Privacy Notice
Last updated: 29 August 2026
This privacy notice explains how Therapy with Rick collects, uses, stores, and protects personal information.
Therapy involves trust. That includes how personal information is handled. I aim to keep data use clear, limited, relevant, and secure.
Therapy with Rick is the trading name of Rick Cox, MBACP (Accred), a UK-based online psychodynamic psychotherapist.
For the purposes of UK data protection law, I am the data controller for the personal information I collect and use in my private practice.
You can contact me through the contact page on this website.
What information do I collect?
I may collect and use different types of personal information depending on how you contact me and whether we work together.
This may include:
Your name; email address and phone number
Information you provide through the contact form such as information about why you are seeking therapy
Appointment times and attendance records
Brief therapy notes
Video and audio content from selected therapy sessions, only where recording has been separately discussed and explicitly agreed in writing.
Payment and invoice information;
Correspondence between us;
Information needed for safeguarding, risk management, or professional responsibilities;
Technical information about how the website is used.
Because this is a therapy practice, some of the information you share may include special category data. This may include information about your mental health, emotional wellbeing, relationships, family history, trauma, sexuality, identity, physical health, medication, risk, or other sensitive personal matters.
I only collect information that is relevant to the enquiry, therapy work, administration of the practice, legal obligations, or professional responsibilities.
How I collect information
I may collect information when you:
Visit this website
Complete the contact form
Email me
Arrange an introductory call
Book or attend therapy sessions
Make a payment
Communicate with me before, during, or after therapy
The website may also collect limited technical information through cookies, analytics, hosting tools, and security features. More detail is available on the Cookie Policy page.
Why I use your Information
I use personal information to:
Respond to enquiries
Assess whether I may be able to offer therapy
Arrange appointments
Provide online therapy
Keep brief clinical and administrative records
Review my clinical work and use selected recordings in confidential clinical supervision or ISTDP training supervision, where this has been separately discussed and explicitly agreed.
Manage payments, invoices, and accounts
Communicate about appointments or the service you have requested
Meet professional, ethical, legal, tax, and safeguarding obligations
Maintain the security and functioning of the website
Understand basic website use and improve the service
I do not sell your personal information and I do not share your personal information for third-party marketing.
Lawful bases for using personal information
Under UK data protection law, I need a lawful basis for using personal information. Depending on the situation, I may rely on one or more of the following lawful bases:
Contract
To respond to your enquiry, arrange sessions, provide therapy, manage appointments, and administer the therapy service.
Legitimate interests
To run a small private therapy practice, respond to enquiries, manage records, maintain the website, and communicate about services you have requested. I only rely on this where my interests do not override your rights and freedoms.
Legal obligation
To meet legal, tax, accounting, safeguarding, regulatory, or professional duties.
Consent
Where consent is required, for example for some non-essential cookies, optional communications, or specific circumstances where I ask for clear permission. Consent can be withdrawn where consent is the lawful basis being used.
Special category data
Therapy may involve sensitive personal information. Under UK GDPR, this is called special category data. Where I process special category data, I also need a separate condition under Article 9 of UK GDPR.
The relevant condition will usually be that processing is necessary for the provision of health or social care, or for the management of health or social care systems and services. In some situations, other conditions may apply, such as explicit consent, legal claims, safeguarding, or substantial public interest.
I handle this information carefully and only use it where necessary for therapy, administration, safeguarding, professional responsibilities, or legal obligations.
Therapy notes and records
I keep brief therapy notes and relevant administrative records. These records are used to support the therapy work, keep continuity between sessions, manage risk where relevant, and meet professional responsibilities. Therapy notes are not a verbatim record of everything discussed. They are brief working records. I aim to keep records factual, relevant, proportionate, and secure.
I keep personal information only for as long as it is needed for the purpose for which it was collected. My standard retention periods are:
Enquiries that do not lead to therapy or another ongoing professional relationship, including related emails, are retained for no longer than 12 months after the last meaningful contact. They will be deleted earlier when there is no continuing reason to retain them.
