Updated June 2026
Part One: Your data protection rights
I process personal data about you in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Data controller: Andrea English trading as AE Therapy
ICO registration number: 00044798745
Under UK data protection law, you have the following rights in relation to your personal data:
• Right of access: you can request a copy of the personal data I hold about you.
• Right to rectification: you can ask me to correct any inaccurate information.
• Right to erasure: in certain circumstances, you can ask me to delete your data.
• Right to restriction: you can ask me to restrict how I use your data while a concern is being investigated.
• Right to data portability: where processing is based on consent or contract, you can ask for your data in a portable format.
• Right to object: you can object to processing carried out on the basis of legitimate interests.
Data protection complaints
If you have a concern about how your personal data has been handled, for example a request to access or delete your records that was not dealt with to your satisfaction, or a concern about whether your information was shared appropriately or stored securely, please raise it with me directly in the first instance.
Please note that this covers concerns about data handling only, not about the therapeutic relationship or professional conduct.
To raise a data protection concern, please contact me at andreajenglish@outlook.com . I will acknowledge your concern within 30 days and respond as promptly as possible. If you remain dissatisfied, you have the right to raise a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.
Data breaches
In the unlikely event of a data breach affecting your information, I will assess the risk and, where required, report it to the Information Commissioner’s Office and inform you directly without undue delay.
Part Two: How I work with your information
This section is specific to my practice and explains what information I hold and how I handle it.
I hold the following personal information relating to you:
• Name, date of birth, address, telephone number, email address, GP details, emergency contact
I hold this information to enable me to undertake my obligations to you in my professional role, and to communicate with you during the course of our work together.
Storage: I make paper notes and keep brief digital records of the work we do and these are kept in a locked filing cabinet or in password protected digital files stored on a secure digital platform.
Retention: Information is held for 7 years and then destroyed.
Sharing your information with third parties
I do not share your information with any third parties except in the following situations:
• I may discuss your work in clinical supervision, in an anonymised form wherever possible.
• I may share your information with relevant professionals or authorities if I believe that you or another person is at risk of serious harm.
• I may share your information where required to do so by law.
• I will share your name and contact details with my clinical executor, so they may contact you in the event of my death or incapacity.
• If you are working with me through an insurer, I may share your name and date of birth in order to confirm identification and funding authorisation. Minimal additional information may be shared in order to request additional sessions.
This notice forms part of my working agreement with you.