‍ ‍

Who we are

‍CBT and EMDR Therapy Solutions is a private therapy practice providing cognitive behavioural therapy and EMDR. I am Kevin Harry Dudman, a cognitive behavioural therapist registered with the British Association for Behavioural and Cognitive Psychotherapies (BABCP).

‍ You can contact me at: cbt.therapysolutions@gmail.com

‍ This privacy policy explains how I collect, use, store, and protect your personal information when you use my therapy services.

‍ What personal data we collect

‍I collect and process the following types of personal information:

‍ Contact and identification details:

‍ ‍

• Your name, address, telephone number, and email address

• Emergency contact details

• GP details (where relevant to your care)

‍ ‍Health and therapy-related information:

‍ ‍

• Details of your presenting issues and reasons for seeking therapy

• Relevant medical and mental health history

• Information about current medications or other treatments

• Session notes recording our therapeutic work together

• Assessment outcomes and progress notes

• Any correspondence between us relating to your therapy

‍ ‍Administrative information:

‍ ‍

• Invoices and payment records

• Appointment dates and scheduling information

• Consent forms and therapy agreements

‍Health and therapy-related information is classified as "special category data" under Article 9(1) of the UK GDPR. This type of data reveals information about your physical or mental health and receives enhanced legal protection. I take particular care to keep this information secure and confidential.

‍How we collect your data

‍I collect your personal information directly from you:

‍ ‍

• When you first contact me to enquire about therapy

• During our initial consultation and assessment

• Throughout our therapy sessions together

• Through email, telephone, or video call communications

• When you complete intake forms, questionnaires, or consent documents

‍I do not collect information about you from third parties unless you have given your explicit consent, or unless you are referred through an Employee Assistance Programme (in which case limited referral information may be provided by the commissioning organisation).

‍Why we process your data — lawful basis

‍Under UK data protection law, I must have a valid legal reason to process your personal information. For therapy services, I rely on the following lawful bases:

‍Article 6 basis (ordinary personal data):

‍Article 6(1)(b) UK GDPR — processing is necessary for the performance of the therapeutic contract between us. When you engage me for therapy, we enter into a contract. I need to process your contact details, appointment information, and payment details to fulfil my side of that agreement.

‍Article 9 special category basis (health data):

‍Article 9(2)(h) UK GDPR — processing is necessary for the provision of health or social care treatment by a health professional. As a qualified cognitive behavioural therapist, I am permitted to process your health information for the purpose of providing your therapy.

‍The additional condition required under UK law is found in DPA 2018 Schedule 1, Part 1, paragraph 2 (health or social care purposes). This processing is carried out by a qualified cognitive behavioural therapist subject to the professional obligation of confidentiality under the BABCP Standards of Conduct, Performance and Ethics.

‍Professional obligations and CPD

‍I am required by the British Association for Behavioural and Cognitive Psychotherapies (BABCP) to attend regular clinical supervision to maintain and develop my professional practice.

I may discuss my therapeutic work with my supervisor.

‍When I do so:

‍ ‍

• Your name and any identifying details are NOT shared with my supervisor

• I use anonymised or pseudonymised case material only, meaning my supervisor cannot identify you from our discussions

• My clinical supervision is provided by a qualified professional bound by the same confidentiality obligations as I am

• My supervisor is bound by their own professional code of ethics and practice

‍ ‍

This supervision is an important safeguard that helps ensure you receive high-quality, ethical therapy.

‍Clinical will — what happens to your records if I am unable to practise

‍I am currently putting arrangements in place for a clinical will. A clinical will is a formal arrangement that ensures your records are handled appropriately and confidentially if I become unexpectedly unable to continue practising due to serious illness, incapacity, or death.

‍Once these arrangements are finalised, I will inform you of the details. In the meantime, please be assured that your records remain securely stored and that I am taking steps to ensure continuity of care and proper record handling in any eventuality.

‍Who we share your data with

‍I treat everything you share with me in therapy as confidential. However, in order to provide my services, I work with a small number of trusted third parties:

‍Clinical supervisor — I discuss my clinical work in supervision using anonymised case material only. Your name and identifying details are never shared.

‍External accountant or bookkeeper — My accountant or bookkeeper has access to invoice data only (your name and amounts paid) for the purposes of accounts and tax compliance. They do not have access to any clinical information.

‍Employee Assistance Programme (EAP) — If you were referred to me through an EAP, limited information may be shared with the commissioning organisation as part of the referral arrangement. This is typically limited to confirmation of attendance and session numbers, not clinical content.

‍Administrative support — I may use administrative help for scheduling and appointment management. This person has access to calendar and contact details only. They do not have access to clinical notes.

