UK GDPR Privacy Notice for Anna Burford MBR Practitioner.

Privacy Notice

Data Controller
Anna Burford
Email: annaburford.mbr@gmail.com

1. Introduction

I am committed to protecting your personal information and respecting your privacy. This Privacy Notice explains how I collect, use, store, and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information I Collect

I may collect and process the following categories of personal information:

  • Name, address, email address, and telephone number

  • Date of birth

  • Emergency contact details

  • GP details (where relevant)

  • Information relating to your physical and mental health

  • Session notes and records

  • Payment and invoicing information

  • Correspondence between us

As a therapist, I process special category data relating to health and wellbeing.

3. Why I Collect Your Information

I collect and use your personal information to:

  • Provide therapeutic services

  • Maintain clinical records

  • Arrange appointments and communicate with you

  • Ensure your safety and wellbeing

  • Meet professional, legal, and regulatory obligations

  • Manage payments and administration

4. Lawful Basis for Processing

Under UK GDPR, my lawful basis for processing your personal data is:

  • Article 6(1)(b): Processing is necessary for the performance of a contract for therapeutic services.

  • Article 6(1)(f): Legitimate interests in managing and operating a professional therapy practice.

  • Article 9(2)(h): Processing is necessary for the provision of health or social care.

  • Where applicable, Article 9(2)(a): Explicit consent.

5. Confidentiality and Disclosure

All information shared during therapy is treated confidentially.

However, confidentiality may be broken where:

  • There is a serious risk of harm to you or another person.

  • Disclosure is required by law or court order.

  • There are safeguarding concerns involving a child or vulnerable adult.

  • Disclosure is necessary for professional supervision, in which case identifying information will be minimised wherever possible.

6. How Your Information Is Stored

Your information is stored securely using password-protected and/or encrypted systems.

I take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or disclosure.

7. Retention of Records

Client records are retained for [insert retention period, e.g., 7 years after the end of therapy] and then securely destroyed.

Retention periods may vary where legal, insurance, safeguarding, or professional requirements apply.

8. Sharing Information

I do not sell or share your personal information for marketing purposes.

Information may be shared only where necessary with:

  • Clinical supervisors

  • Professional indemnity insurers

  • Legal advisers

  • Regulatory bodies

  • Emergency services or safeguarding authorities where required

9. Your Rights

Under UK GDPR, you have the right to:

  • Access your personal information

  • Request correction of inaccurate information

  • Request erasure of information where applicable

  • Restrict processing in certain circumstances

  • Object to processing where applicable

  • Request data portability where applicable

  • Withdraw consent where processing relies on consent

Some rights may be limited where exemptions apply to therapy records.

10. Complaints

If you have concerns about how your personal data is handled, please contact me in the first instance.

You also have the right to lodge a complaint with the:

Information Commissioner's Office (ICO)

11. Contact

If you have any questions regarding this Privacy Notice or how your information is processed, please contact:

Anna Burford
annaburford.mbr@gmail.com

Last Updated: 12/06/2026