Privacy policy

This Privacy Policy is effective from 1 November 2026.

This privacy policy explains how we handle your personal data. It does not form part of any contract with you. Our Therapy Terms and Conditions govern your use of our services. We may update this privacy policy from time to time. Where we make significant changes, we will tell you before they take effect, for example by email or by a notice on our website.

Our registration details

Abode therapy is operated by Abode Therapy Ltd. which is registered in England and Wales under company number 12885677. Our company address is: 6 Genesis Business Centre, Redkiln Way, Horsham, West Sussex, RH13 5QH

We are registered with the Information Commissioner’s Office (ICO) registration number: A8868501.

Who is in charge of your data?

Abode Therapy Ltd. is the controller of the personal data described in this privacy policy. This means we decide how and why your data is used. You can contact us at:

About us

Abode Therapy Ltd. provides psychological therapy and assessment services to adults, together with a therapist matching service that connects clients with our associate clinicians. All sessions are delivered remotely by video or telephone. We do not offer in-person sessions. As a core part of our work, we need to collect personal information about you, including information about your health, so that we can properly engage with you and provide the best possible service to you. This Privacy Policy outlines how we collect, use, store and manage your data and your rights regarding that data. We take all reasonable steps to ensure that your personal data is safeguarded and kept in accordance with data protection law.

Definitions

• Abode Therapy Ltd. is the company behind Abode Therapy.
• Abode therapy does not have a separate privacy policy.
• We work with self-employed associate clinicians, including clinical psychologists and counselling psychologists, who are referred to as “therapist/s”, “clinician/s” or “associate/s”. Your contract for services is always with Abode Therapy Ltd., but the clinician who treats you is clinically responsible for your care;
• “Platform” means our website and the services provided through it, including our therapist matching service.
• “Services” means services provided using our website.

Not happy with something?

We’re committed to treating your personal data with respect, transparency and care. If you ever have questions or concerns about how your data is used, we want to hear from you, and we’ll do our best to resolve things quickly and fairly. Under the Data (Use and Access) Act 2025, you have the right to raise a complaint about how your personal data is handled. Here’s how:

This privacy policy applies to personal data we collect through www.abodetherapy.co.uk (referred to as “website”) and when you enquire about, book or receive our services. It does not apply to our associate clinicians, who receive a separate privacy notice.

What data do we collect?

We collect the following data:

• Identity data (includes title, first name, last name, usernames, date of birth, gender);
• Contact data (includes address, email address, telephone numbers, GP details and emergency contact details);
• Transaction data (includes details about payments to and from you, details of services you have bought from us and, where your sessions are funded by a health insurer, your insurer’s name and your policy or authorisation number);
• Technical data (includes internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in versions, operating systems and platform);
• Usage data (information about how you use our website and the services that you choose from our website e.g., packages);
• Marketing and communication data (includes your preferences on marketing communication, communication preferences);
• Health data (includes information about your mental and physical health that you provide in our enquiry, therapist matching and consultation booking forms, client registration forms and first appointment form, and information shared during sessions, including your clinician’s session notes and any assessment report. Where you attend couples therapy, this may include information about your partner).

Health data is “special category data”, which receives extra protection under data protection law. We only record other sensitive information (such as ethnicity, religious beliefs or sexual orientation) where you choose to share it and it is relevant to your care. We do not collect information about criminal convictions or offences.

We do not collect or store your payment card details. Card payments are processed by Stripe, who have their own privacy policy (https://stripe.com/gb/privacy).

If you do not provide the information we need to deliver our services (for example, your contact details or relevant health information), we may not be able to match you with a clinician or provide therapy to you. We will tell you if this is the case.

How do we collect your data?

