Website privacy policy

East London and City Therapy | Updated 9 September 2026

I am Carlo Ricciardi, a sole trader trading as East London and City Therapy and the data controller for this website. Contact carlo@eastlondonandcitytherapy.com for privacy questions, requests or complaints. This policy covers website visits, enquiries, forms and optional measurement. My GDPR statement covers client records and therapy: https://www.eastlondonandcitytherapy.com/gdpr-statement-east-london-therapy.

Enquiries and forms

When you contact me or request a consultation, I receive the contact details and information you enter. The client information form also asks for date of birth, address, GP details and an emergency contact. Please avoid putting unnecessary sensitive detail in an initial enquiry.

Wix receives and stores form submissions, and I use Google Workspace for email correspondence. I arrange appointments directly; the website forms request contact and do not book a session. I use information to respond, discuss whether therapy is appropriate and administer our work together.

For an enquiry about entering a therapy agreement, the legal basis is taking steps at your request before a contract (Article 6(1)(b)). For other routine correspondence and secure website administration, it is my legitimate interest in operating the practice and responding to communications (Article 6(1)(f)). Health information relevant to care is handled as explained in the GDPR statement; submitting a form is not a blanket consent to unrelated uses.

Hosting and security

Wix and the services used to deliver the website may process technical information such as IP address, browser and device details, requested pages, timestamps, referring pages and security events. This supports delivery, requested features and protection against spam and misuse. Necessary technologies may operate without optional-cookie consent. Optional analytics and advertising measurement are described below.

Retention of form information

Enquiries that do not lead to therapy are reviewed annually and deleted when the last contact was more than 12 months earlier, so they may remain for up to about two years. Former clients’ Wix information forms and retained SMS/WhatsApp correspondence are reviewed annually and deleted when therapy ended more than seven years earlier, so they may remain for seven to eight years. Core therapy records are kept for seven years after therapy ends. Financial records are deleted seven years after the end of the relevant tax year. Necessary exceptions for an existing complaint, claim or legal duty are considered individually.

Cookies and measurement

Your choice

The cookie banner offers a choice about optional Google Analytics and Google Ads measurement. You can accept or decline, and revisit your choice using “Cookie settings” in the footer. Refusing optional measurement does not prevent you from making an enquiry. Consent is the legal basis for this optional measurement (Article 6(1)(a)) and the associated storage or access on your device.

Your choice is stored in your browser’s local storage so the site can remember it. Local storage does not have an automatic expiry in the current implementation; it remains until changed or cleared. You can also clear cookies and site storage in your browser. Withdrawing consent applies to future measurement and does not undo processing that was lawful before withdrawal.

Google Analytics

After acceptance, Google Analytics helps measure visits and use of the website. It may receive page addresses, referral and campaign information, event times, browser and device information, online identifiers and technical connection information. Reports help me understand which pages are used and how people find the practice.

Google documents default expiry periods of two years for the _ga and _ga_<container-id> analytics cookies; browser limits or configured settings can shorten these periods. Cookie lifetime is different from the retention of event data and reports on Google’s systems. Google’s cookie information is at https://support.google.com/analytics/answer/11397207 and its privacy information is at https://policies.google.com/privacy.

Google Ads conversion measurement

After acceptance, the website’s Google Ads tracking records a successful contact or consultation enquiry submission so I can understand whether advertising leads to enquiries. It uses advertising/campaign identifiers and technical event information, including a random transaction identifier. The custom conversion event does not send the form’s name, email, telephone number or message contents to Google.

The custom conversion tracking excludes the client information submission form. Enhanced conversions and advertising personalisation are disabled in the reviewed setup. This does not mean that measurement is anonymous: Google may still receive IP addresses, cookies, page URLs and other online identifiers. Its technologies and retention information are explained at https://policies.google.com/technologies/cookies.

Fonts and external services

The website uses font files and other resources to display its pages. If a resource is requested directly from an external provider, that provider receives technical connection information such as an IP address. Locally served font files do not require a request to Google Fonts. Links to external services take you to sites governed by their own privacy notices.

Providers and your rights

Recipients and international processing

Wix provides hosting and form services; Google provides practice email and, with your optional measurement consent, Google Analytics and Google Ads. Banks and PayPal process payment information if you choose those payment methods. Provider systems can process information outside the UK, including in the EEA, United States and other countries used for infrastructure or support.

Providers describe transfer protections in their own notices, including adequacy arrangements and contractual safeguards where applicable. Google’s processing addendum includes UK transfer provisions for covered services. The safeguards applying to a particular account or service must be distinguished from a provider’s general privacy statement. You can contact me to request information about the providers and safeguards used for your information.

Provider notices: Wix https://www.wix.com/about/privacy; Google https://policies.google.com/privacy; Google Workspace processing terms https://cloud.google.com/terms/data-processing-addendum/; PayPal https://www.paypal.com/uk/legalhub/paypal/privacy-full. Providers may keep technical, security or financial information for their own lawful purposes under those notices, independently of copies held by my practice.

Access and other rights

You can request access, correction, deletion or restriction of your personal information, object to legitimate-interest processing and, where applicable, request data portability. Where processing relies on consent, you can withdraw that consent. The rights have legal conditions and exceptions; I will explain any that affect a request. I do not make solely automated decisions with legal or similarly significant effects about prospective or existing clients.

Requests may be made verbally or in writing to carlo@eastlondonandcitytherapy.com. I normally respond without undue delay and within one month, subject to lawful identity-checking, clarification and extension rules, and normally without charge.

Complaints and updates

If you are concerned about how I use your information, contact me by email or speak to me directly. I acknowledge privacy complaints within 30 days, investigate appropriately without undue delay, keep you informed and communicate the outcome without undue delay. You can also complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/ or on 0303 123 1113.

I will update this policy when relevant arrangements change and bring material new uses of personal information to your attention. The linked GDPR statement explains my client-record arrangements in more detail.