Client Privacy Notice

Sensitive Depth | Therapy clients and prospective clients

Your privacy matters. This notice explains what information I collect from enquiry and referral through assessment and therapy, how I use and protect it, and your rights.

1. Who is responsible for your information?

Sensitive Depth is an independent counselling and psychotherapy practice operated by Piotr Trznadel in the United Kingdom. I am the data controller for personal information handled in my private practice.

For privacy questions or requests about your information, email contact@sensitivedepth.com. This notice applies to people enquiring about therapy, completing a self-referral or assessment, joining a waiting list, or receiving therapy, including clients based in the UK or Poland.

2. What information do I collect?

I collect information reasonably needed to respond to your enquiry, assess suitability, provide therapy safely and manage the practice. Depending on the stage, this may include:

• your name, contact details, location, preferred contact method and availability;

• self-referral and assessment answers, including reasons for seeking therapy, wellbeing, health, safety and relevant personal circumstances;

• GP or other healthcare contact details and a nominated person to contact in a crisis;

• brief clinical session notes, supervision-related information and safeguarding or risk records where necessary;

• appointments, communications, payments, invoices and relevant administrative records.

Some information is special category data under UK GDPR, including health information and, where you choose to share it, information about sexuality, ethnicity or religious beliefs. Please share only what you feel able to at the enquiry stage; I may need certain information to assess whether I can work with you safely.

3. Self-referrals, assessments and waiting lists

Self-referral information is collected through a Microsoft-based online form to review your enquiry, contact you and decide on the next steps. If you progress to a full assessment, the assessment becomes part of your secure client record and the original self-referral submission is securely deleted once its relevant information has been transferred or is no longer needed, subject to any necessary safety or legal record.

If I cannot offer a suitable appointment immediately, you may choose to join a waiting list. I will use your contact details and limited relevant enquiry information to contact you about availability. Joining is optional and does not guarantee a place. You may ask to leave at any time. Waiting-list information is reviewed and securely deleted when it is no longer needed, unless a record must be retained for a justified legal or safeguarding reason.

If therapy does not go ahead, I retain only information that is necessary for a legitimate administrative, safeguarding or legal purpose, and delete the remainder when no longer needed.

4. Why do I use your information?

I use your information to respond to enquiries, manage waiting lists, assess whether therapy is appropriate, provide and arrange sessions, maintain appropriate clinical records, support safe and ethical practice, manage payments, and meet legal and professional responsibilities. Information may also be needed to respond to complaints or legal claims.

5. My legal basis for using your information

For ordinary personal information, I generally rely on taking steps before entering into a therapy contract or performing that contract, legitimate interests in operating a safe professional practice, and legal obligations where applicable. In an emergency, vital interests may apply.

For special category information, I also need a separate condition under UK GDPR. Depending on the purpose and circumstances, this may include an applicable health or social-care condition, explicit consent where genuinely appropriate, or a condition relating to vital interests or legal claims. The relevant legal condition depends on the activity and is not automatically the same for every record.

Where processing genuinely relies on your consent, you may withdraw it at any time by contacting me. Withdrawal does not affect processing already carried out lawfully or records I must retain under another lawful basis.

6. Confidentiality and when information may be shared

What you share in therapy is treated confidentially, subject to the limits explained in your Therapy Agreement. I do not sell your information. I share only what is reasonably necessary, which may include:

• my clinical supervisor for professional oversight, normally without details that directly identify you;

• trusted service providers supporting secure forms, Microsoft 365 email and storage, video sessions, administration and payments, acting under appropriate arrangements;

• your GP, nominated crisis contact, safeguarding professionals or emergency services if necessary to respond to a serious safety concern;

• insurers, professional advisers, regulators or relevant authorities where reasonably necessary for legal, regulatory, insurance or complaint matters.

Where safe and appropriate, I will discuss a disclosure with you first. Confidentiality may need to be limited where there is a serious risk of harm or a legal requirement to disclose information.

7. Clinical will and continuity of care

I have arrangements in place in case I become seriously unwell, incapacitated or die and cannot continue providing therapy. Under these clinical-will arrangements, my designated clinical supervisor or appointed clinical executor may be given controlled access to the minimum necessary client contact and clinical information to notify clients, manage urgent safeguarding concerns and arrange appropriate continuity or closure of care.

This is not routine unrestricted access. Access is intended to be used only when the clinical-will arrangements are activated, with appropriate confidentiality and security safeguards.

8. How is your information collected and protected?

Online self-referrals and assessments are planned to be collected using Microsoft Forms and managed within my professional Microsoft 365 environment. I use appropriate account security, access restrictions and secure handling procedures. Unnecessary duplicate copies, including email copies, are removed when no longer needed.

Client records are also stored on encrypted, password-protected external storage devices kept in a locked safe or secure cabinet. Access credentials and physical access are restricted. Arrangements for access by my clinical supervisor or clinical executor are controlled as described above.

No digital system is entirely risk-free. Where providers process or access information outside the UK, I will use appropriate transfer safeguards as required by applicable data-protection law. If you are based in Poland, cross-border processing and relevant local requirements will be considered as part of providing your care.

9. How long do I keep your information?

My current policy is to retain adult client clinical records for seven years after the last therapeutic contact, unless a longer period is justified by a legal, safeguarding, insurance or professional requirement. This period is under review pending confirmation with my insurer; any change will be reflected in an updated notice.

Self-referral submissions are deleted once the assessment process has progressed and they are no longer needed, as explained above. Waiting-list details are retained only while needed for the waiting-list purpose and are reviewed periodically. Financial and other administrative records may be kept for different periods where required by law. When retention is no longer justified, information is securely deleted or destroyed.

10. Your data-protection rights

Depending on the circumstances, you may request access to your information, correction of inaccuracies, erasure, restriction of processing, portability, or object to certain processing. These rights are not absolute; for example, I may need to retain certain clinical records for lawful reasons.

To exercise your rights or ask a privacy question, email contact@sensitivedepth.com. I may need to verify your identity before responding. I will respond in accordance with applicable data-protection law.

11. Concerns and complaints

If you have concerns about how your personal information is handled, please contact me at contact@sensitivedepth.com so I can investigate. You also have the right to complain to the UK Information Commissioner’s Office (ICO): www.ico.org.uk. Clients in the European Economic Area may also have rights to contact their local data-protection authority, where applicable.

12. Changes to this notice

I review this notice when my practice, systems or legal requirements change. The latest version will be available through Sensitive Depth and provided or linked during the referral and assessment process.