You directly provide us with most of the data we collect. We collect data and process data when you:

• Complete our enquiry or therapist matching form, book a consultation or appointment through our online booking system (Jane App), or register as a client (including our client registration form, first appointment form and Client Confidentiality and Consent form);
• Email us (we keep copies of these, which are held according to this Privacy Policy);
• Telephone calls (data relating to the call may be retained by us on the basis of legitimate business needs or our need to fulfil our contractual obligations to you);
• Social media (if you send us a direct message, the details may be retained by us as relevant to our legitimate business interest or as required for legal purposes);
• Voluntarily complete a questionnaire or provide feedback on any of our surveys or via email;
• Use or view our website, through cookies and similar technologies (see our Cookie Policy);
• Attend therapy or assessment sessions with your clinician by video or telephone;

We may also receive your data indirectly from the following sources:

• Automatically through your interaction with our website (information may automatically be received about your equipment, browsing actions and patterns). This is collected via cookies and other similar technologies. This data collection helps us to improve user experience and to understand how you use our website. For more information, please refer to our Cookie Policy, which can be accessed here: www.abodetherapy.co.uk/cookie-policy.
• From your health insurer, where your sessions are funded by insurance (for example, authorisation details);
• From your GP or another healthcare professional, where they refer you to us;
• From the associate clinician who provides your therapy, for example information needed to manage your bookings and billing.

How will we use your data?

We collect your data so that we can:

• Perform the contract that we are about to or have entered into with you;
• Provide you with access to our site and manage this access;
• Comply with a legal obligation (e.g., notifying you of a change in our privacy policy);
• To administer and protect our website (e.g., troubleshooting, system maintenance etc.);
• Ask you to leave a review or complete a survey;
• To make suggestions and recommendations to you about services from us that we think you might be interested in (you will only receive these if you have requested services from us and have not opted out, or if you have consented to join our mailing list, which you may opt out of at any time);
• Match you with a suitable clinician through our therapist matching service;
• Provide therapy and assessment services to you through our associate clinicians;
• Bill your health insurer, where applicable;
• Protect your safety and the safety of others, and meet our safeguarding responsibilities.

We will only use your data where UK data protection law allows us to. The law requires us to have a “legal basis” for processing your personal data. These legal bases are:

• To perform a contract that we are about to enter into or have with you;
• To comply with a legal or regulatory obligation;
• Where it is necessary for our legitimate business interests (and where we believe your interests and fundamental rights do not override these).
• Where you have given your consent (for example, for marketing emails or non-essential cookies). You may withdraw your consent at any time;
• Recognised legitimate interests under the Data (Use and Access) Act 2025, such as safeguarding vulnerable individuals and responding to emergencies.

Because health data is special category data, we also rely on one of the following conditions under Article 9 of the UK GDPR when we use it:

• Article 9(2)(h): the processing is necessary for the provision of health care or treatment by, or under the responsibility of, a health professional who is subject to a duty of confidentiality;
• Article 9(2)(a): your explicit consent, which we ask for in our consultation booking form and Client Confidentiality and Consent form;
• Article 9(2)(c): to protect your vital interests or those of another person where you are unable to give consent, for example in an emergency;
• Article 9(2)(f): where necessary to establish, exercise or defend legal claims.

We may use your data in some of the ways outlined in the table below:

How do we store your data?

We store your data securely using Google Workspace (including Gmail, Google Drive and Google Sheets), and we have asked Google to store this data at rest in Europe. Our website and online forms are hosted by Squarespace, and forms submitted through our website are exported to a Google Sheet held in our Google Drive. Associate clinicians are responsible for storing their own clinical notes securely and in line with the UK GDPR. They may use the secure Google Drive we provide or their own secure systems.

How long do we keep your data?

We only keep your data for as long as necessary for the purposes we collected it for. Our retention periods are:

• Clinical records (including session notes, assessment reports and health information): 7 years after your last session, in line with professional body guidance;
• Financial and transaction records (including invoices and insurer billing records): 6 years after the end of the financial year to which they relate, to meet our tax and accounting obligations;
• Enquiries and therapist matching forms where you do not go on to book: deleted within one month of it becoming clear that you will not be proceeding, unless the enquiry raises a safeguarding concern, a complaint or a potential legal claim, in which case we keep a brief record for as long as reasonably necessary (generally 7 years);
• Free initial consultations: where no clinical view is formed and you do not proceed, deleted within one month; where a clinical or risk-related view is formed, kept for 7 years;
• Marketing data: until you unsubscribe or withdraw your consent, after which we keep a minimal record so that we do not contact you again;
• Complaints: 6 years after the complaint is closed.

