Privacy Policy

Last updated: September 2026

What is the purpose of this policy?

I recognise that you trust me with your personal information and I take my data protection responsibilities seriously. This privacy notice explains how I handle any personal information about you, what I do with your information, why, and what rights you have. I have tried to keep it plain. If anything here is not clear, please ask me.

If we work together, this notice sits alongside the written contract we agree at the start — the therapy contract, or the supervision or group contract. Those set out confidentiality and the practical arrangements between us. This notice explains what happens to your information.

1. Who I am

I am Helen Rowland. I work through my limited company, Helen Rowland Psychotherapy Training & Supervision Ltd, offering individual psychotherapy, clinical supervision (individually and in groups), specialist consultation, and reading, study and training groups for qualified and trainee therapists. I work primarily online, and I offer occasional in-person and online workshops across the UK and internationally.

I also work as a visiting trainer at psychotherapy training institutes and as a co-editor of the Transactional Analysis Journal. Section 3 explains how those roles affect information about you, and who is responsible for it.

The company is the data controller for the information held about you. That means it is responsible for deciding how your information is held and used, and accountable for looking after it. In practice I am the only person who sees it, apart from the people named in section 7.

• Registered name: Helen Rowland Psychotherapy Training & Supervision Ltd

• Registered in Scotland, company number SC827507

• Registered office: 5 South Charlotte St, Edinburgh EH2 4AN

• Email: helen@helenrowland.co.uk

• Text or WhatsApp: 07949 524819 (please do not leave a voicemail, as I do not collect them)

• My UKCP registration as a psychotherapist: 06158142

• ICO registration: ZB884656

Email is the best way to reach me about anything in this notice.

2. Who this notice is for

This notice covers everyone I hold information about in the course of my work:

• people who contact me but do not go on to become clients or supervisees

• individual psychotherapy clients

• supervisees, seen individually and in supervision groups

• people who come for specialist consultation

• members of my reading, study and training groups, and workshop participants

• people who have signed up to my mailing list

• colleagues, authors and reviewers I deal with through my editorial and training work

Where something applies only to one of these groups, I have said so.

3. What information I hold

When you first get in touch, I hold your name, email address, phone number and whatever you choose to tell me about what is bringing you to therapy, supervision or a group, together with the messages between us. If you do not go on to work with me, I delete this after six months.

If you are a psychotherapy client

I also hold:

• notes of our sessions — I keep these brief and I use reasonable efforts not to include information that would identify you

• a short record of your name, email address, phone number, GP details, and the number of sessions we have had

• emails and messages between us, and appointment details

• a record of payments and invoices

Much of what you tell me in therapy is what data protection law calls special category information. This is information that needs extra protection — for example, your health and mental health, your ethnicity, your religious or philosophical beliefs, your sexual orientation, your gender identity, and your relationships. You are not obliged to tell me any of it. It comes up because it is part of the work.

Your notes may also mention other people — a partner, a family member, a colleague. I keep what I record about them to the minimum needed to make sense of our work.

If you are a supervisee or consultee

I hold your name and contact details, your training and training institute (where applicable), your professional body and registration status, notes of our supervision, and a record of sessions and payments. I keep individual notes for each supervisee, including where I see you in a group.

I ask supervisees not to share identifiable information about their own clients with me. Where you bring a recording and/or transcript of your own client work, it stays yours and I do not keep a copy. It is your responsibility to make sure your client has agreed to it.

If you are in a supervision group

Other members of the group will hear what you bring, including what you say about your own client work. At the start of the group we agree that what is said in the group stays in the group, and that client material is anonymised. I cannot guarantee that other members will keep to that agreement.

Group members usually exchange contact details with one another. Those details are then held by the people you have shared them with, and are outside my control.

If you are a member of a reading, study or training group, or attend a workshop

I hold your name and contact details, your professional body or training institute, your level of experience, a record of attendance and payments, and the attendance contract where one applies. The same points about confidentiality and anonymising clinical material apply, and members often share contact details with each other.

If you are in one of my WhatsApp groups

I run WhatsApp groups for some supervision and reading groups, for practical messages between sessions. Please note that your phone number and profile name are visible to every other member of the group. WhatsApp messages are encrypted in transit, but WhatsApp is owned by Meta, which holds information about who is messaging whom and when. I ask everyone not to post client material in these groups, and I would encourage you to tell me if you would rather not be added to one.

