THE ONLINE THERAPY CLINIC

UK Privacy Notice & Data Protection Policy

Last updated: September 2026

1Data Controller Roles & Dual-Controller Structure

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018):

Administrative Data Controller

The Online Therapy Clinic UK LTD (Company No. 16554447; ICO Reg: ZB928518). Trading as The Online Therapy Clinic and Minds Over Business. We act as Controller for platform infrastructure, user account admin, payment processing, marketing, contact forms, and client matching.

Clinical Data Controllers

Your designated Associate Therapist acts as an Independent or Joint Data Controller for clinical notes, health records, medical intake details, and session records created during care.

Contact Email: [email protected] [email protected]

2Data Types & Lawful Bases

We process personal data in accordance with UK GDPR Articles 6 and 9:

Data Category	Examples	UK GDPR Lawful Basis (Art. 6)	Special Category Basis (Art. 9)
Identity & Contact Data	Name, address, email, phone number, age, emergency contact / GP details.	Art. 6(1)(b) Contract Performance / Art. 6(1)(d) Vital Interests (Safeguarding).	N/A
Payment Data	Transaction records, billing details (processed via Stripe/PayPal/SimplyBook.me).	Art. 6(1)(b) Contract Performance.	N/A
Special Category Health Data	Health condition, psychological history, therapy notes, child assessment scores.	Art. 6(1)(b) Contract Performance.	Art. 9(2)(h) Provision of health or social care.
Technical & Web Data	IP address, browser type, analytics cookies, contact form submissions.	Art. 6(1)(f) Legitimate Interests / Art. 6(1)(a) PECR Consent (Cookies).	N/A

Transparency Statement

Providing personal information via website contact forms or booking systems is voluntary for service delivery. Acceptance of website Terms & Conditions does not constitute forced or bundled consent for data processing.

3Third-Party Processors, SimplyBook.me & Data Transfers

3.1

Operational Processors

We utilise trusted UK GDPR-compliant data processors under strict Data Processing Agreements (DPAs).

3.2

SimplyBook.me Supplier Terms

SimplyBook.me acts as a Data Processor for The Online Therapy Clinic UK LTD, providing appointment scheduling, client intake management, and booking workflows. Personal data processed via SimplyBook.me is handled under our Data Processing Agreement and SimplyBook.me’s client processing terms (https://simplybook.me/en/terms-and-conditions#tab-for-clients).

3.3

Contact Forms

Inquiries submitted via website contact forms or direct email are processed to respond to pre-contractual requests or fulfil legitimate client support interests.

3.4

International Data Transfers

Where data is processed outside the UK or EEA, we enforce UK GDPR Chapter V safeguards, utilising UK Adequacy Regulations or the UK International Data Transfer Agreement (IDTA) / UK Addendum to EU SCCs.

4Data Retention

6 yearsfollowing the end of the financial year

Administrative & Accounting Records

Retained for 6 years following the end of the financial year to satisfy UK tax laws.

7 yearsfollowing the conclusion of treatment

Adult Clinical Records

Retained independently by Associate Therapists for 7 years following the conclusion of treatment in line with professional regulatory bodies (BACP, BABCP, HCPC).

Until age 25or 7 years post-treatment, whichever is longer

Children's Clinical Records (Aged 6–17)

Retained by Associate Therapists until the individual reaches age 25 (or 7 years post-treatment, whichever is longer).

5Your Data Subject Rights & Subject Access Requests (SARs)

5.1

Your Rights

Under UK GDPR, you have the right to be informed, access your data, rectify inaccuracies, request erasure ("Right to be Forgotten"), restrict processing, request data portability, and object to direct marketing.

5.2

Subject Access Requests (SARs)

Requests regarding administrative platform data should be sent to [email protected]. SARs regarding clinical therapy notes should be submitted directly to your individual Associate Therapist (or via our platform team who will assist in forwarding the request).

5.3

Free of Charge

All SARs are processed free of charge in strict compliance with UK data protection laws.

5.4

ICO Complaint Right

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or via 0303 123 1113.

ico.org.uk 0303 123 1113