Privacy Policy — How I Look After Your Information

I'm Brian Sheppard, a clinical psychotherapist and mental health specialist, UKCP registered, working online as Online Therapist In London. I work on my own, so I decide how your information is used and I'm responsible for looking after it. In data protection law, that makes me the “data controller”.

I'm registered with the Information Commissioner's Office (ICO), the UK's data regulator, as a data controller. My registration number is ZC269237.

You can contact me about anything on this page at brian@onlinetherapistinlondon.co.uk.

When you get in touch: what you choose to send me, through the booking form, by email, by WhatsApp or by phone. On the form that's your name and email address, and, only if you add them, a phone number, good times to talk and a short message.

If we work together: your contact details, brief notes of our sessions, and a record of the fees you've paid. If we agree it's needed, I may also ask for your GP's details or an emergency contact.

What I don't collect: card details (I'm paid by bank transfer), recordings of sessions (nothing is ever recorded), or anything you haven't chosen to tell me.

When you press “Send message”, your enquiry travels over an encrypted connection and arrives in my inbox as an email. The website doesn't keep a copy once it has been sent.

If sending fails for a technical reason, one copy is held securely on the web server so your enquiry isn't lost. It's deleted once I've received it. To stop spam, the form also remembers a scrambled, anonymous version of your connection for about an hour. It can't be used to identify you.

Please keep anything very personal for the call. A line or two on the form is plenty.

I only use your information to reply to you, arrange and provide therapy, keep appropriate clinical records, take payment and meet my legal and professional duties.

UK data protection law asks me to name the legal basis for each of these:

• Replying to an enquiry and providing therapy: the steps you've asked me to take before we agree to work together, and then our agreement itself.
• Health information: this is “special category” information. I hold it to provide health care as a registered professional bound by a duty of confidentiality. When you send me an enquiry, you also give your explicit consent by ticking the box on the form.
• Keeping records and accounts: my legal and professional obligations.
• Keeping the website secure: my legitimate interest in stopping misuse.

I never sell your information, and I don't share it with anyone for marketing. The only other people or services involved are:

• The tools I use to work: my email provider, Zoom for sessions, WhatsApp if you choose to message me there, my web host and my bank. They process information on my behalf, under their own security and confidentiality terms.
• Clinical supervision: like every registered psychotherapist, I discuss my work with a supervisor, but never in a way that identifies you.
• When the law requires it: for example a court order, or a serious risk to your safety or someone else's. These rare exceptions are explained under confidentiality in my terms.

Enquiries that don't lead to sessions: deleted once it's clear we won't be working together, and within 12 months at most.

Session notes and records: kept for 6 years after our last session, in line with professional guidance, then securely destroyed. Financial records are kept as long as the tax rules require.

Notes are kept to a minimum and stored securely. My devices and accounts are password-protected, the website only accepts encrypted connections, and nobody else has access to my records. If something ever went wrong and your information was exposed, I'd tell you promptly and report it to the Information Commissioner's Office when the law requires.

You can ask me, at any time and free of charge, to:

• give you a copy of the information I hold about you
• correct anything that's wrong
• delete your information (unless I have to keep it by law, for example safeguarding records)
• stop or limit how I use it, or object to a particular use
• send it to you, or to someone else, in a usable format
• withdraw your consent, which won't affect anything done before you withdraw it

Just email me at brian@onlinetherapistinlondon.co.uk. I'll reply within one month.

This website doesn't set any cookies and doesn't track you. That's why you haven't been asked to accept any. If that ever changes, this page will be updated first, and you'll be asked before anything is stored on your device.

Links on this site to WhatsApp, Zoom and other websites follow those services' own privacy policies.

Please tell me first. Most things can be put right quickly. If you're still not satisfied, you have the right to complain to the Information Commissioner's Office, the UK's data regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

If I change how I use your information, I'll update this page and the date on it. If you're a current client and the change affects you, I'll tell you directly.