When a retention period ends, we will securely delete or anonymise your data, unless we need to keep it for longer for legal reasons, for example where it is relevant to a legal claim.

International transfers

Some of our service providers (including Squarespace, Acuity Scheduling, Zoom, Jane App, Stripe and Xero) are based in, or may access data from, countries outside the UK and EEA, such as the United States. Where your data is transferred outside the UK, we make sure it is protected by at least one of the following safeguards: the country has been found by the UK to provide an adequate level of protection (including, for certified US organisations, the UK Extension to the EU-US Data Privacy Framework); or we use contracts approved for use in the UK, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Please contact us if you would like more information.

How we keep your data secure

Only authorised people who need access to your data can see it. These are your clinician, Abode’s directors and, where needed to administer your bookings, our virtual assistant. Each of them is bound by confidentiality obligations. If a personal data breach occurs, we have procedures in place and will notify you and the ICO where we are legally required to do so.

Disclosure of your data

Third parties

We will get your express consent before we share your personal data with a third party for marketing purposes.

We may also share your personal data with the following third parties:

• The associate clinician you are matched with or book with, so that they can provide your therapy or assessment. Your clinician is clinically responsible for your care and for the clinical notes they keep. Where those notes are stored on Abode’s Google Drive, Abode and your clinician act as joint controllers of them. Otherwise, your clinician is an independent controller of their clinical notes.
• Service providers who process data on our behalf as our processors, including: Google (Workspace, Gmail, Drive and Sheets, for email and storage); Squarespace (website hosting and online forms); Acuity Scheduling (appointment booking); Zoom and Google Meet (video sessions); Stripe (payment processing); Xero (accounting); Healthcode (billing health insurers); our virtual assistant (administrative support); and Jane App (clinic management software and video sessions). These providers may only use your data on our instructions and must keep it secure.
• Third parties if required to do so by law, in connection with any legal proceedings or in order to establish, exercise, or defend our legal rights, or if legally permitted.
• Your health insurer, where your sessions are funded by insurance, limited to the information needed for billing and authorisation (such as appointment dates) and any treatment updates the insurer requires;
• Your GP or another healthcare professional, with your consent, for example where you ask us to share information or a referral is needed;
• Our professional advisers (such as lawyers, accountants and insurers), HM Revenue & Customs and regulators, where necessary.
• Other third parties with your explicit consent.

In exceptional circumstances, where we or your clinician believe there is a risk of serious harm to you or to another person, we may share information with your GP, your emergency contact, the emergency services or the police without your consent. We will only do this where we have a duty of care or are required or permitted to do so by law. If a client behaves inappropriately during a session (for example, sexually inappropriate behaviour), we may end the session, block that person from our services and report the matter to the police.

Supervision

Our clinicians are required by their regulatory and professional bodies (such as the HCPC and the British Psychological Society) to receive regular clinical supervision. This is common practice to maintain professional standards. When discussing clients in supervision, clinicians keep identifying information to a minimum and do not use your full name. Supervision is carried out in line with each clinician’s professional standards.

Therapy notes and Online/Telephone Sessions

Your clinician will keep clinical notes of your sessions, as required by their regulatory body. These notes are confidential and will identify you. Your clinician is responsible for keeping them secure and in line with the UK GDPR. They may store notes on the secure Google Drive provided by Abode, on the Jane App electronic record management system, or in their own secure system. Any handwritten notes must be kept securely, for example in a locked cabinet. The notes must comply with the requirements of each clinician’s regulatory or professional body.

Please see our Client Confidentiality and Consent form for more information on therapy confidentiality. This will also be verbally explained in your first therapy appointment with one of our therapists.

We do not record therapy or assessment sessions. If you would like to record a session yourself, you must ask your clinician first, and they may refuse. Any recording you make with your clinician’s agreement must be for your own personal use only and must not be shared with anyone else or published. Sessions take place by video using Zoom, Google Meet or Jane App, each of which has its own privacy policy (for example, https://zoom.com/en/trust/privacy/ , https://policies.google.com/privacy and https://jane.app/legal/privacy-notice).