‍Third-party technology services:

‍I use the following third-party services which may process your data:

‍ ‍

• Zoom — for video therapy sessions

• Microsoft Teams — for video therapy sessions

‍Each of these services is bound by a data processing agreement that requires them to handle your data securely and in accordance with UK data protection law. Links to their privacy policies are available on request.

‍I never sell your personal data to anyone.

‍International data transfers

‍The following third-party services I use may transfer personal data outside the United Kingdom:

‍ ‍

• Zoom (Zoom Video Communications Inc, USA)

• Microsoft Teams (Microsoft Corporation, USA)

‍Where data is transferred to the USA, I rely on Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs) as appropriate safeguards, in accordance with UK GDPR Chapter V and the updated requirements of the Data (Use and Access) Act 2025.

‍The USA does not currently have a UK adequacy decision, which is why these additional safeguards are necessary.

‍You can request a copy of the relevant transfer safeguards by contacting me at cbt.therapysolutions [at] gmail.com

‍How long we keep your data

‍I retain your personal information for specific periods depending on its type:

‍Therapy records (adult clients): 7 years after our last session, in line with the Limitation Act 1980 and standard professional indemnity insurance requirements.

‍Therapy records (clients under 18 at time of therapy): Until the client reaches the age of 25, or 7 years after our last session, whichever is longer.

‍Financial records: 6 years after the end of the financial year in which the transaction occurred. This is a legal requirement under HMRC rules.

‍Website enquiries (non-clients): 12 months from the date of your enquiry.

‍After the applicable retention period has ended, records are securely destroyed.

‍Your rights under UK GDPR

‍You have the following rights regarding your personal data. I have explained each one in plain language:

‍Right to be informed — You have the right to know how I collect and use your personal information. This privacy policy fulfils that right.

‍Right of access — You can ask me for a copy of the personal information I hold about you. This is sometimes called a "subject access request." Under the Data (Use and Access) Act 2025, I will conduct a reasonable and proportionate search to locate your information and respond within one month.

‍Right to rectification — If any information I hold about you is inaccurate or incomplete, you can ask me to correct it.

‍Right to erasure — In some circumstances, you can ask me to delete your personal information. However, this right is not absolute. I may need to retain your records until the end of the applicable retention period where required by professional guidelines, insurance requirements, or law.

‍Right to restrict processing — You can ask me to limit how I use your information in certain circumstances, for example while I am checking whether information is accurate.

‍Right to data portability — In some circumstances, you can ask me to provide your personal information in a structured, commonly used format so you can transfer it to another service.

‍Right to object — You can object to certain types of processing in specific circumstances. However, as I process your data under contract and for health care purposes, this right has limited application to therapy services.

‍Rights related to automated decision-making — You have the right not to be subject to decisions based solely on automated processing that significantly affect you. I do not use automated decision-making in my practice.

‍ To exercise any of these rights, please contact me at: cbt.therapysolutions@gmail.com

‍ I will respond to your request within one month. There is no fee for most requests, though I may charge a reasonable fee if a request is clearly unfounded or excessive.

‍Data protection complaints — your right under the Data (Use and Access) Act 2025

‍ You have the right to make a data protection complaint directly to me if you are unhappy with how I have handled your personal information.

‍ You can submit a complaint at: https://cbtandemdrtherapysolutions.policydiary.co.uk

Or contact me at: cbt.therapysolutions@gmail.com

I take all complaints seriously and will respond promptly.

If you are not satisfied with my response, you may escalate your complaint to the Information Commissioner's Office (ICO):

‍ ‍

• Website: ico.org.uk

• Telephone: 0303 123 1113

• Address: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

‍Confidentiality exceptions

Everything you share with me in therapy is confidential. However, there are specific circumstances where I may be required to share information without your consent:

Risk of serious harm — If I believe there is an immediate risk of serious harm to you or to another person, I may need to contact appropriate services to help keep people safe.

Safeguarding concerns — If I become aware of concerns about the safety or welfare of a child or a vulnerable adult, I have a professional and legal duty to report this to the appropriate safeguarding authorities.

‍Court order — If a court orders me to disclose information, I am legally required to comply.

Legal or regulatory requirement — In rare circumstances, other legal obligations may require disclosure.

Wherever possible, I will discuss any concerns with you first and involve you in decisions about sharing information — unless doing so would itself put someone at risk of harm.

Changes to this policy

I review this privacy policy annually and whenever my practices change significantly.

If I make any significant changes that affect how your personal information is used, I will inform you directly.

If you have any questions about this privacy policy or how I handle your personal information, please contact me at: cbt.therapysolutions@gmail.com

‍ ‍