Enquiries that do not lead to therapy or another ongoing professional relationship, including related emails, are normally deleted 12 months after the last meaningful contact.
Clinical and administrative records for clients, including therapy notes, agreements, consent records and clinically relevant correspondence, are normally retained for seven years after therapy ends.
Routine appointment correspondence that does not form part of the clinical record is normally deleted 12 months after therapy ends.
Financial and tax records are retained for at least five years after the relevant 31 January tax-return deadline, or longer where required by HMRC.
Therapy-session recordings are deleted no later than 12 months after they were last used for supervision or training. They are deleted earlier when no longer needed.
Records may be retained for longer where this is necessary because of an active complaint, legal claim, safeguarding concern, tax enquiry or other professional or legal requirement.
When a retention period ends, information is securely deleted or, where appropriate, irreversibly anonymised. Retention periods are reviewed periodically.
How long I keep information
Confidentiality and when information may be shared
Therapy is confidential, but confidentiality is not absolute.
I may need to share information in limited circumstances, including:
If there is a serious risk of harm to you or someone else
Where safeguarding concerns arise
Where required by law, court order, or legal obligation
Where necessary for professional consultation, supervision, insurance, or legal advice
Where needed to manage a complaint or professional concern
Where disclosure is necessary to protect vital interests
Where possible and appropriate, I would aim to discuss this with you before sharing information.
Professional supervision is a standard part of ethical therapy practice. Client material discussed in supervision is handled confidentially and is shared only as needed for professional reflection, safety, and good practice.
Service providers and processors
I use a limited number of service providers to operate this website and private practice:
Squarespace hosts the website, processes contact-form submissions and temporarily stores submissions within Squarespace Contacts.
Proton Mail provides my professional email service and receives website enquiries.
doxy.me provides the video platform used for online therapy sessions.
Google Analytics provides website-use statistics where analytics has been enabled through the website’s cookie choices.
Google reCAPTCHA protects website forms from automated spam and abuse. It may process limited information about a visitor’s browser, device, network and interaction with the website.
Banking and payment providers process information needed to receive and account for therapy payments.
These providers receive only the information needed to supply their services. Depending on the service and circumstances, they may act as data processors or as independent data controllers under their own legal terms.
I do not sell personal information or provide it to third parties for advertising or marketing.
Online therapy
Online therapy sessions are usually provided through Doxy.me. You are responsible for choosing a private space for your session where you cannot be overheard, unless we have discussed and agreed otherwise.
Selected therapy sessions may occasionally be video recorded for my own clinical review, ISTDP supervision, or ISTDP Core Training supervision. Recording will only take place after a separate discussion and with your explicit written consent.
Recording is entirely optional. You can decline without this affecting your therapy, your relationship with me, or your access to future sessions. You may also withdraw your consent later.
A recording may contain your image, voice, and the content of the session. Recordings are treated as confidential clinical material and are kept separately from routine therapy notes. Access is restricted to the people and purposes described in the Video Recording for Supervision and Training notice and the accompanying consent form.
I do not record any therapy session without prior written consent.
Video recordings for supervision and training
Where a client gives explicit written consent, selected therapy sessions may be video recorded for clinical review, supervision, and ISTDP Core Training supervision.
Recordings are stored securely, access is restricted, and recordings are deleted no later than 12 months after the date they are last used in ISTDP supervision or training supervision.
Video recording is optional. Declining or withdrawing consent does not affect access to therapy.
Payments and financial records
If you make payments for therapy, I may process information needed to manage payment, invoicing, bookkeeping, tax, and accounting records. Payment providers and banks may process information according to their own privacy policies. I do not store full card details myself.
Website use, cookies, and analytics
This website may use cookies and similar technologies.
Some cookies are necessary for the website to work properly. Others, such as analytics cookies, should only be used where consent is required and has been given.
