Privacy Policy
The Compassionate Therapy Space
Last updated: Thursday 11th June 2026
1. Introduction
The Compassionate Therapy Space respects your privacy and is committed to protecting your personal data.
This Privacy Policy explains how we collect, use, store, process and share your personal information when you:
- Visit our website;
- Contact us with an enquiry;
- Engage with our therapy services;
- Attend appointments face-to-face or online;
- Communicate with us by telephone, email, text message or other means.
This policy has been prepared in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection legislation.
By using our website or engaging with our services, you acknowledge that you have read and understood this Privacy Policy.
2. Who We Are
The Compassionate Therapy Space is a sole trader business operated by Lisa McKendrick, providing psychological therapy services to adults and young people aged 16 years and over.
Lisa McKendrick is registered with the Health and Care Professions Council (HCPC) and complies with applicable HCPC Standards of Conduct, Performance and Ethics. Personal information may be processed where necessary to meet professional, ethical, regulatory, safeguarding, insurance, audit, or legal requirements.
For the purposes of UK data protection legislation, Lisa McKendrick is the Data Controller and is responsible for determining how your personal information is collected, stored and used.
Lisa McKendrick is registered with the Information Commissioner's Office (ICO) under registration number ZB821909 and complies with the requirements of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
3. Contact Details
If you have any questions about this Privacy Policy or how your personal data is handled, please contact:
Lisa McKendrick
The Compassionate Therapy Space
Email:
ICO Registration Number: ZB821909 and registered business name: Lisa McKendrick
You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK's independent authority for data protection matters.
Website: https://ico.org.uk
We would, however, appreciate the opportunity to address your concerns first and encourage you to contact us in the first instance.
4. The Information We Collect
We collect personal information necessary to provide safe, ethical and effective psychological services.
What is personal data?
Personal data means any information relating to an identified or identifiable natural person, such as your contact information, browsing history or clinical data. It does not include data where the identity has been removed, known as anonymous data.
This may include:
Identity Data
- Full name
- Date of birth
- Gender
- Address
Contact Data
- Email address
- Telephone number
- Postal address
- Emergency contact details
Health and Therapy Information
- Medical history
- Mental health history
- Psychological assessments
- Therapy notes
- Diagnoses, where applicable
- Information relating to relationships, life events and wellbeing
- Information relevant to safeguarding or risk management
Professional and Support Information
- GP details
- Other healthcare professionals involved in your care
- Educational information, where relevant
- Employment information, where relevant
Financial Data
- Payment records
- Invoices
- Transaction details
Technical Data
When you visit our website, we may collect:
- IP address
- Browser type and version
- Operating system
- Device information
- Website usage information
- Pages visited
- Time spent on pages
- Referring websites
5. Special Category Data
As a psychological therapy provider, we process information relating to your physical and mental health.
Under UK GDPR, health information is classified as "special category data" and receives additional legal protection.
We only collect and process special category data where it is necessary for the provision of psychological therapy and related healthcare services, safeguarding responsibilities, professional obligations, or where otherwise permitted by law.
We do not use automated decision-making or profiling that produces legal or similarly significant effects.
6. Young People Aged 16 and Over
The Compassionate Therapy Space provides services to adults and young people aged 16 years and over.
We recognise that many young people aged 16 and 17 are capable of making informed decisions about their own healthcare and personal information. We will process personal data in accordance with applicable UK law, professional guidance and ethical standards.
Where appropriate and lawful, we may involve parents, carers or other professionals in aspects of a young person's care. Decisions regarding information sharing will always be made with careful consideration of confidentiality, safeguarding responsibilities, the young person's rights, capacity, and the circumstances of the individual case.
Capacity and confidentiality decisions will be considered in accordance with applicable law and professional guidance.
7. How We Collect Information
We collect information directly from you and, where appropriate, from other sources connected with your care.
Methods of collection include:
Website
Information submitted through:
- Contact forms
- Email links
- Website enquiries
Telephone
Information discussed during enquiries, assessments and appointments.
Email and Text Messages
Information shared during appointment scheduling, administration and professional communication.
Face-to-Face and Online Appointments
Information gathered during assessments, therapy sessions and reviews.
Written Documents
Information contained within:
- Intake forms
- Assessment questionnaires
- Consent forms
- Reports
- Correspondence
Third Parties
We will not sell your personal information. Personal information will only be shared where necessary for the provision of therapy services, professional supervision, safeguarding responsibilities, legal obligations, insurance requirements, or with your consent where appropriate.
With your knowledge and, where appropriate, your consent, information may be obtained from:
- GP, where agreed or clinically necessary
- Other healthcare professionals
- Clinical supervisors
- Professional indemnity insurers
- Accountants or bookkeepers, using limited information
- Secure software providers, including practice management systems, encrypted email, video platforms, Zoom, Microsoft Teams, Proton Mail, Cliniko, Heidi Health, and website management company www.youcanconsulting.com
- Legal advisers
- Courts or law enforcement when legally required
- Safeguarding authorities
- Insurance providers
- Other agencies involved in your care
When we disclose your personal data to a third party, we take all reasonable steps to ensure that those third parties are bound by confidentiality and privacy obligations with respect to the protection of your personal data.
The disclosure is conducted in compliance with legal requirements, including entering into data processing agreements with the relevant third parties, to ensure that personal data is only processed in accordance with our instructions, applicable law and regulations, and for the purpose specified by us. This also helps ensure adequate security measures are in place.
8. Lawful Bases for Processing
We only process personal information where we have a lawful basis to do so under Article 6 of the UK General Data Protection Regulation (UK GDPR).
