Last updated: October 2026

Your privacy and confidentiality are central to my practice. As a registered member of the British Association for Counselling and Psychotherapy (BACP), I am committed to working in accordance with its Ethical Framework 2026, the Data Protection Act 2018 and UK GDPR.

This notice explains how I collect, use, store and protect your personal information when you contact me or engage in individual or relationship therapy.

Who Is Responsible for Your Information?

I am responsible for the personal information collected and held within my private therapy practice.

Practitioner: Matthew Deaves
Contact: therapy@matthewdeaves.co.uk

I am registered with the Information Commissioner's Office (ICO), registration number C1351763.

Information I Collect

I may collect your name, contact details, relevant personal and relationship history, appointment information and brief therapy notes.

This may include sensitive information relating to your emotional wellbeing, mental health, relationships or personal circumstances.

I only collect information necessary to provide a safe, ethical and professional therapy service.

How I Use Your Information

Your information is used to respond to enquiries, arrange appointments, provide therapy, maintain appropriate records and meet my professional and legal responsibilities.

I process personal information where necessary to provide an agreed therapy service, comply with legal obligations or address serious safety concerns. Where sensitive information is involved, I process it in accordance with the additional protections required by UK GDPR and the Data Protection Act 2018.

Confidentiality and Supervision

Information shared during therapy is treated confidentially, subject to limited legal, safeguarding and ethical exceptions.

I attend regular clinical supervision to support safe and effective practice. Aspects of our work may be discussed, but I avoid sharing names or unnecessary identifying details. My supervisor is bound by professional confidentiality requirements.

Record Keeping and Security

I maintain brief and appropriate therapy notes, stored securely on a laptop used exclusively by me. Both the laptop and individual documents are password protected.

Records are normally retained for six years following the end of therapy, in accordance with my professional indemnity insurance requirements, unless a different retention period is legally necessary.

Records are securely deleted or destroyed when they are no longer required.

Online Therapy via Zoom

I use Zoom to provide online therapy sessions, sharing only clients' first names when arranging meetings.

Sessions are not recorded or transcribed, and these features are disabled. Zoom may process technical information in accordance with its own privacy policy.

Further information is available in Zoom's Privacy Statement.

Artificial Intelligence (AI)

I may use AI to support administrative tasks, research, professional development and reflective practice.

I do not share identifiable client information with AI tools. AI does not replace my professional judgement, clinical supervision or the therapeutic relationship.

I consider the confidentiality, security and ethical implications of AI and digital technology in accordance with the BACP Ethical Framework 2026.

Sharing Your Information

I do not sell or share your personal information for marketing purposes.

Information may be shared with relevant service providers where necessary to operate my practice, or where there is a lawful and ethically justified reason, including safeguarding or serious safety concerns.

Any disclosure is carefully considered and limited to what is necessary.

Clinical Will

I have appointed a trusted professional colleague who would manage essential practice responsibilities in the event of my incapacity or death.

This colleague is also a BACP member and would ensure that appointments and confidential records are managed appropriately and securely.

Your Data Protection Rights

Under UK GDPR, you have rights relating to your personal information, including requesting access to your records, correcting inaccurate information and, in certain circumstances, requesting deletion or restriction of processing.

You can contact me directly with any questions or concerns about your information. You also have the right to complain to the Information Commissioner's Office at www.ico.org.uk.

Website and Communication Services

When you contact me through my website or by email, your information may be processed by the relevant website hosting or communication providers. I take appropriate steps to protect your personal information and use services with suitable data protection safeguards.

Changes to This Notice

I may update this notice to reflect changes in legislation, professional guidance or my practice. The latest version will be available on this website.