Sam Talk Therapy

Privacy Policy

Sam Talk Therapy Privacy Notice Version: August 2026

1. Who I am I am Dr Samantha Otero, trading as Sam Talk Therapy and Counselling & Psychotherapy Ltd (company number 16678274). I am the Data Controller for your personal data. ICO registration number: ZC116009. Contact: drsamtalktherapy@gmail.com | +44 73 9692 3312.

I practise in accordance with the BACP Ethical Framework for the Counselling Professions and the ACC (Association of Christians in Counselling and Linked Professions) Ethics and Practice, including their requirements on confidentiality, records, and continuity of care.

2. What personal data I collect I may collect and process:

  • Identity and contact details (name, date of birth, address, email, telephone).
  • Emergency contact details (if you choose to provide them).
  • GP and other professional details (where relevant).
  • Special category (sensitive) data: information about your mental or physical health, therapy history, medication, neurodivergence, experiences of self-harm or suicide, relationships, sexuality, faith or spirituality, and anything else you share that is relevant to the work.
  • Administrative data: appointment records, payment records, correspondence.
  • Session notes (concise, professional, and limited to what is necessary).

I only collect what is reasonably necessary for providing therapy, administering the practice, meeting legal and professional obligations, and protecting safety where required.

3. Why I process your data and the lawful bases I process your data to:

  • Provide counselling and psychotherapy.
  • Arrange and manage appointments and payments.
  • Keep professional records for continuity, safeguarding, and accountability.
  • Meet legal obligations (including tax and professional requirements).
  • Protect your or another person’s vital interests if there is a serious risk of harm.
  • Handle complaints or disputes.

Lawful bases (UK GDPR Article 6)

  • Contract (necessary to provide the therapy you have agreed to).
  • Legitimate interests (running a safe and effective practice, professional accountability, and defending legal claims).
  • Legal obligation (e.g. financial records).
  • Vital interests (serious risk of harm).

Special category data (Article 9) Processing of health and related sensitive data is necessary for the provision of health or social care (counselling) or is based on substantial public interest conditions relevant to confidential counselling, with appropriate safeguards.

I do not rely on consent as the primary lawful basis for the core processing of therapy data.

4. How I collect data Mainly from you (forms, sessions, email, WhatsApp for logistics only). Occasionally from a third party (e.g. GP) only with your explicit consent or where required by law/safeguarding.

5. Who I share data with I do not sell or routinely share your data. Sharing is limited to:

  • My clinical supervisor (anonymised or with identity protected as far as possible).
  • The trusted professional person named in my clinical will (only if I become seriously ill, incapacitated or die, and only to the extent necessary to contact you, support continuity, or manage records).
  • Platforms that act as data processors: Zoom (primary video), Microsoft Teams (occasional fallback), Gmail, Google Drive, and WhatsApp (logistics only). These providers process data under their own terms and Data Processing Agreements / Standard Contractual Clauses where applicable.
  • Professional or legal bodies if required by law, court order, or safeguarding.
  • An accountant (where one is appointed) and under a Data Processing Agreement.

6. International transfers Some service providers (including Google for Gmail and Google Drive, Zoom, Microsoft, and WhatsApp/Meta) may process data outside the UK. Where this occurs I rely on the safeguards required by UK data protection law (including Standard Contractual Clauses and, where applicable, the UK Extension to the Data Privacy Framework). I take reasonable steps to understand and mitigate the associated risks. Fuller details of each provider’s arrangements are available on request or via their privacy notices.

7. How long I keep your data Clinical records and contact details are normally retained for up to 6 years after our last session and then securely destroyed or deleted, unless a longer or shorter period is required or justified by law, professional requirements, or the circumstances of the case. Financial records are retained as required by HMRC (normally 6 years). In the event of my death or permanent incapacity, the clinical will arrangements provide for appropriate management and eventual secure destruction of records in line with professional and legal requirements.

8. Security I use password protection, encryption where available, secure storage, and access controls. Paper records (if any) are kept in a locked cabinet. Electronic records are stored on password-protected devices and in Google Drive. I take reasonable technical and organisational measures appropriate to the sensitivity of the data.

9. Your rights Under UK data protection law you have the right to:

  • Be informed (this Notice).
  • Access your personal data.
  • Rectification of inaccurate data.
  • Erasure (subject to legal and professional retention requirements).
  • Restriction of processing.
  • Data portability (where applicable).
  • Object to processing based on legitimate interests.
  • Not be subject to automated decision-making (I do not use it).

You also have the right under the Data (Use and Access) Act 2025 to make a data protection complaint directly to me. I will acknowledge such a complaint within the period required by law and respond without undue delay. If you remain dissatisfied you may contact the Information Commissioner’s Office (ICO) at www.ico.org.uk or 0303 123 1113.

To exercise any right, please contact me using the details above. I will respond in accordance with the law.

10. Clinical will and continuity I maintain a clinical will and have appointed a trusted professional person who can contact clients and manage necessary arrangements if I become unable to practise because of serious illness, incapacity or death. That person is bound by confidentiality and will only access or disclose what is reasonably necessary. Client records will continue to be handled with appropriate confidentiality and data protection safeguards and will ultimately be securely destroyed in accordance with professional requirements. My personal family or estate will not have a right to read your therapy records.

11. Updates I may update this Notice from time to time. This is the current version. Significant changes will be drawn to your attention where appropriate.

12. Contact If you have any questions about this Notice or how your data is handled, please contact me at drsamtalktherapy@gmail.com.

This Privacy Notice should be read alongside the Working Agreement.