Privacy Notice

Veronica Rumens
info@spaceforus.co.uk

This privacy notice explains how I collect, use, store and protect personal information in my therapy practice. I am responsible for deciding how Space For Us is using your personal information and for keeping it safe.

What information is collected

Basic personal information includes your name, date of birth, address, telephone number, email address, GP details and an emergency contact.
The information you choose to share in your enquiry and in any further correspondence
Special category information includes information about health, mental health, sexuality, ethnicity, religion or other sensitive areas where these are relevant to therapy.
Clinical notes do not contain your name or contact details but can be linked to you. They contain a record of our therapeutic work and may include relevant clinical, risk or safeguarding information, agreed actions or decisions, and copies or photographs of material used during sessions.
Clinical records that may include session dates, Information about your personal history, relationships, work, identity, family, circumstances and reasons for seeking therapy
Sessions dates, payments log and appointment information records
An entrance video doorbell records video and audio for security

I may also receive relevant information about you from another person participating in your therapy, a referring professional, or services involved in your care or safeguarding. Where required, I will tell you the source of information obtained about you from others.

How and why your information is used

Space For Us uses this information to respond to enquiries, arrange and provide therapy, take payment, keep appropriate records, manage risk, safeguarding or emergency situations where necessary, maintain tax and accounting records, meet legal obligations and run the practice safely.

I process your personal information where necessary to provide therapy and fulfil my contract with you, to comply with legal obligations, and for my legitimate interests in running my practice safely and effectively, maintaining appropriate records and protecting against potential legal claims or professional complaints.

Therapy may involve processing sensitive information, including information about your physical or mental health. Where I process this information for the provision of therapy, I rely on the health or social care condition under Article 9(2)(h) UK GDPR.

Your name, contact details, GP details, emergency-contact details and information necessary to arrange payment are required as part of our therapy agreement. If you do not provide the required information, I may be unable to provide therapy.

How information is stored and accessed

Clinical records:

Clinical notes are stored locally on my iPad for the duration of your therapy. The iPad is used for professional purposes only and can only be accessed by me. The iPad is password protected, the app where the notes are located is also protected and each note is locked. Once therapy has ended, the clinical notes and other therapeutic materials stored on the iPad are transferred to the practice’s encrypted, PIN-protected iStorage drive. The iStorage drive can only be accessed by me.

Accessed by other relevant people:

Basic contact information, signed contracts, signed consent forms, account details, sessions and payments log that contain your full name are stored in the practice’s Google Drive account with access restricted to those who need it for their work.

The practice’s administrator has access to information needed for appointments, payments, documents and communications but does not access clinical notes or session content. An accountant may see client names, bank account details and payment records.

My clinical supervisor has access to active clients’ Google Drive folders so clients can be contacted in the event of my incapacity to inform you of the situation and discuss appropriate next steps or alternative options. These folders contain contracts, basic information sheets and consent forms. Once your therapy has ended, my supervisor will no longer be able to access your folder.

I also discuss aspects of my therapeutic work in confidential clinical supervision, as explained in your therapy contract.

The doorbell footage is stored locally and normally kept for about four months, or longer if needed for an incident such as suspected crime, after which it gets securely deleted.

Where necessary, limited information may also be shared with my insurer, legal or professional advisers, professional body, or clinical executor.

Information may be disclosed to relevant agencies or authorities where required by law or where necessary in response to a serious risk of harm or a safeguarding concern. Further information about the limits of confidentiality is provided in the therapy contract.

How long the information is kept

I keep client records for 7 years after our work together ends, after which they are securely deleted or destroyed. Clinically or professionally significant communications are retained as part of the client record. Routine administrative communications are kept only for as long as necessary. Information relating to enquiries that do not lead to therapy is kept for 12 months.

Financial and accounting records are kept for 7 years after the end of the relevant tax year, unless a longer period is required by law.

Records may be kept for longer where there are safeguarding, legal, insurance or professional-body reasons.

Artificial intelligence and digital tools

I may use Upheal, an AI-assisted note-writing platform, to help with clinical documentation. Upheal is used only with your prior written consent. Full information about how your information is processed and handled, your choices and how to withdraw consent is provided before you consent and in the separate Upheal consent form.

I use Google Workspace, Wix, Zoom, WhatsApp Business, PayPal POS and Starling Bank to provide and administer my services. Google Workspace is used for email, administration and document storage. These providers process personal information as necessary to provide their services. Some information may be processed outside the UK. Where required, transfers are protected by UK adequacy regulations or appropriate safeguards, including standard contractual clauses with the UK Addendum or binding corporate rules, as applicable. You can contact me for details of the safeguards applying to your information and how to obtain a copy.

Sessions may be video or audio recorded only with your prior agreement and written consent. Information about how recordings are used, stored and handled is provided in the separate recording consent form.

General-purpose AI tools are not used with client personal information unless the proposed use has been separately assessed and explained to the client.

If I ever propose using an AI tool, transcription tool or recording system in relation to therapy, I will discuss this with you first. I will explain what the tool is for, what information it would process, where the data would go, any material risks or limitations, and what alternatives are available.

I will not use an AI tool, transcription tool or recording system to process therapy sessions without telling you in advance and identifying the appropriate legal basis, safeguards and any consent required for that use.

I may use digital tools for general practice administration, writing, planning or education, but I do not put identifiable client material into public AI tools.

I use locally operated AI tools for practice administration, including preparing daily briefings and organising correspondence. These tools may process client names, contact details, appointment information and correspondence, including sensitive information where relevant. The AI operates offline and the processing takes place entirely on my own computer. Your information is not sent to an external AI provider or uploaded to the cloud for AI processing. I remain responsible for reviewing the outputs and for decisions about your care.

Website

My website is hosted by Wix, which may process technical information such as your IP address and information about your device when you use the website. The website also uses cookies and similar technologies. Further information and available choices are provided through the website's cookie settings.

Your data protection rights

Under UK data protection law, you have rights over your personal information, including the right to access your information, have inaccurate information corrected, and, in certain circumstances, have information deleted or restrict or object to its use. These rights are not always absolute. In certain circumstances, you can also receive personal information you have provided in a reusable electronic format and have it transferred to another provider.

Where I rely on your consent, you can withdraw it at any time by contacting me using the details above. Withdrawal does not affect the lawfulness of processing carried out before you withdrew consent.

Your right to object

You have the right to object to processing based on legitimate interests, for reasons relating to your particular situation.

To exercise your rights, please contact me using the details above. I will normally respond within one month.

You can find more information about your rights at https://ico.org.uk/your-data-matters/

Data protection complaints

If you have concerns about how I have handled your personal information, please contact me using the details above. I will acknowledge your complaint within 30 days, investigate it, keep you informed about progress where appropriate, and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office (ICO):

Website: ico.org.uk
Telephone: 0303 123 1113

Last updated: October 2026