Corrina Beasley Therapy Privacy Notice
Last updated: 17 August 2026
This privacy notice explains how I collect, use, store and protect personal information when you visit my website, contact me, receive therapy or another service from me, attend a workshop or programme, or subscribe to my marketing communications.
1. Who I am
I am Corrina Beasley, trading as Corrina Beasley Therapy. I am the data controller responsible for deciding how and why your personal information is used.
Email: hello@corrinabeasleytherapy.co.uk
If you have any questions about this notice or how I use your information, please contact me using the email address above.
2. The information I may collect
The information I collect depends on how you interact with me and which services you use. It may include:
Your name, email address, telephone number and communication preferences.
Appointment, booking, attendance and transaction information.
Information you provide in enquiries, emails, telephone calls or forms.
Information relevant to therapy, including the difficulties you are experiencing, your needs, goals, relevant history and progress.
Relevant health, wellbeing, safeguarding or risk information.
Handwritten and electronic therapy notes.
Information provided by a parent or carer about a child, including the child’s first name, age and needs relevant to the service.
For workshops and children’s programmes, relevant communication, sensory, accessibility, participation, developmental, allergy and safety information.
Records of consent, including marketing and special-category-data consent where applicable.
Billing information and payment records. I do not normally receive or retain your complete payment-card details.
Newsletter subscriptions and marketing preferences.
Technical and website information, such as your IP address, browser, device, referring pages and use of my website.
I aim to collect only information that is adequate, relevant and necessary for the particular purpose.
3. Where I obtain information
I usually receive information directly from you.
Where a service relates to a child, information may be provided by a parent, carer or another person with appropriate authority. In limited circumstances, and with an appropriate basis, I may also receive relevant information from another professional or service involved in supporting you or your child.
4. How and why I use personal information
I may use personal information to:
Respond to enquiries and assess whether I may be able to help.
Arrange, administer and provide therapy, workshops and other services.
Tailor therapy or support to an individual’s needs and goals.
Assess whether a group programme is likely to be appropriate for a child or family.
Make reasonable preparations for communication, sensory, accessibility, allergy or participation needs.
Manage appointments, bookings, payments, refunds and event communications.
Maintain appropriate clinical, safeguarding, insurance, accounting and business records.
Seek confidential professional supervision.
Communicate with other professionals where you have asked me to do so or where there is another lawful and appropriate reason.
Protect the vital interests, safety or wellbeing of you or another person.
Comply with legal, regulatory, insurance and professional obligations.
Establish, exercise or defend legal claims.
Send newsletters or other marketing where you have chosen to receive them.
Operate, protect and improve my website and services.
I do not use information about your health, therapy, child or workshop participation for marketing.
5. My lawful bases for using information
UK data-protection law requires me to identify a lawful basis for each way I use personal information. Depending on the purpose, I may rely on:
Contract: where using the information is necessary to take steps at your request before providing a service, or to provide and administer a service you have booked.
Legitimate interests: where necessary for the proportionate administration, security and development of my practice, provided those interests are not overridden by your rights and interests.
Legal obligation: where I must retain, use or disclose information to comply with the law.
Vital interests: in rare circumstances where using or disclosing information is necessary to protect someone’s life and they are unable to give consent.
Consent: for activities such as optional marketing, or where consent is otherwise the appropriate lawful basis. You may withdraw consent at any time, although this will not affect processing that has already taken place lawfully.
6. Health and other special-category information
Some information I process may be classed as special-category data under the UK GDPR. This may include information about physical or mental health, neurodiversity, disability, allergies or other needs that reveal health information.
In addition to an Article 6 lawful basis, I must have a separate Article 9 condition for processing this information. Depending on the circumstances, I may rely on:
Your explicit consent, where this is the appropriate condition.
Processing necessary to protect someone’s vital interests where the person is physically or legally incapable of giving consent.
Processing necessary for the establishment, exercise or defence of legal claims.
Another condition permitted by data-protection law where applicable and properly documented.
Where I rely on explicit consent, I will ask for a clear affirmative indication and keep a record of it. You may withdraw that consent, but withdrawal may affect my ability to provide a service where the information is genuinely necessary to deliver it safely or appropriately.
7. Children’s information and Big Reactions
For Big Reactions and other child-focused services, a parent or carer may provide information about their child. This may include the child’s first name, age, communication preferences, sensory or participation needs, relevant health or developmental information, allergies and information needed to assess whether a small-group environment is likely to be appropriate.
