Privacy Notice

This privacy notice explains how David Cervera collects, uses, stores, and protects your personal data and clinical records. It also outlines your rights regarding your data under the UK GDPR and the Data (Use and Access) Act.

1. Who I Am (The Data Controller)

I am a private therapist operating as a sole trader. For the purposes of data protection laws, I am the "Data Controller" of your personal information.

Name: David Cervera

Contact Email: hello@davidcerveratherapy.com

ICO Registration Number: ZB771817

2. The Data I Collect & Why I Process It

To provide you with safe and professional therapeutic treatment, I need to collect and process several types of information about you:

Contact & Administrative Information: Your name and email address. I use this to manage our appointments and contact you regarding sessions.
Emergency Contact Information: If necessary I may gather the name and telephone number of a trusted contact or your GP. I only use this in emergency situations where I am concerned for your immediate safety.
Special Category Data (Clinical Records): This includes brief session notes, psychological histories, health details, and any therapeutic assessments. I hold this data to guide our therapeutic work and ensure clinical safety.

My Lawful Bases for Processing Data:

Under data protection laws, I must have a valid legal reason to hold your data. My reasons are:

Contract: I need your administrative and contact details to fulfil our agreement to provide therapy.
Special Category Data (Health & Social Care): I process your health and clinical records under the specific legal basis that allows health professionals to provide healthcare and psychological treatment.

3. How Your Data Is Stored & Shared

Your confidentiality is a foundational part of our therapeutic relationship. I will never sell or rent your data, and I do not use it for marketing purposes.

Secure Storage: Your digital clinical notes and bookings are managed securely on my password-protected computer using encrypted storage. Digital payments are handled via secure bank transfer.
Website Analytics: I use a lightweight, cookieless analytics tool called Umami to understand which pages are helpful to visitors. It does not set any cookies, track you across other websites, or store your IP address. If you prefer not to be counted in my statistics, you can easily block the script via your browser settings.
Confidentiality Exceptions: I will keep all of your information strictly confidential unless I am legally or ethically required to share it. This only occurs if:
I believe you or someone else is at risk of serious, imminent physical harm.
I am ordered to do so by a court of law.
It is a statutory requirement (such as reporting specific criminal acts under terrorism or money laundering laws).

4. How Long I Retain Your Records

I do not keep your records indefinitely, but as a healthcare practitioner, I am required by professional insurance and clinical guidelines to retain them for a set period.

Adult Records: Your clinical notes and contact records will be kept securely for [check with your insurer: 5/7] years following our final session. After this period, any existing paper files are securely shredded, and digital files are permanently deleted.
Minor Records: For clients who were under 18 at the time of treatment, records are retained until their 25th birthday.

5. Your Data Protection Rights

Under data protection law, you have several rights regarding the information I hold about you:

The Right of Access (Subject Access Request): You can ask for a copy of the personal data and clinical notes I hold about you at any time. In accordance with the law, I will fulfil reasonable and proportionate requests within one calendar month.
The Right to Rectification: You can ask me to correct any factual inaccuracies in your records.
The Right to Restriction or Erasure: You can ask me to restrict or delete certain parts of your administrative data, though please note that I am legally and professionally required to retain core clinical notes for the retention period mentioned above.

6. How to Make a Data Protection Complaint

If you have any concerns or are unhappy with how your personal data or clinical records are handled, you have the right to lodge a formal complaint directly with me.

To make a complaint, please email me at hello@davidcerveratherapy.com with the subject line "Data Protection Complaint."

My Response Commitment: I will formally acknowledge your complaint within one calendar month of receiving it.
Investigation: I will investigate your concerns thoroughly and without undue delay, keeping you updated on my progress.

If you remain unsatisfied with how I handle or resolve your complaint, you have the statutory right to escalate the matter to the UK data protection regulator:

Information Commissioner’s Office (ICO) Website: www.ico.org.uk Helpline: 0303 123 1113