not affect processing that was lawful before withdrawal.

Contact the Clinic Director using the details at the start of this notice. We may need to verify your identity and clarify the information requested. We will respond within the applicable legal time limits and explain any lawful extension or restriction. Requests relating to separately held practitioner records may need to be handled by that practitioner; we can help you identify the relevant contact.

If you have a concern

Please contact the Clinic Director at enquiries@yorktherapyclinic.co.uk so that we can consider your concern. You can also complain to the Information Commissioner’s Office. Information about making a complaint is available at ico.org.uk/make-a-complaint/ . You do not have to obtain our permission to contact the ICO.

Updates

We will review this notice when our practices change and update the date above. We will explain significant changes where appropriate.