Privacy Notice

Introduction

Your privacy is very important to me. I understand that coming to therapy can involve sharing things that are deeply personal, and I take my responsibility to look after that information seriously.

This privacy notice explains what personal information I collect, why I need it, how I keep it safe and what happens to it during and after our work together. I've tried to keep this as straightforward as possible and to avoid unnecessary jargon. If there is anything you're unsure about, you're very welcome to ask me.

I am Amy Downham, and I am responsible for the personal information I hold about you. I am registered with the Information Commissioner's Office (ICO), registration number ZC245755.

My practice address is: 15 Newton Terrace
Glasgow
G3 7PJ

My email is: amydownhamtherapy@gmail.com

When you first contact me

The website contact form asks for your name, email address and a message. I only ask for this information so that I can respond to your enquiry and, if appropriate, arrange an initial consultation.

As the contact form is not intended for sharing personal or sensitive information, please avoid including detailed information about your mental health, medical history, relationships or other sensitive aspects of your circumstances in the message box. There will be an opportunity to talk about what brings you to therapy during our initial consultation.

During an initial consultation, we may talk about practical matters such as availability, as well as what has brought you to therapy and whether you have had therapy before. I may make brief notes from this conversation where they are relevant. These guide me in considering whether therapy is appropriate, as well as arranging any future work together. 

If you contact me through Psychology Today, BACP or The Counselling Directory I may receive the information you choose to provide through those services. Most of the information I hold about you is provided directly by you.

If you decide to have therapy with me

If we decide to work together, I will need to collect and keep some personal information about you so that I can provide therapy safely and appropriately and manage our work together.

This may include:

  • your name and contact details

  • your GP details

  • the details of an emergency contact

  • Appointment and scheduling information

  • Payment and invoicing information

  • Correspondence by email, phone or contact form

  • Information relevant to therapeutic assessment and ongoing clinical work

  • Brief clinical notes

Some of the things you may talk about in therapy are personal and sensitive. This can include information about your physical or mental health, relationships, sexuality, beliefs, or other aspects of your life that you may consider private.

I will only ask for and keep information that is relevant and necessary to our work together, and that helps me provide you with safe, appropriate and professional therapy.

Why I use your information

I use your information primarily to:

  • provide you with safe and appropriate psychotherapy;

  • understand your circumstances and the difficulties that have brought you to therapy;

  • keep appropriate clinical records;

  • communicate with you about appointments and our work together;

  • respond to enquiries and arrange initial consultations;

  • manage payments and the administration of my practice;

  • meet relevant legal, professional and ethical responsibilities.

I only collect and use information that is relevant and necessary for these purposes.

The legal basis for using your information

Data protection law requires me to have a lawful reason for collecting and using your personal information. Depending on the circumstances, I may use your information where it is necessary:

  • to respond to your enquiry and take steps towards arranging therapy with you;

  • to provide and manage the therapy we have agreed to undertake;

  • to meet legal or professional obligations that apply to my practice; and

  • to support the safe, ethical and responsible running of my psychotherapy practice, where this does not override your rights and privacy.

Some of the information I hold is what data protection law calls “special category data”, particularly information about your physical or mental health. This type of information has additional protection under data protection law. Where I need to process this information as part of providing therapy, I do so under the specific conditions provided by data protection law for health and social care.

I only collect and use information that is relevant and necessary for the purposes described in this privacy notice.

Confidentiality

What you share with me in therapy is treated as confidential. I take your privacy seriously and will not share information about you unless there is a good reason for doing so.

There are rare circumstances where confidentiality may need to be broken. This might be because I am legally required to provide information, for example following a court order, or because I have serious concerns about your safety or the safety of someone else.

If I ever felt that information needed to be shared, I would, wherever possible, talk this through with you first. Where appropriate, I would support you to share the information yourself. If information did need to be shared without your consent, I would only share what was relevant and necessary for the particular situation.

I also discuss my clinical work with an independent clinical supervisor. This is an important part of practising safely and ethically. I take care to anonymise information as far as possible when discussing clients in supervision, and my supervisor does not have access to your therapy records.

Services I use

I keep the information I hold about you as private as possible. In the course of running my practice, there are a small number of people or organisations who may need to receive limited information. These include:

  • Gmail for email communication

  • Zoom for online therapy sessions

  • WhatsApp or telephone for initial consultations and occasional appointment related communication

  • Mettle by Natwest for receiving payments and financial administration

These organisations may process some of your personal information on my behalf when I use their services. I only use these services for the purposes described above and take care to share only the information that is relevant and necessary.

Some of these organisations operate internationally, which means that your information may sometimes be processed or stored outside the UK. Where this happens, the relevant organisation is responsible for putting appropriate safeguards in place in accordance with UK data protection law.

You can find more information about how these organisations handle personal information by following the links which I have provided above.

Practice continuity

I have a fellow therapist who acts as my practice contact in the event that I become unable to continue practising, including in the event of my death. For this purpose, they have access to your name, email address, phone number and the day and time of your appointment so that they can contact and inform you accordingly. They do not have access to your therapy notes.

How I keep your information safe

Your clinical records are stored electronically in a password-protected and encrypted folder on my laptop. I do not keep paper therapy records.

How long I keep your information

I retain your therapy records for five years after the end of our work together. This is a requirement of my professional insurance policy and helps to ensure that appropriate records are available should there be a need to respond to a claim.

Once the five-year retention period has passed, I will securely delete your personal information unless there is a specific reason why I need to retain it for longer.

Your rights

You have a number of rights in relation to the personal information I hold about you.

Depending on the circumstances, these include the right to:

  • ask to see the personal information I hold about you;

  • ask me to correct information that is inaccurate or incomplete;

  • ask me to delete your information in certain circumstances;

  • ask me to restrict how I use your information in certain circumstances;

  • object to certain uses of your information; and

  • ask for your information to be provided to you or transferred to another organisation in certain circumstances.

Some of these rights are subject to legal exceptions, particularly in relation to clinical records and information that I am required to retain, so they will not necessarily apply in every situation.

If you would like to exercise one of these rights, please email me at amydownhamtherapy@gmail.com. I will respond to your request as soon as possible and normally within one month, in line with data protection requirements.

My website

Like most websites, my website uses cookies. Cookies are small files stored on your device which help a website to work properly and remember certain preferences.

My website is built and hosted using Squarespace. I use the necessary cookies that Squarespace requires to keep the website functioning and secure. 

When you visit my website, you will be given the option to manage your cookie preferences. You can choose whether to allow non-essential cookies, and you can change your preferences at any time.

You can find out more about the cookies Squarespace uses here.

Questions or concerns

If you have any questions about how I use or protect your personal information, please feel free to contact me. I would much rather you asked than were left unsure about something.

If you are unhappy with the way I have handled your personal information, please contact me first so that I have the opportunity to understand and address your concerns.

You also have the right to make a complaint to the Information Commissioner's Office (ICO) if you are concerned about how your personal information has been handled.

My ICO registration number is ZC245755.

Changes to this privacy notice

I may occasionally update this privacy notice if the way I work changes or if there are changes to data protection requirements.

The most recent version will always be available on my website.

Last updated: September 2026