If you ask about a subsidised place

I hold what you choose to tell me about your circumstances. I keep this to the minimum needed and I do not ask you for evidence.

If you are on my mailing list

I hold your first name, last name, email address, phone number, how you heard about me, and a record of when you signed up and confirmed your subscription.

If you are an author, reviewer or colleague connected with the Transactional Analysis Journal

I am one of the Journal’s co-editors. The International Transactional Analysis Association and the Journal decide how author and reviewer information is used, so they are responsible for it rather than me, and their privacy information applies to that work. Manuscripts reach me through a copy editor at Routledge, the Journal’s publisher.

In the course of editing I hold correspondence, manuscript drafts and review notes in my email and in my own file storage. I use them only for the Journal’s editorial process and never for anything to do with my practice.

If you attend training where I am a visiting trainer

The training institute that engages me is responsible for your information, and its terms apply rather than mine. I hold only what I need in order to teach, such as a participant list, and I return or delete it at the end of the training. I do not hold assessment records, personal therapy hours or fitness-to-practise material for any institute.

4. Where I get information about you from

Almost always I get this information directly from you: by email, by text or WhatsApp, through the contact form on my website, in sessions, or when you sign up to my mailing list. Occasionally someone is referred to me by a colleague, a training institute or another professional. I only keep that information if we go on to have a professional relationship.

5. Why I use your information, and my lawful basis

Under UK data protection law, I need a lawful basis for everything I do with your information.

• Arranging and providing therapy, supervision, consultation, groups and workshops, and communicating with you about it: Contract; and for special category information, Article 9(2)(h) UK GDPR with paragraph 2, Schedule 1 of the Data Protection Act 2018 (health or social care purposes, provided by someone under a duty of confidentiality)

• Keeping clinical records: Contract, and my legitimate interests in practising safely and being able to answer a complaint or claim

• Discussing my work in my own supervision, as my professional body requires: My legitimate interests in ethical and competent practice

• Invoicing, payments and tax records: Contract, and legal obligation

• Sending my newsletter, and letting you know about groups, workshops and waiting list availability: Your consent

• Corresponding with colleagues about editorial, training and professional work: My legitimate interests in meeting my commitments to the organisations I work with

• Contacting someone else if I believe you or another person is at serious risk of harm: Vital interests, and where it applies, the safeguarding condition in paragraph 18, Part 2, Schedule 1 of the Data Protection Act 2018

• Responding to a legal requirement, court order, complaint or claim: Legal obligation, and my legitimate interests in defending legal claims

I do not sell your information, and I do not use it for automated decision-making or profiling. The only marketing I do is my own newsletter, which you have to ask to receive and can stop at any time.

6. How I store and protect your information

Some of my session notes are handwritten and kept securely at home. The rest are electronic, held on my own device rather than in the cloud, in password-protected files on an encrypted device, with two-factor authentication on the accounts I use.

Emails are held in Google Workspace, which is a business service with a data processing agreement rather than a personal email account. I read and send email using Spark, an email application made by Readdle. Spark holds account credentials and some message data on its own cloud infrastructure so that features such as notifications and syncing between devices can work, which means emails between us pass through Readdle’s systems as well as Google’s.

Text and WhatsApp messages are held on my phone, which is passcode-protected. I keep individual messages to practical matters, such as arranging or changing an appointment. Section 3 explains how the WhatsApp groups work.

Online sessions are held on Zoom.

Invoices are raised and sent through FreeAgent, an accounting service. My mailing list is held by MailerLite. Both are business services with their own data protection terms.

Your name and contact details only are held for the arrangements described in section 10.

If something goes wrong and your information is lost, disclosed or accessed when it should not be, I will tell you and the Information Commissioner’s Office where the law requires it.

7. Who I share your information with

I will not share your information with anyone else without your consent, except in the situations below.

People I share with in the ordinary course of the work

• My own supervisor. I discuss my client work in supervision, as my professional body requires. I use first names only and keep identifying detail to a minimum. My supervisor is a registered psychotherapist bound by a professional ethical code.

• If you are in training and you need me to sign a record of therapy, supervision or group sessions attended, which will always be with your express consent. I may also need to complete a supervision or attendance report for your training provider.

• My Clinical Executor, but only if I die or become incapacitated. See section 10.

• My accountant, who has access to my invoicing and accounting records. They are bound by a confidentiality and data processing agreement, and they see names and amounts, never anything about the content of our work.