The lawful bases we rely upon include:
Contract
To provide psychological therapy services that you have requested and to fulfil our professional obligations arising from those services.
Legitimate Interests
To operate, manage and improve our practice effectively, securely and professionally, provided that such interests do not override your rights and freedoms.
Legal Obligation
Where processing is necessary to comply with legal, regulatory, safeguarding, insurance or professional requirements.
Vital Interests
Where processing is necessary to protect someone from serious harm or to safeguard life.
Special Category Health Data
As part of providing psychological therapy services, we process information relating to your physical and mental health. This information is classified as special category data under Article 9 UK GDPR and is subject to additional protection.
We process special category data where necessary for the provision of health care and psychological therapy services in accordance with Article 9(2)(h) UK GDPR.
We may also process special category data where necessary for:
- Safeguarding children and adults at risk;
- The establishment, exercise or defence of legal claims;
- Compliance with legal or regulatory obligations;
- Reasons of substantial public interest where permitted by law;
- Explicit consent, where this is the most appropriate legal basis.
9. Confidentiality
Information shared during consultation, assessment and therapy is treated as confidential. However, confidentiality may be breached where there is a legal obligation to do so or where there are concerns about serious harm, safeguarding, or public protection.
This may include:
- Risk of serious harm to self
- Risk of serious harm to others
- Child protection concerns
- Vulnerable adult safeguarding concerns
- Court orders
- Terrorism or serious crime legislation
- Professional regulatory requirements
As part of HCPC professional practice, client work will be discussed in confidential clinical supervision. Information is anonymised wherever possible.
10. Cookies
We use cookies to ensure that our website functions properly, to remember user preferences, and to understand how visitors use the website.
Where non-essential cookies such as analytics cookies are used, these will only be placed on your device with your consent. You can manage your cookie preferences through our cookie banner or your browser settings.
Essential cookies are required for the operation of the website and cannot be switched off.
11. Data Outside the UK
Where personal information is transferred outside the UK, appropriate safeguards such as UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), or other lawful transfer mechanisms will be used in accordance with UK GDPR requirements.
12. Data Security
We take the security of your personal information seriously and implement appropriate technical and organisational measures to protect it from unauthorised access, loss, misuse, alteration or disclosure.
These measures include:
- Password-protected devices and systems used for the storage and processing of personal information;
- Clinical notes are stored in password-protected electronic files;
- Encryption of devices used to access and store personal information, including FileVault full-disk encryption on Mac devices;
- Secure storage of electronic records and client documentation;
- Use of encrypted email services, including Proton Mail, where appropriate;
- Multi-factor authentication on relevant accounts and services where available;
- Restricted access to personal information so that only authorised individuals can access it;
- Regular review of security practices and procedures;
- Secure disposal or deletion of personal information when it is no longer required.
While we take reasonable steps to protect personal information, no method of electronic transmission or storage can be guaranteed to be completely secure. We continually review our security arrangements to maintain appropriate protection of personal data.
13. Your Right of Access to Your Information
You have the right to request access to the personal information we hold about you, commonly known as a Subject Access Request.
Upon receiving a valid request, we will normally provide a copy of your personal information within one month, unless an extension is permitted under applicable data protection legislation. Your request will be carefully considered in accordance with applicable legal, ethical and professional obligations.
In certain circumstances, information may be withheld or redacted where permitted by the UK GDPR and the Data Protection Act 2018. This may include situations where disclosure could:
- Cause serious harm to the physical or mental health of you or another individual;
- Adversely affect the rights and freedoms of another person;
- Reveal information about another individual who has not consented to disclosure;
- Prejudice the prevention or detection of crime, legal proceedings, or other matters where a legal exemption applies.
Any decision to withhold information will be carefully considered in accordance with applicable legal, ethical and professional obligations.
To make a Subject Access Request, please contact:
Email:
14. Data Retention
We retain personal information only for as long as necessary to fulfil the purposes for which it was collected and to comply with professional, ethical, insurance and legal obligations.
Unless a longer retention period is required by law, professional regulation, insurance requirements, safeguarding considerations, or ongoing legal proceedings, client records will generally be retained for seven years from the date of the final therapy session or last professional contact.
After this period, records will be securely deleted, anonymised, or destroyed using appropriate methods.
Where there is an ongoing complaint, legal claim, safeguarding concern or regulatory investigation, records may be retained for longer where reasonably necessary. Retention periods may be extended for young people, safeguarding matters, complaints, legal claims, or where required by professional guidance.
15. Website Hosting and Data
Our website is hosted by You Can Consulting. Website analytics may be provided by Google Analytics or Plausible to help us understand website usage and improve our services.
We process information submitted through website enquiries in order to respond to requests for information and take steps prior to entering into a therapeutic contract.
16. Your Rights
Under UK GDPR, you have the right to:
- Access your personal information;
- Request correction of inaccurate information;
- Request erasure of personal information in certain circumstances;
- Request restriction of processing;
- Object to processing;
- Request transfer of your information, also known as data portability;
- Withdraw consent where consent is relied upon;
- Lodge a complaint with the Information Commissioner's Office (ICO).
Requests can be made by contacting:
We will normally respond within one month, although extensions may apply where permitted by law.
17. Data Breaches
In the unlikely event of a personal data breach, we will investigate the incident promptly and take appropriate steps to minimise any potential impact.
Where legally required, we will notify the Information Commissioner's Office (ICO) and affected individuals in accordance with UK GDPR requirements.