This website uses Google Analytics through a Google tag to understand basic website use, such as page views, traffic sources, device information, and how visitors move around the site. This helps me understand what is being read and whether the website is working clearly.
Google Analytics may collect limited technical information such as IP address, browser, device, approximate location, pages visited, and time spent on the site. I use this information in an aggregated way and do not use it to identify individual visitors.
Analytics cookies should only be used where you have consented to them through the cookie banner or settings available on the site.
More information is available on the Cookie Policy page.
You can also manage cookies through your browser settings.
Email communication
I use email to respond to enquiries, arrange appointments, send practical information about therapy, and manage the service you have requested. Email is widely used but is not a completely risk-free form of communication. Please consider this when deciding what to include in an email.
I do not currently send a regular marketing newsletter. If I introduce one in future, I will only send it where I have a lawful basis to do so and will provide a clear way to unsubscribe.
Your rights
Under UK data protection law, you have rights over your personal information.
These may include the right to:
Ask for access to personal information I hold about you
Ask for inaccurate information to be corrected
Ask for information to be erased in some circumstances
Ask for processing to be restricted in some circumstances
Object to processing in some circumstances
Ask for a copy of your information in a portable format in some circumstances
Withdraw consent where consent is the lawful basis being used
Complain about how your information has been handled
These rights are not absolute. Some rights may not apply in every situation, especially where legal, safeguarding, professional, clinical, or third-party considerations apply.
Subject access request
You can ask for a copy of personal information I hold about you.
I may need to confirm your identity before responding and I will respond in line with UK data protection law. In most cases, this means responding within one month.
In some circumstances, information may be withheld where an exemption applies. This may include information involving another person, information connected to legal or professional duties, or information where disclosure could create a serious risk of harm.
Searches for information will be reasonable and proportionate.
Data protection complaints
If you have a concern about how I collect, use, store, or share your personal information, please contact me through the contact page.
I will acknowledge data protection complaints within 30 days of receiving them and I will take appropriate steps to review the concern, keep you informed where needed, and respond without undue delay.
If you are not satisfied with my response, you have the right to raise a concern with the Information Commissioner’s Office.
The ICO website is: ico.org.uk
Security
I take reasonable steps to protect personal information from unauthorised access, loss, misuse, alteration, or disclosure. This includes using appropriate digital systems, passwords, access controls, professional boundaries, and secure working practices. No system can be guaranteed as completely secure, but I aim to keep risk as low as reasonably possible.
International transfers
Some service providers, including website and analytics providers, may process limited technical or administrative data outside the UK. Where this happens, I aim to use providers that apply appropriate safeguards for international data transfers. Sensitive therapy records are not knowingly published or made publicly accessible through this website.
Links to other websites
This website may contain links to other websites. I am not responsible for the privacy practices, content, or security of external websites. You should read the privacy notices of any external sites you choose to visit.
Changes to this notice
This privacy notice may be updated from time to time to reflect changes in the law, professional guidance, website systems, or how the practice operates.
The latest version will be published on this page.
FAQ: Privacy
-
I collect information you share via the contact form, such as your name, email address, phone number, and message details. If we work together, I also keep brief therapy records stored separately and securely from the website.
-
Your information is used to respond to enquiries, arrange and provide therapy, manage administration, and maintain appropriate professional records in line with UK data protection law and professional requirements.
-
Your information is never sold or shared for third-party marketing. Information is only shared in limited circumstances, such as where required by law, for safeguarding, professional consultation, legal/insurance advice, or where there is a serious risk of harm.
-
You have rights under UK data protection law, including the right to ask for access to your data, correction of inaccurate information, deletion in some circumstances, restriction or objection in some circumstances, and to raise a concern about how your data has been handled.
-
Therapy records are stored securely and separately from the website. Emails and online forms are handled through secure systems, though no system can be guaranteed 100% secure.