I use this information only to:
Understand the child’s relevant needs.
Assess whether the programme is likely to be a suitable setting.
Make reasonable preparations for their comfort, access and participation.
Communicate privately with the parent or carer where clarification is required.
Help deliver the programme safely and appropriately.
This form is not a diagnostic or general clinical assessment. I ask parents and carers to provide only information relevant to participation. The information is not used for advertising, profiling or automated decision-making.
The parent or carer completing the form must confirm that they have parental responsibility, or appropriate authority from a person with parental responsibility, to provide the information.
Where appropriate, I will also explain to the child in clear, age-appropriate language what information I know about them and why.
8. Therapy records, confidentiality and supervision
Information shared during therapy is treated confidentially. Electronic records are stored using appropriately secured systems and handwritten notes are kept in locked physical storage.
As is common in therapeutic practice, I may discuss cases during professional supervision to support safe and effective practice. I do not disclose names or unnecessary identifying details during supervision.
Confidentiality is not absolute. There may be circumstances in which I am legally, professionally or ethically required or permitted to share relevant information, including:
Where there is a serious concern about the safety of the client or another person.
Where there is a safeguarding concern relating to a child or vulnerable adult.
Where disclosure is required by law or ordered by a court.
Where necessary to prevent or detect a serious crime.
Where necessary to establish, exercise or defend a legal claim.
Where it is safe and appropriate to do so, I will normally try to discuss a proposed disclosure with you first. I will share only information that is relevant and necessary in the circumstances.
There may also be occasions when I advise or require a client to consult their GP or another qualified healthcare professional before therapy begins or continues—for example, where symptoms may require medical assessment or treatment.
More detailed expectations concerning confidentiality, safeguarding, contact and the therapeutic relationship may be set out in the relevant therapy agreement or service terms.
9. Booking, payment and service providers
I use trusted service providers to operate my practice. They may process personal information on my behalf only to the extent needed to provide their services. Depending on how you interact with me, these may include:
Squarespace, which hosts my website and may provide website, account, scheduling, checkout, analytics and email functionality.
Eventbrite, which processes bookings, ticket payments and event communications for programmes such as Big Reactions.
Microsoft Forms and Microsoft 365, where used to collect and securely store Getting to Know Your Child forms and related records.
Stripe, which processes certain payments.
Funnel Sketchers and any email-marketing platform they operate on my behalf, which manage my newsletter and consent-based marketing.
Email, cloud-storage, IT-security and backup providers.
Accountants, insurers, legal advisers, professional supervisors and other professional advisers where necessary.
These providers may collect information directly under their own privacy notices as well as processing information on my behalf. You can find further information at:
Squarespace: https://www.squarespace.com/privacy
Eventbrite: https://www.eventbrite.co.uk/help/en-gb/articles/460838/eventbrite-privacy-policy/
Microsoft: https://privacy.microsoft.com/en-gb/privacystatement
Stripe: https://stripe.com/gb/privacy
Funnel Sketchers: https://funnelsketchers.com/privacy-policy/
I do not sell personal information.
10. Sharing information
I may share relevant personal information:
With service providers acting on my behalf.
With professional supervisors, using anonymised or minimally identifying information wherever possible.
With another professional or service where you have asked or authorised me to do so.
With safeguarding, emergency, healthcare, regulatory or law-enforcement bodies where there is a lawful and necessary reason.
With courts, insurers, legal advisers or other parties where necessary to meet legal or professional obligations or deal with a legal claim.
I apply data minimisation and disclose only information that is relevant and necessary for the purpose.
11. International transfers
Some technology providers may store or process personal information outside the United Kingdom. Where this happens, I take reasonable steps to ensure that an appropriate transfer mechanism and safeguards are in place, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses or another lawful safeguard.
Further information about the locations and safeguards used by individual providers is available in their privacy notices. You may contact me if you would like more information about the safeguards relevant to your information.
12. How I protect information
I use proportionate technical and organisational safeguards designed to protect personal information. These include, where appropriate:
Password-protected devices, accounts and documents.
Device encryption.
Two-factor authentication.
Restricted access to identifiable records.
Secure cloud services and encrypted transmission where supported.
Locked physical storage for handwritten records.
Keeping identifying information to the minimum necessary.
Reviewing and securely deleting information in accordance with my retention schedule.
Access to identifiable client and participant information is restricted to me, except where trusted service providers process information on my behalf or disclosure is legally, professionally or ethically required.