People I share with only where I have to

• Emergency services, your GP, or another appropriate person, if I reasonably believe you or someone else is at serious risk of harm. Wherever it is possible and safe, I will discuss this with you first.

• A court, or another body I am legally required to disclose to, including under legislation on safeguarding, terrorism or criminal activity.

• My professional body or insurer, if there is a complaint or claim.

• My legal advisers, if I need legal advice.

Service providers who handle information on my behalf

These act on my instructions and cannot use your information for their own purposes:

• Google Workspace: email, calendar and file storage

• Spark (Readdle): the email application I use to read and send email

• Squarespace: my website and its contact form

• Zoom: online sessions

• MailerLite: my mailing list and newsletter

• FreeAgent: invoicing and accounts

WhatsApp sits slightly differently. It is not acting on my instructions, and Meta holds information about messages sent through it, so I keep what I use it for to a minimum. Section 3 explains this in more detail.

Some of these providers store information outside the UK, including in the United States. Where that happens, the transfer is covered by safeguards approved under UK data protection law, such as the UK International Data Transfer Addendum.

If you are outside the UK

Workshop participants and group members join me from many different countries. Wherever you are, I handle your information in the way this notice describes, and you can contact me about it in the same way. Depending on where you live, your own country’s data protection law may give you additional rights.

8. How long I keep your information

• Enquiries from people who do not go on to work with me: 6 months

• Client records: 7 years after our work ends

• Supervision and consultation records: 7 years after our work ends

• Reading, study and training group and workshop records: 5 years after the group or workshop ends

• Invoices and financial records: 7 years, to meet tax requirements

• Emails, texts and WhatsApp messages: deleted in line with the periods above

• Mailing list details: until you unsubscribe or ask me to stop

• Contact details held for waiting lists: until you ask me to stop, or one year, whichever is sooner

• Editorial correspondence for the Transactional Analysis Journal: see section 3

I keep client and supervision records for seven years because my professional body and my indemnity insurer require it, and because I need to be able to show I have acted properly if a complaint or claim is ever made. This means there are periods during which I cannot delete some information even if you ask me to. I will always explain why if that comes up. Anything I no longer have a reason to keep, I delete or destroy securely.

9. Your rights

You have the right to:

• ask for a copy of the information I hold about you

• ask me to correct anything inaccurate or incomplete

• ask me to delete it, in some circumstances

• ask me to restrict or stop using it, in some circumstances

• object to how I am using it

• ask me to transfer it to you or someone else, where that applies

• withdraw your consent at any time, where I have relied on your consent — for my newsletter, or for keeping you on a waiting list

• complain, both to me and to the ICO. See section 11

Please make requests by email. I will respond within one month. If I need to ask you for more information before I can deal with your request, that time limit pauses until you reply. Withdrawing consent will not affect the quality of the work between us, although it may affect what I can offer safely and ethically.

10. If I die or become incapacitated

My professional body requires me to have arrangements in place so that clients are not left without support if something happens to me. This is often called a clinical will. I have appointed a psychotherapist as my Clinical Executor, in accordance with UKCP requirements. If I die or become incapacitated, they can access your name, email address and phone number — and nothing else — in order to contact you, let you know what has happened, and help you find support elsewhere. They are bound by the same kind of ethical code and duty of confidentiality that I am.

11. How to complain

If you are unhappy with how I have handled your information, please tell me. You can use the form below, email me at helen@helenrowland.co.uk, or tell me directly. You do not need to use any particular form of words, or call it a complaint. I will:

• acknowledge your complaint within 30 days

• look into it without undue delay

• keep you updated on progress

• tell you the outcome, and what you can do if you are not satisfied

I keep a record of complaints and how they were dealt with.

You can also complain to the Information Commissioner’s Office at any time, whether or not you have raised it with me first: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline: 0303 123 1113

12. Cookies and this website

My website uses only the cookies it needs to function. I do not use analytics, tracking or advertising cookies of my own, and nothing about your visit is monitored by me. The sign-up form for my mailing list is provided by MailerLite and is embedded in the page. It sets its own cookies. MailerLite explains which ones it uses and what each of them does here. If anything about this changes, I will update this notice first.

13. Changes to this notice

I review this notice at least once a year, and whenever my practice or the law changes. The current version will be on this page.

© Helen Rowland Psychotherapy Training & Supervision Ltd, 2026