Privacy Notice

Last updated: 7 June 2026

This privacy notice explains how Therapy with Rick collects, uses, stores, and protects personal information.

Therapy involves trust. That includes how personal information is handled. I aim to keep data use clear, limited, relevant, and secure.

Therapy with Rick is the trading name of Rick Cox, MBACP (Accred), a UK-based online psychodynamic psychotherapist.

For the purposes of UK data protection law, I am the data controller for the personal information I collect and use in my private practice.

You can contact me through the contact page on this website.

What information do I collect?

I may collect and use different types of personal information depending on how you contact me and whether we work together.

This may include:

  • Your name; email address and phone number

  • Information you provide through the contact form such as information about why you are seeking therapy

  • Appointment times and attendance records

  • Brief therapy notes

  • Payment and invoice information;

  • Correspondence between us;

  • Information needed for safeguarding, risk management, or professional responsibilities;

  • Technical information about how the website is used.

Because this is a therapy practice, some of the information you share may include special category data. This may include information about your mental health, emotional wellbeing, relationships, family history, trauma, sexuality, identity, physical health, medication, risk, or other sensitive personal matters.

I only collect information that is relevant to the enquiry, therapy work, administration of the practice, legal obligations, or professional responsibilities.

How I collect information

I may collect information when you:

  • Visit this website

  • Complete the contact form

  • Email me

  • Arrange an introductory call

  • Book or attend therapy sessions

  • Make a payment, if the payment is made through Squarespace payments

  • Communicate with me before, during, or after therapy

The website may also collect limited technical information through cookies, analytics, hosting tools, and security features. More detail is available on the Cookie Policy page.

Why I use your Information

I use personal information to:

  • Respond to enquiries

  • Assess whether I may be able to offer therapy

  • Arrange appointments

  • Provide online therapy

  • Keep brief clinical and administrative records

  • Manage payments, invoices, and accounts

  • Communicate about appointments or the service you have requested

  • Meet professional, ethical, legal, tax, and safeguarding obligations

  • Maintain the security and functioning of the website

  • Understand basic website use and improve the service

I do not sell your personal information and I do not share your personal information for third-party marketing.

Lawful bases for using personal information

Under UK data protection law, I need a lawful basis for using personal information. Depending on the situation, I may rely on one or more of the following lawful bases:

Contract

To respond to your enquiry, arrange sessions, provide therapy, manage appointments, and administer the therapy service.

Legitimate interests

To run a small private therapy practice, respond to enquiries, manage records, maintain the website, and communicate about services you have requested. I only rely on this where my interests do not override your rights and freedoms.

Legal obligation

To meet legal, tax, accounting, safeguarding, regulatory, or professional duties.

Consent

Where consent is required, for example for some non-essential cookies, optional communications, or specific circumstances where I ask for clear permission. Consent can be withdrawn where consent is the lawful basis being used.

Special category data

Therapy may involve sensitive personal information. Under UK GDPR, this is called special category data. Where I process special category data, I also need a separate condition under Article 9 of UK GDPR.

The relevant condition will usually be that processing is necessary for the provision of health or social care, or for the management of health or social care systems and services. In some situations, other conditions may apply, such as explicit consent, legal claims, safeguarding, or substantial public interest.

I handle this information carefully and only use it where necessary for therapy, administration, safeguarding, professional responsibilities, or legal obligations.

Therapy notes and records

I keep brief therapy notes and relevant administrative records. These records are used to support the therapy work, keep continuity between sessions, manage risk where relevant, and meet professional responsibilities. Therapy notes are not a verbatim record of everything discussed. They are brief working records. I aim to keep records factual, relevant, proportionate, and secure.

How long I keep information

I do not keep personal information for longer than necessary.

As a general guide:

  • Enquiry information may be kept for a limited period if we do not go on to work together

  • Therapy records are usually kept for a number of years after therapy ends, in line with professional, insurance, legal, and ethical requirements

  • Financial records are kept for the period required for tax and accounting purposes

  • Emails and administrative correspondence may be retained where relevant to the therapy service, legal obligations, or professional responsibilities.

Retention periods may vary depending on the circumstances. For example, records may need to be kept for longer where there are safeguarding concerns, legal issues, complaints, disputes, or professional obligations.

Confidentiality and when information may be shared

Therapy is confidential, but confidentiality is not absolute.

I may need to share information in limited circumstances, including:

  • If there is a serious risk of harm to you or someone else

  • Where safeguarding concerns arise

  • Where required by law, court order, or legal obligation

  • Where necessary for professional consultation, supervision, insurance, or legal advice

  • Where needed to manage a complaint or professional concern

  • Where disclosure is necessary to protect vital interests

Where possible and appropriate, I would aim to discuss this with you before sharing information.

Professional supervision is a standard part of ethical therapy practice. Client material discussed in supervision is handled confidentially and is shared only as needed for professional reflection, safety, and good practice.

Service providers and processors

I use a small number of trusted service providers to run the practice.