No method of electronic storage or transmission can be guaranteed completely secure. I regularly review the steps I take to reduce foreseeable risks.
13. How long I keep information
I retain personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, insurance and professional obligations.
My usual retention periods are:
Initial enquiries that do not lead to a service: up to 12 months after our last meaningful contact, unless there is a reason to retain them longer.
Adult therapy records: seven years after the end of therapy, in line with current insurance guidance.
Children’s therapy records: seven years after the child turns 18, in line with current insurance guidance.
Big Reactions and other short workshop participation forms: normally three months after the final workshop or personal follow-up, unless the information becomes part of a therapy record or must be retained longer because of an incident, complaint, safeguarding concern, insurance requirement or legal claim.
Booking and financial records: for the period required by tax, accounting and legal obligations, normally up to six years after the relevant financial period.
Marketing records: until you unsubscribe or withdraw consent. I may retain minimal suppression information so that I can respect your request not to receive further marketing.
Website and analytics information: in accordance with the relevant cookie settings, provider controls and my legitimate operational needs.
When information is no longer required, I securely delete, destroy or anonymise it.
14. Marketing
I will send newsletters or other electronic marketing only where I have an appropriate basis, normally your consent.
You can unsubscribe at any time by using the unsubscribe link in an email or contacting hello@corrinabeasleytherapy.co.uk. Withdrawing marketing consent will not affect service-related communications, such as appointment information, booking confirmations, receipts or important changes to a programme you have booked.
I do not add therapy clients, workshop participants or parents to my marketing list simply because they have used a service.
15. My website, analytics and cookies
My website is hosted by Squarespace. When you visit it, Squarespace and other authorised providers may process information including:
Your IP address.
Information about your browser, network and device.
Pages visited before and during your visit.
Clicks, searches, internal links, scrolling and timestamps.
This information is used to operate, secure and understand the use of the website.
The website uses cookies and similar technologies. Necessary cookies support the functioning and security of the site. Non-essential analytics or marketing cookies should be used only in accordance with the choices presented through the website’s cookie controls.
Information about Squarespace cookies is available at:
https://support.squarespace.com/hc/en-us/articles/360001264507
The website may also load fonts or other resources from providers such as Google or Adobe. Those providers may receive technical information, such as your IP address and details about your browser or device, when those resources are loaded.
16. Customer accounts, orders and service emails
If you create a customer account, book or buy through my website, Squarespace or another booking provider may collect information such as your name, contact details, billing information, appointment or order details and account activity.
You may receive necessary administrative messages about your booking, order or account—for example, appointment details, receipts, password resets, changes or cancellations. These messages are not marketing and it may not be possible to unsubscribe from them while the relevant service or account remains active.
17. Your data-protection rights
Depending on the circumstances and the lawful basis being used, you may have the right to:
Ask for confirmation that I process your information and request a copy.
Ask me to correct inaccurate or incomplete information.
Ask me to delete information.
Ask me to restrict how information is used.
Object to certain processing based on legitimate interests or to direct marketing.
Receive certain information in a portable format or ask for it to be transferred.
Withdraw consent where processing relies on consent.
Complain to the Information Commissioner’s Office.
These rights are not absolute and exemptions may apply—for example, where information must be retained for legal, safeguarding, insurance or legal-claims purposes.
To make a request, email hello@corrinabeasleytherapy.co.uk. I may need to verify your identity or authority before responding. I will normally respond within one month, as required by data-protection law.
Where information concerns a child, I will consider the child’s rights, age, understanding and best interests, as well as the authority of the person making the request.
18. Automated decision-making
I do not make decisions that have legal or similarly significant effects on you or your child solely through automated processing.
Any decision about whether a workshop is likely to be appropriate is reviewed personally by me, using the information supplied and, where necessary, a private conversation with the parent or carer.
19. Contact preferences and incidental meetings
Please tell me if you have particular requirements concerning how or when I contact you—for example, if you do not want telephone messages left or do not want me to call at home.
To protect confidentiality, if I see a client outside a session, I will not normally approach them or indicate that I know them. If the client chooses to acknowledge me, I will respond appropriately.
20. Concerns and complaints
If you have any questions or concerns about how I use your information, please contact:
Corrina Beasley
Email: hello@corrinabeasleytherapy.co.uk
I hope I can resolve your concern, but you also have the right to complain to the Information Commissioner’s Office:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: https://www.ico.org.uk
21. Changes to this notice
I may update this privacy notice when my services, providers or legal obligations change. The latest version will be published on my website with the date it was last updated.