Privacy Notice — Craig Lee Therapy
Last updated: June 2026
1. Who I am
My name is Craig Lee. I am a qualified counsellor and psychotherapist trading as Craig Lee Therapy(www.craigleetherapy.co.uk).
I provide online counselling to adults. For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), I am the data controllerof the personal information I hold about you. This means I decide how and why your information is used, and I am responsible for looking after it.
Registered with the Information Commissioner's Office (ICO): registration number ZB608980
Contact for any data protection matter: hello@craigleetherapy.co.uk
I am bound by a professional duty of confidentiality and work within the ethical framework of my professional body. I hold professional indemnity insurance.This notice explains what information I collect, why I collect it, who I share it with, how long I keep it, and the rights you have. It works alongside my Counselling/Therapy Agreement, which sets out the practical terms of our work together (including confidentiality and its limits).
2. The information I collect
Depending on our contact, I may hold:Identity and contact details — your name, email address, telephone number, and (where relevant) emergency contact or GP details.Health and therapy information — your reasons for seeking therapy, relevant health history, intake/assessment information, and brief clinical notes I make after sessions. This includes information about your mental and physical health. This is "special category data" and receives extra protection — see section 4.Financial and transaction information — payment records and bank transfer details, and (for clients paying from outside the UK) information processed by my card payment provider.Website information — my website is intentionally simple. See section 9 for how it handles cookies.I only collect what is necessary to provide therapy safely and to run my practice lawfully.
3. Why I use your information, and my lawful basis
UK GDPR requires me to have a "lawful basis" for using your personal information. I rely on the following:
To provide therapy and manage your appointments — my basis is Contract (performing our agreement to provide therapy to you).
To keep clinical records, undertake clinical supervision, manage risk and safeguarding, and handle complaints and insurance matters — my basis is Legitimate interests (running a safe, accountable and professional practice).
To meet tax, accounting and other legal duties, and to comply with a court order or safeguarding obligation — my basis is Legal obligation.
To act in an emergency to protect someone's life — my basis is Vital interests.
Because your therapy information is health data, I also rely on an additional condition under Article 9 — explained next.
4. Special category (health) information
Information about your mental and physical health is "special category data" under Article 9 of the UK GDPR, which the law protects more strictly. To process it lawfully I must meet a specific condition in addition to the lawful bases above.My condition for processing your health information is Article 9(2)(h) — the provision of health or social care or treatment, together with the associated condition in Schedule 1 of the Data Protection Act 2018. I am able to rely on this because I provide therapeutic treatment and am bound by a professional duty of confidentiality.In a genuine emergency where there is a risk to life, I may also rely on Article 9(2)(c) — vital interests..I do not use your special category data for any automated decision-making or profiling.
5. Who I share your information with
I keep your information confidential and only share it where necessary and lawful. The people and organisations I may share information with are:
My clinical supervisor. Like all ethical practitioners, I discuss my work in regular clinical supervision. My supervisor is a qualified professional bound by the same duty of confidentiality.
Other professionals involved in your care — for example your GP or a dietitian — where you have agreed to this, or where I am required to act to protect your safety. (This is covered in more detail in my Counselling/Therapy Agreement.)
My software and service providers ("data processors") — see section
My accountant and HMRC, to meet tax and accounting obligations.
Courts, regulators, the police or safeguarding authorities, where I am legally required or ethically obliged to disclose information (for example a court order, or a serious safeguarding risk).The limited circumstances in which I may need to break confidentiality are set out fully in my Therapeutic Agreement.
6. The service providers I use
I use trusted, established providers to deliver and run my practice. Each acts as my "data processor," meaning they handle data only on my instructions and under a data processing agreement.
WriteUpp — secure clinical practice-management software where I store your clinical notes. WriteUpp hosts data within the European Economic Area (Ireland).
Psychology Today "Sessions" — the secure, encrypted video platform I use for appointments.
WhatsApp — used only as a backup for video calls if the Sessions platform fails during an appointment, or where specifically requested, and only where we have agreed this in advance. WhatsApp calls are end-to-end encrypted.
Google Workspace (Gmail) — my professional email, on a paid Workspace account with a business data processing agreement.
Stripe — card payments for clients paying from outside the UK.
Monzo — my business bank, which receives UK bank transfers.
7. Sending information outside the UK
Some of my providers store or process information outside the UK:
WriteUpp stores data in the EEA (Ireland). The EEA benefits from a UK "adequacy" decision, so no additional transfer safeguards are required.
Google, Stripe, Psychology Today and WhatsApp are based in the United States and may transfer data there. Where this happens, the transfer is protected by appropriate safeguards recognised under UK law — such as the UK International Data Transfer Agreement or Addendum, or the UK Extension to the EU–US Data Privacy Framework, depending on the provider.If you would like more detail about the specific safeguards a provider uses, please ask me.
8. How long I keep your information
I keep your information only as long as necessary:Clinical records and notes — I am required by my insurer to retain these for a minimum of 5 years after your last session, after which they are securely deleted.Financial and transaction records — as a sole trader I am required by HMRC to keep basic financial records for at least 5 years after the relevant Self Assessment filing deadline.When information is no longer needed, it is securely destroyed.
9. Cookies and my website
My website is intentionally simple. It does not use advertising cookies, advertising networks, web beacons, or third-party analytics or tracking tools. Any cookies used are limited to those strictly necessary for the website to function. You can control or block cookies through your browser settings if you wish.
10. Keeping your information secure
I take the security of your information seriously. Clinical notes are held in secure, access-controlled software; email is handled through a paid, business-grade account; and video sessions use an encrypted platform. I keep the amount of information I hold to the minimum needed for our work.
11. Your rights
Under UK data protection law you have the right to:
be informed about how your information is used (this notice);
access the personal information I hold about you;
rectification — ask me to correct inaccurate or incomplete information;
erasure — ask me to delete your information (this may be limited where I am legally required to keep it, e.g. for insurance or tax);
restrict or object to certain processing;data portability;
and withdraw consent, where I rely on your consent for a particular purpose.
12. Complaints
If you have any concerns or complaints about how I handle your personal data, you have the statutory right to raise a formal data protection complaint directly with me.
Please submit your complaint in writing to hello@craigleetherapy.co.yk
I will acknowledge receipt of your complaint within 30 days.
I will investigate the matter and provide a full outcome response without undue delay, keeping you informed of my progress, if the investigation requies extended enquiries.
You also have the right to complain to the Information Commissioner's Office (ICO) at any time:
Website: www.ico.org.uk
Helpline: 0303 123 1113
13. Changes to this notice
I may update this notice from time to time. The current version is always available at www.craigleetherapy.co.uk/privacy-policy, and the "last updated" date above shows when it was most recently changed.
14. Contact
For anything relating to this notice or your personal information: Craig Lee — hello@craigleetherapy.co.uk