Artificial intelligence and automated decision-making

We do not use artificial intelligence (AI) tools to process your personal data, including to transcribe or summarise sessions, and we have switched off AI features (such as Google Gemini) in our Google Workspace account. We do not make decisions about you using solely automated means. Matches made through our therapist matching forms and consultations are always made by a person. If this changes, we will update this privacy policy before we start.

Data protection compliance

As a controller, we comply with UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), each as amended by the Data (Use and Access) Act 2025. Dr Samantha Adams acts as our Data Protection Lead and is responsible for issues relating to data protection. You can contact us about data protection issues by emailing samantha@abodetherapy.co.uk or welcome@abodetherapy.co.uk.

Details of the service providers we use are set out in the “Disclosure of your data” section above. Each has its own privacy policy, which you can read on its website.

Marketing

We would like to send you information about our services that we think you might like. We will only do this where you have given your consent or, if you are an existing client, where we are telling you about similar services and you have not opted out.

If you have agreed to receive marketing, you may always opt out at a later date.

You have the right at any time to stop us from contacting you for marketing purposes.

If you no longer wish to be contacted for marketing purposes, please click the “unsubscribe” link in any marketing email or email us at welcome@abodetherapy.co.uk.

What are your data protection rights?

We would like to make sure you are fully aware of all of your data protection rights. Every user is entitled to the following:

• The right to access - You have the right to request copies of your personal data.
• The right to rectification - You have the right to request that we correct any information you believe is inaccurate. You also have the right to request that we complete information you believe is incomplete.
• The right to erasure - You have the right to request that we erase your personal data, under certain conditions.
• The right to restrict processing - You have the right to request that we restrict the processing of your personal data, under certain conditions.
• The right to object to processing - You have the right to object to our processing of your personal data, under certain conditions.
• The right to data portability - You have the right to request that we transfer the data that we have collected to another organisation, or directly to you, under certain conditions.
• The right to withdraw consent - Where we rely on your consent, you can withdraw it at any time. This does not affect processing carried out before you withdrew it.
• Rights relating to automated decision-making - You have the right not to be subject to significant decisions based solely on automated processing without appropriate safeguards, including the right to request human review. We do not currently make such decisions.

We do not usually charge a fee for a request. We will respond within one month. If we need to confirm your identity or ask you to clarify your request, the time limit starts once we receive that information. We may extend the deadline by up to two further months for complex or multiple requests, and we will tell you if we do. When responding to a request for access, we will carry out a reasonable and proportionate search. If you would like to exercise any of these rights, please contact us at our email: welcome@abodetherapy.co.uk. If you are unhappy with how we handle your request, please see the “Not happy with something?” section above.

Use by children

Our website and services are designed for adults aged 18 and over, and we do not provide therapy or assessments to children. We ask everyone to confirm their date of birth when they register. We request that individuals under the age of 18 do not provide any personal data to us. If we discover that an individual under this age has provided data to us, we will delete it, unless we need to keep it to address a safeguarding concern.

Do we use cookies?

Cookies help make our website work better for you, remembering your preferences and improving your experience. Our website uses cookies to distinguish you from other users of our website. We only use non-essential cookies (such as analytics or advertising cookies) with your consent, which you can give or withdraw at any time using the cookie settings link in our website footer.

Please refer to our Cookie Policy to learn more about the cookies we use and how to manage them: www.abodetherapy.co.uk/cookie-policy

Privacy policies of other websites

The Abode Therapy website contains links to other websites. Our privacy policy applies only to our website, so if you click on a link to another website, you should read their privacy policy.

Changes to our privacy policy

We keep our privacy policy under regular review and place any updates on this web page. This privacy policy was last updated on 1^st November 2026.

How to contact us

If you have any questions about our privacy policy, the data we hold on you, or you would like to exercise one of your data protection rights, please do not hesitate to contact us.

Abode Therapy Ltd. Is a company incorporated and registered in England and Wales with company number 12885677 whose registered office is 6 Genesis Business Centre, Redkiln Way, Horsham, West Sussex, RH13 5QH

How to contact the appropriate authority

If you have a concern about how we use your personal data, please follow the steps in the “Not happy with something?” section above. If you are not satisfied with our response, you may contact the Information Commissioner’s Office (ICO), which is the UK supervisory authority for data protection issues (www.ico.org.uk).