These may include:

  • Website hosting and website forms;

  • Email services;

  • Online therapy video software;

  • Payment and banking services;

  • Accounting or bookkeeping services;

  • Calendar or scheduling tools;

  • Google Analytics for basic website analytics;

  • Professional, legal, insurance, or supervisory services where necessary.

These providers only process information where needed to provide their service or meet legal/professional requirements. Where relevant, I aim to use services that provide appropriate safeguards for personal information.

Online therapy

Online therapy sessions are usually provided through a secure video platform. You are responsible for choosing a private space for your session where you cannot be overheard, unless we have discussed and agreed otherwise.

I do not record therapy sessions. If recording were ever considered, this would only happen with clear discussion and explicit agreement.

Payments and financial records

If you make payments for therapy, I may process information needed to manage payment, invoicing, bookkeeping, tax, and accounting records. Payment providers and banks may process information according to their own privacy policies. I do not store full card details myself.

Website use, cookies, and analytics

This website may use cookies and similar technologies.

Some cookies are necessary for the website to work properly. Others, such as analytics cookies, should only be used where consent is required and has been given.

This website uses Google Analytics through a Google tag to understand basic website use, such as page views, traffic sources, device information, and how visitors move around the site. This helps me understand what is being read and whether the website is working clearly.

Google Analytics may collect limited technical information such as IP address, browser, device, approximate location, pages visited, and time spent on the site. I use this information in an aggregated way and do not use it to identify individual visitors.

Analytics cookies should only be used where you have consented to them through the cookie banner or settings available on the site.

More information is available on the Cookie Policy page.

You can also manage cookies through your browser settings.

Email communication

I use email to respond to enquiries, arrange appointments, send practical information about therapy, and manage the service you have requested. Email is widely used but is not a completely risk-free form of communication. Please consider this when deciding what to include in an email.

I do not currently send a regular marketing newsletter. If I introduce one in future, I will only send it where I have a lawful basis to do so and will provide a clear way to unsubscribe.

Your rights

Under UK data protection law, you have rights over your personal information.

These may include the right to:

  • Ask for access to personal information I hold about you

  • Ask for inaccurate information to be corrected

  • Ask for information to be erased in some circumstances

  • Ask for processing to be restricted in some circumstances

  • Object to processing in some circumstances

  • Ask for a copy of your information in a portable format in some circumstances

  • Withdraw consent where consent is the lawful basis being used

  • Complain about how your information has been handled

These rights are not absolute. Some rights may not apply in every situation, especially where legal, safeguarding, professional, clinical, or third-party considerations apply.

Subject access request

You can ask for a copy of personal information I hold about you.

I may need to confirm your identity before responding and I will respond in line with UK data protection law. In most cases, this means responding within one month.

In some circumstances, information may be withheld where an exemption applies. This may include information involving another person, information connected to legal or professional duties, or information where disclosure could create a serious risk of harm.

Searches for information will be reasonable and proportionate.

Data protection complaints

If you have a concern about how I collect, use, store, or share your personal information, please contact me through the contact page.

I will acknowledge data protection complaints within 30 days of receiving them and I will take appropriate steps to review the concern, keep you informed where needed, and respond without undue delay.

If you are not satisfied with my response, you have the right to raise a concern with the Information Commissioner’s Office.

The ICO website is: ico.org.uk

Security

I take reasonable steps to protect personal information from unauthorised access, loss, misuse, alteration, or disclosure. This includes using appropriate digital systems, passwords, access controls, professional boundaries, and secure working practices. No system can be guaranteed as completely secure, but I aim to keep risk as low as reasonably possible.

International transfers

Some service providers, including website and analytics providers, may process limited technical or administrative data outside the UK. Where this happens, I aim to use providers that apply appropriate safeguards for international data transfers. Sensitive therapy records are not knowingly published or made publicly accessible through this website.

Links to other websites

This website may contain links to other websites. I am not responsible for the privacy practices, content, or security of external websites. You should read the privacy notices of any external sites you choose to visit.

Changes to this notice

This privacy notice may be updated from time to time to reflect changes in the law, professional guidance, website systems, or how the practice operates.

The latest version will be published on this page.

FAQ: Privacy

  • I collect information you share via the contact form, such as your name, email address, phone number, and message details. If we work together, I also keep brief therapy records stored separately and securely from the website.

  • Your information is used to respond to enquiries, arrange and provide therapy, manage administration, and maintain appropriate professional records in line with UK data protection law and professional requirements.

  • Your information is never sold or shared for third-party marketing. Information is only shared in limited circumstances, such as where required by law, for safeguarding, professional consultation, legal/insurance advice, or where there is a serious risk of harm.

  • You have rights under UK data protection law, including the right to ask for access to your data, correction of inaccurate information, deletion in some circumstances, restriction or objection in some circumstances, and to raise a concern about how your data has been handled.

  • Therapy records are stored securely and separately from the website. Emails and online forms are handled through secure systems, though no system can be guaranteed 100% secure.

Complete FAQ