Privacy Notice

1 Data Controller

WitheyLindley Ltd is the Data Controller for the purposes of UK GDPR and the Data Protection Act 2018. Therapeutic coaching services are delivered by Heather Lindley, Director of the company.

The company is registered with the Information Commissioner's Office (ICO).

2 Lawful Basis for Processing

Personal data is processed under:

• Article 6(1)(b) – Contract (to provide therapeutic coaching services)
• Article 6(1)(f) – Legitimate Interests (practice management and administration)
• Article 9(2)(h) – Provision of health or social care (special category data)

Therapeutic coaching involves processing health-related and sensitive personal information, which is classified as special category data.

3 What Information Is Collected

This may include:

• Name, address, date of birth and contact details
• Parent/carer details (for clients under 18)
• Emergency contact details
• GP details (where appropriate)
• Background and assessment information
• Session notes
• Appointment correspondence
• Safeguarding documentation (where necessary)

Only information that is relevant and proportionate to providing therapeutic coaching is collected.

4 How Information Is Stored

Records may be held electronically and/or in paper format.

• Electronic records are password-protected and stored securely
• Paper records are kept in locked storage
• Access is restricted to the practitioner

Where third-party platforms are used (e.g. email providers, video conferencing platforms, practice management systems), these act as GDPR-compliant data processors. Reasonable technical and organisational measures are in place to safeguard personal data.

5 Confidentiality and Data Sharing

Information is treated as confidential and will not be shared without consent unless:

• There is a risk of serious harm to the client or others
• There are safeguarding concerns involving a child or vulnerable person
• There is a legal obligation or court order requiring disclosure

Anonymised information may be discussed in clinical supervision in accordance with professional requirements.

6 Clients Under 16

For clients under 16:

• Parental consent is required before therapeutic coaching begins
• Both the young person and parent/carer will receive information about confidentiality and its limits
• The young person's privacy will be respected in line with their level of understanding and best interests
• Information will only be shared with parents/carers as agreed, unless safeguarding concerns arise

7 Clients Aged 16–17

Where a client aged 16 or 17 is assessed as having capacity:

• The young person is considered the data subject
• Parents/carers do not have automatic access to records
• Any request for access will be considered in line with confidentiality, capacity, and best interests

8 Retention of Records

Records are retained for the following periods:

• Adults: 6 years after the therapeutic coaching relationship ends
• Under 18s: until the client reaches age 25 (or longer if required by professional indemnity insurer guidance)

Records are securely destroyed after the retention period.

9 Your Rights

Under UK GDPR, you have the right to:

• Request access to your personal data
• Request correction of inaccurate data
• Request restriction of processing in certain circumstances
• Lodge a complaint with the Information Commissioner's Office (ICO)

10 Data Breach Procedure

In the unlikely event of a data breach that poses a risk to your rights and freedoms, appropriate action will be taken in line with ICO guidance, including notification where required.

11 Website Data

When you submit an enquiry via the contact form on this website, your name and email address are collected solely for the purpose of responding to your enquiry. This data is not shared with third parties and is not used for marketing purposes.