Privacy Notice

hdartpsychotherapy – Art Therapy Service

Last updated: 01.06.26

​

1. About this Privacy Notice

This Privacy Notice explains how personal information is collected, used, and protected when you use this website or engage with my art therapy services.

​

This service is provided by:

Hayley Darbyshire
HCPC-Registered Art Therapist

2. Who is responsible for your data

I am the data controller for the personal information you provide.

This means I am responsible for deciding how your personal data is collected, used, and stored in accordance with UK data protection law (UK GDPR and Data Protection Act 2018).

​

​

3. What information is collected

I may collect and process the following personal information:

• Name of parent/carer and child/young person

• Contact details (email address and phone number)

• Child’s date of birth

• Information provided in referral forms

• Information shared during assessment and therapy sessions

• Relevant health, wellbeing, or background information

• Emergency contact details

​

​

4. How your information is collected

Information may be collected when you:

• Complete a referral form on this website

• Contact me via email or phone

• Book or enquire about sessions

• Engage in assessment or therapy sessions

​

​

5. Why your information is collected

Your information is used to:

• Respond to enquiries and referral requests

• Assess suitability for art therapy support

• Provide safe and appropriate therapeutic care

• Maintain accurate clinical records

• Manage appointments and communication

• Meet professional, legal, and safeguarding responsibilities

​

​

6. Lawful basis for processing

Under UK GDPR, the lawful bases for processing your personal data include:

• Provision of health or social care services

• Legitimate interests in providing a safe and effective therapeutic service

• Legal obligations (including safeguarding and record keeping requirements)

Where special category data (such as health information) is processed, this is done under the conditions for health and social care provision.

​

​

7. How your information is stored

Your personal data is stored securely using:

• All paper records are stored in a locked filing cabinet. 

• Digital files (e.g. notes, emails) are password-protected and stored on secure, encrypted devices. 

• I do not share your data with third parties unless legally required or if there is a serious risk to you or others

​

​

8. How long your information is kept

Client records are stored for:

• 7 years after the end of therapy for adults, and

• For children and young people, 7 years after they reach the age of 18

After this time, records are securely deleted.

​

​

9. Sharing your information

Your information is treated as confidential.

It will only be shared in the following circumstances:

• With your consent

• If there is a safeguarding concern (risk of harm to self or others)

• If required by law or court order

• When necessary for referral or coordination with other professionals (e.g. GP, CAMHS, school services)

Where possible, you will be informed before information is shared.

​

​

​

10. Children and young people

Where the client is under 18, information is usually provided by a parent or legal guardian.

Confidentiality is explained in an age-appropriate way to the child or young person as part of the therapeutic process.

​

​

11. Your rights

Under UK GDPR, you have the following rights:

• The right to access your personal data

• The right to correct inaccurate data

• The right to request deletion of data (where appropriate)

• The right to restrict or object to processing in certain circumstances

To exercise these rights, please contact me using the details below.

​

​

12. Security

Appropriate technical and organisational measures are in place to protect your personal data from loss, misuse, or unauthorised access.

​

​

13. Contact details

If you have any questions about this Privacy Notice or how your data is handled, please contact:

Hayley Darbyshire
Email: hdartpsychotherapist@gmail.com

​

​

14. Complaints

If you are unhappy with how your data has been handled please contact me first, if the issue remains unresolved then you have the right to complain to:

Information Commissioner’s Office (ICO)
Website: https://ico.org.uk

​

​As part of ethical practice, I discuss my work in regular clinical supervision. All identifying details are withheld, and supervisors are bound by the same duty of confidentiality.