GDPR statement
Client privacy notice | East London and City Therapy | Updated 9 September 2026
I am Carlo Ricciardi, a sole trader trading as East London and City Therapy. I am the data controller: I decide why and how personal information is used in my practice. This notice explains how I use information about enquiries, referrals and individual adult clients. My clients are based in the UK, although they may occasionally attend an online session while temporarily abroad.
For privacy questions, requests about your information or complaints, contact carlo@eastlondonandcitytherapy.com. Website cookies and advertising measurement are explained separately in the website privacy policy: https://www.eastlondonandcitytherapy.com/privacy-policy-1.
Information I collect
I collect contact and identification details, including your name, date of birth, address, telephone number and email address; GP details; and your emergency contact’s name, relationship to you and telephone number. I also keep enquiry correspondence, appointment and attendance details, payment records and brief therapy notes.
Therapy information may include mental and physical health, medication, relevant personal history, relationships, sexual life or orientation, beliefs and other sensitive matters you choose to discuss. I collect information relevant to providing therapy and managing the practice, rather than asking for unnecessary detail.
Where information comes from
Most information comes from you through conversation, website forms, email, telephone, text messages, WhatsApp and therapy sessions. National Ugly Mugs may refer you and supply contact details and relevant background. I do not routinely report information about you or your therapy back to National Ugly Mugs.
If you provide an emergency contact’s details, please let them know you have done so and share this notice where it is appropriate and safe. I use those details to support contact in an emergency, not to involve that person routinely in your therapy.
Providing information
Information marked as required on the client form helps me identify and contact you and plan safe care. If you cannot provide it, contact me so we can discuss what is needed and whether therapy can safely proceed. You do not have to disclose every personal detail. I arrange appointments directly with you and agree the therapy arrangements verbally; Wix is used for collecting forms, not booking appointments.
Why I use information
Legal bases
For responding to your request for therapy, arranging appointments, providing sessions and administering payment, I rely on steps you ask me to take before a contract and performance of our therapy agreement (UK GDPR Article 6(1)(b)). The agreement may be verbal.
For proportionate clinical supervision, practice administration, record retention and handling complaints or legal claims, I rely on legitimate interests (Article 6(1)(f)): providing accountable care, keeping appropriate records and protecting legal rights. I balance those interests against your rights and the sensitivity of the information.
For tax records and disclosures that a specific law requires, I rely on legal obligation (Article 6(1)(c)). In an emergency, vital interests (Article 6(1)(d)) may apply where processing is necessary to protect a person’s life.
Health and other sensitive information
Health and other special-category information needs an additional condition. For information necessary to provide therapy and associated clinical care, I rely on the health or social care condition (Article 9(2)(h), Article 9(3) and Data Protection Act 2018 Schedule 1, Part 1, paragraph 2), with the duty of confidentiality that applies to the therapeutic relationship.
Where necessary to establish, exercise or defend legal claims, Article 9(2)(f) applies. In a life-threatening emergency, Article 9(2)(c) may apply if the person is physically or legally incapable of giving consent. Other safeguarding disclosures require a condition that applies to the particular circumstances; concern alone is not a blanket permission to disclose.
Agreement to therapy and acknowledgement that you have read this notice are separate from consent as a data-protection legal basis. The form acknowledgement does not waive your rights or give unlimited permission to use your information. If I ask for consent for a separate optional use, I will explain that use and how to withdraw consent.
Confidentiality and sharing
I discuss clinical work in confidential supervision, using first names only and limiting identifying detail. A first name does not make the discussion anonymous. My supervisor does not have direct access to your client record.
I normally discuss any proposed contact with your GP or another professional with you first. I may share the minimum necessary information without your agreement where a lawful and justified disclosure is needed to protect someone from serious harm, meet a specific legal duty or comply with a valid court order. I will explain this where it is safe and lawful to do so. Information may also be disclosed where necessary and lawful for a complaint or legal claim. I do not treat all suspected crime as automatically reportable.
Storage and service providers
All my client records are electronic. Notes and contact details are stored on a password-protected computer, with a backup in OneDrive. Notes are held separately from identifying details and labelled with a client code rather than a name. This is pseudonymisation, not anonymisation: I can still link a record to its client.
I use two-step verification for Google Workspace, Microsoft/OneDrive and Wix. Only I have direct access to my practice records; I have not appointed an administrator or another person authorised to manage them if I become unable to practise. Service providers necessarily process information to operate the services described below.
Services used in my practice
Wix hosts the website and receives and stores form submissions. Google Workspace provides my practice email. For client emails containing personal information, I save the relevant details to the client record and delete the email. Enquiries that do not lead to therapy follow the separate retention rule below.
