Therapy Privacy Notice (UK GDPR)

Data Controller: Nyasha Mutavayi, Sole Trader

Contact: info@nyasha.uk|   nyasha.uk

This notice explains what personal data I collect in connection with therapy, why I collect it, and your rights.

What I collect:

·       Identity & contact: name, contact details, date of birth (if needed).

·       Administrative: session dates, invoices/payments, insurer authorisation codes (where relevant).

·       Clinical: brief therapy notes (proportionate record of themes, risks, plans).

Why I collect it (lawful bases):

·       To provide therapy and manage our agreement (Contract).

·       To keep the service safe, effective and auditable (Legitimate interests).

·       To comply with legal/professional obligations (Legal obligation).

·       With your consent for specific purposes (e.g., contacting your GP with your agreement).

Sharing your data:

I do not sell your data. I may share limited data with:

• AXA Health (or other funders) for billing/authorisation when applicable — minimum necessary details only.

• Clinical supervisor (de‑identified), professional insurer, accountants, and secure IT service providers (email/hosting).

• Authorities if required by law or if there is serious risk of harm (see Consent & Terms).

Retention & security:

·       Records are stored securely. Therapy records are retained up to 7 years after our work ends (or until age 25 for work begun with a minor), then destroyed.

·       Invoices/financial records are kept as required for tax/accounting.

International transfers:

Some IT services may store data outside the UK/EEA (e.g., secure email/hosting). Where this occurs, appropriate safeguards (such as Standard Contractual Clauses) are used.

Your rights:

·       You have the right to request access to your personal data; correction; deletion; restriction; portability; and to object to certain processing.

·       You can withdraw consent at any time where processing is based on consent. This does not affect the lawfulness of processing prior to withdrawal.

·       To exercise rights, contact info@nyasha.uk. You can also complain to the Information Commissioner’s Office (ico.org.uk).

Children & safeguarding:

I do not provide therapy to unaccompanied minors. Safeguarding concerns may require sharing information with appropriate services.

Contact & updates:

Questions about this notice? Contact info@nyasha.uk. I may update this notice from time to time; the current version will always be provided to clients and posted on my website.