​​

Effective from: 19.06.2026

Next review: 18.06.2026

Version: 2.0

 

Introduction

RiverWay Therapies is committed to protecting your privacy and handling your personal information with care, transparency and respect. This Privacy Notice explains how your information is collected, used, stored, shared, retained and disposed of when I provide:

• counselling and therapeutic support

• walk‑and‑talk therapy

• Life Story Work

• Theraplay®‑informed work

• DDP-informed work

• parent consultancy

• training and workshops

• commissioned therapeutic services (including ASGSF work)

This notice is written in clear, accessible language so you can understand how your information is used and what your rights are.

 

Data Controller

Data Controller: Philippa Bolger

ICO Registration: ZB256273

Email: pippa@riverwaytherapies.co.uk

Address: Available on request

As the Data Controller, I am responsible for deciding how and why your personal information is processed.

 

Data Minimisation

I only collect information that is necessary for the safe, ethical and effective delivery of the service you are accessing. I do not collect more information than I need, and I regularly review what I hold to ensure it remains relevant and proportionate.

​

The Information I Collect

The information I collect depends on the service you are accessing.

 

Counselling and Therapy Clients

Information may include:

• Name, date of birth and contact details

• Emergency contact information

• GP details

• Relevant health and wellbeing information

• Assessment information

• Session notes

• Correspondence and communications

• Outcome measures (e.g., TAYC‑R, SDQ, CORS)

• Photos or videos (only with consent)

• Safeguarding information where applicable

• ASGSF‑related information (e.g., early experiences, education, care orders, cultural information)

• Reports required by commissioning Local Authorities

 

Children and Young People

Where I work with children or young people, information may also be collected from:

• parents or carers

• schools

• social workers

• other professionals

This is done only where appropriate, lawful, and in the child’s best interests.

 

Creative materials: Children may keep what they make. If they ask me to store their creations, these are kept in individual files in a locked cabinet.

 

Photos: Photos are only taken with consent and stored securely on my laptop under their case notes. They are deleted from my phone once transferred.

 

Consultancy and Training Clients

Information may include:

• Contact details

• Organisation details

• Project documentation

• Attendance records

• Training evaluations

• Correspondence and contractual information

 

Website Users

The website may collect:

• Information submitted through contact forms

• Email enquiries

• Technical information generated through website usage

• Cookie‑related information (via Wix)

When you contact me through the website, your message is forwarded securely to my business email.

 

Why I Process Personal Information

I process personal information to:

• provide counselling and therapeutic services

• deliver training and workshops

• maintain professional records

• manage appointments

• communicate with clients and organisations

• issue invoices and maintain financial records

• meet legal, ethical and professional obligations

• manage safeguarding concerns

• defend or establish legal claims where necessary

 

Lawful Bases for Processing

The lawful basis I rely on depends on the nature of the information. These may include:

 

Contract

Processing necessary to provide counselling, therapy, supervision, consultancy or training services.

 

Legitimate Interests

Processing necessary for the safe and effective operation of the practice, including:

• maintaining records

• supervision

• professional accountability

• business administration

 

Legal Obligation

Processing necessary to comply with legal and regulatory responsibilities.

 

Vital Interests

Processing necessary to protect someone from serious harm.

 

Special Category Data

Health information and other special category data are processed under:

• the provision of health or social care

• safeguarding

• counselling exemption

• the establishment, exercise or defence of legal claims

 

Consent

Used only for specific purposes, such as:

• video recordings

• photographs

• sharing information with other professionals

• outcome measures required by commissioning bodies

Consent can be withdrawn at any time.

 

Confidentiality and Information Sharing

Information shared in therapy is treated with the utmost confidentiality.

However, information may be disclosed where:

• there is a serious risk of harm to you or someone else

• there are safeguarding concerns involving a child or vulnerable adult

• disclosure is required by law

• disclosure is required by a court order

• disclosure is necessary for the prevention or detection of serious crime

• professional consultation or supervision is required

Only the minimum necessary information will be shared.

 

Professional Supervision

As part of ethical practice, I discuss my work in supervision. Identifying details are minimised wherever possible, and supervision is conducted with qualified professionals who are bound by confidentiality.

 

Access to Your Information

Access to your information is strictly limited to me as the Data Controller.

Where information is stored using secure digital systems (such as Microsoft 365, OneDrive or encrypted storage), access is protected through passwords, device security and access controls.

No one else has routine access to your information. Any access by third‑party processors (e.g., cloud storage providers) is governed by strict contractual and technical safeguards.

 

Third‑Party Service Providers

I use trusted service providers to support the operation of Riverway Therapies. These include:

• Wix – website hosting, cookies, contact form

• Microsoft 365 – email and document storage

• OneDrive – secure cloud storage

• ProtonMail – secure email system for website form forwarding

• WriteUpp – used only for commissioned work through Inspire Me Events Ltd

• Professional indemnity insurers

• Encrypted external hard drive – long‑term storage

 

Processor Accountability

I review all third‑party service providers I use to ensure they meet appropriate security, confidentiality and data protection standards. I keep a record of these providers as part of my accountability obligations.

 

International Transfers

Some service providers (e.g., Wix, Microsoft) may process data outside the UK. Where this occurs, appropriate safeguards such as Standard Contractual Clauses are used to ensure your information receives equivalent protection.

 

Security of Information

I take the security of your information seriously. Measures include:

• password‑protected laptop and phone

• facial recognition security

• antivirus software and firewall

• encrypted external hard drive

• secure cloud storage

• locked filing cabinet for paper records

• secure deletion of digital files

• no long‑term storage of client data on my phone

• no use of messaging apps for client communication

• regular software updates

No method of transmission or storage can be guaranteed completely secure, but every reasonable effort is made to protect your information.

 

Data Protection by Design

I apply data protection by design, meaning I consider privacy, confidentiality and data security at the earliest stage of planning or delivering any service.

 

Retention of Records

My retention schedule is set by my insurer.

• Adults: records are kept for 5 years after therapy ends

• Children: records are kept for 5 years after the young person turns 18

Records may be retained longer where required for legal, regulatory, safeguarding, insurance or professional reasons.

At the end of the retention period, records are securely destroyed or permanently deleted.

 

Your Rights

Under UK data protection law, you may have the right to:

• access your personal information

• request correction of inaccurate information

• request erasure in certain circumstances

• restrict processing in certain circumstances

• object to processing in certain circumstances

• request transfer of information where applicable

• withdraw consent where consent is relied upon

Not all rights apply in all circumstances.

Requests should be made to: pippa@riverwaytherapies.co.uk

 

Subject Access Requests

You may request a copy of the personal information held about you. Requests will normally be responded to within one calendar month. Identity verification may be required.

 

Data Protection Complaints

If you have concerns about how your information has been handled, please contact me in the first instance. I will investigate and respond within 30 days.

If you remain dissatisfied, you may contact the Information Commissioner’s Office (ICO): ico.org.uk

 

Clinical Wills

In the event of my unexpected death or sudden illness, I have appointed two Therapeutic Executors. They will:

• access only the minimum necessary information

• contact you to explain the situation

• follow my retention schedule

• adhere to the same confidentiality and ethical standards

For ASGSF work, your social worker will be informed first.

​

Changes to This Privacy Notice

This Privacy Notice may be reviewed and updated periodically to reflect changes in:

• legal requirements

• professional guidance

• services provided

• operational practices

The most current version will always be available on request and, where applicable, on the website.

19.06.2026