I use Microsoft 365 Personal with personal Microsoft accounts for OneDrive and Teams. Microsoft Teams is my main video-call service; WhatsApp, Zoom and Apple FaceTime are backups. I also communicate by SMS and the ordinary WhatsApp app. I do not record sessions, use automatic transcription or AI session summaries, or use AI tools to read or write client notes. ChatGPT is not authorised to access my practice inbox or client records.
Payment is by bank transfer, PayPal or cash. Banks and PayPal process payment and transaction information for their own financial, security and legal purposes. A cash payment is recorded in my financial records. Relevant communications providers process messages and call-related information to provide their services.
Processing outside the UK
These providers operate internationally. Information may be processed outside the UK, including in the EEA, the United States and other countries used by their infrastructure and support teams. A UK-based client attending a session while travelling is a different issue from a provider storing or processing information overseas.
Providers describe their own international-transfer arrangements in their privacy notices. These may include UK adequacy regulations, an applicable UK Extension to the EU-US Data Privacy Framework, or standard contractual clauses with UK transfer provisions. Microsoft’s consumer privacy statement and WhatsApp’s UK privacy policy describe such safeguards. This does not mean that a business processing agreement applies to a personal account.
You can ask me about the services used for your information and request details of applicable safeguards. Provider notices are available at the links at the end of this statement. My personal-account processing and transfer arrangements are being reviewed; I will update this notice if the services or arrangements change.
Retention and your rights
How long I keep information
Therapy notes and the associated core client record: seven years after therapy ends, in line with the retention period confirmed with my insurer. This is a practice retention rule, not a universal statutory seven-year rule for counselling.
Former clients’ Wix information forms, SMS and WhatsApp correspondence: reviewed annually and deleted when therapy ended more than seven years earlier. These copies may therefore remain for seven to eight years. Relevant information saved into the core therapy record follows the core record’s retention period.
Enquiries that do not lead to therapy, including email correspondence and Wix submissions: reviewed annually and deleted when the last contact was more than 12 months earlier. They may therefore remain for up to about two years.
Financial records: deleted seven years after the end of the relevant tax year. They are separate from therapy notes and remain subject to data protection law.
A particular record may need to be retained longer for an existing complaint, claim or specific legal requirement. I limit any extension to what is necessary and record the reason. Deletion includes the copies under my control; provider backup, recovery and independently controlled financial records may follow the provider’s own deletion or legal retention arrangements.
Your rights
You can ask for access to your personal information, correction of inaccurate facts, completion of incomplete information, deletion, or restriction of use. You can object to processing based on legitimate interests. Data portability applies where its legal conditions are met, including certain information processed automatically on a contract or consent basis. These rights have conditions and lawful exceptions; a retention policy does not automatically defeat a request.
Clinical notes are not generally exempt from correction. An accurate record of a professional opinion at the time may be retained as an opinion; a factual error can be corrected and your disagreement or later information can be added without rewriting the history inaccurately.
You can make a request verbally or in writing. I normally respond without undue delay and within one month, subject to the lawful rules on identity checks, clarification and extensions. If an extension is permitted, I will explain why and when to expect a response. Requests are normally free. I do not make solely automated decisions that have legal or similarly significant effects on you.
Privacy complaints
Contact carlo@eastlondonandcitytherapy.com or tell me directly if you are concerned about the use of your information. I will acknowledge a privacy complaint within 30 days, investigate appropriately without undue delay, keep you informed and communicate the outcome without undue delay. You can also complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/ or on 0303 123 1113.
Further privacy information
This statement is available on my website and linked from the client information form. The acknowledgement wording is “I have read the GDPR statement”. If you need a copy or another accessible format, please contact me. I will bring material changes to the use of your information to your attention.
Provider privacy notices
Wix: https://www.wix.com/about/privacy
Google and Google Workspace: https://policies.google.com/privacy and https://cloud.google.com/terms/data-processing-addendum/
Microsoft consumer services, including personal OneDrive and Teams: https://www.microsoft.com/en-us/privacy/privacystatement
WhatsApp UK: https://www.whatsapp.com/legal/privacy-policy-uk
Zoom: https://www.zoom.com/en/trust/privacy/
Apple FaceTime: https://www.apple.com/legal/privacy/data/en/face-time/
PayPal UK: https://www.paypal.com/uk/legalhub/paypal/privacy-full
Your mobile network and bank also provide their own privacy notices. Provider policies cover their own processing and do not replace my responsibilities for your information.