Privacy Notice

Kate Bull Therapy

katebulltherapy.com

ICO Registration Number: ZA193663 

Last reviewed: June 2026

1. Who I am

I am Kate Bull, a UKCP-registered psychotherapist practising under the name Kate Bull Therapy. I am registered with the UK Information Commissioner's Office (ICO) as a data controller. My ICO registration number is ZA193663

For any data protection queries, you can contact me at [your email address].

2. What this notice covers

This privacy notice explains what personal data I collect, why I collect it, how I use and store it, and what your rights are. It applies to anyone who contacts me, enquires about my services, or becomes a client.

If you are visiting my website, please also see Section 10 on cookies.

3. What personal data I collect

3a. Enquiry and administrative data

When you contact me, I collect:

  • Your name and contact details (email, phone, address if provided)

  • Information about what you are looking for

  • GP details and emergency contact details (once you become a client)

  • Billing and payment information

3b. Clinical data

As part of providing therapy, I collect and hold:

  • Session notes and records of our work together

  • Presenting concerns, history, and any relevant background information you share

  • Risk-related information where relevant

  • Correspondence related to your care

3c. Supervision and insurance data

I receive clinical supervision as required by my professional body. I may discuss clinical material in supervision on an anonymised basis. If you are using Bupa or another insurance provider to fund your therapy, I will hold relevant pre-authorisation and invoicing information.

3d. Website data

My website may collect data via contact forms and cookies. Please see Section 10.

4. Why I collect your data and the lawful basis

I process your data on the following bases under UK GDPR:

Contract: To provide therapy services in line with our agreement.

Legal obligation: To comply with professional, regulatory, and legal requirements, including safeguarding duties.

Legitimate interests: To manage the running of my practice, including invoicing, scheduling, and contacting you about appointments.

Vital interests: In an emergency where I need to act to protect your life or someone else's.

Health data is special category data under UK GDPR. I process this under Article 9(2)(h) — for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment — and where necessary, with your explicit consent.

5. How long I keep your data

I keep client records for [7] years after the end of our work together, in line with UKCP guidance and professional indemnity insurance requirements. Enquiry data from people who do not become clients is deleted within 3 months unless there is a reason to retain it.

You can request that I delete your data earlier. I will always explain if I am unable to do this and why.

6. Who I share your data with

I do not sell or share your personal data for commercial purposes. I may share information in the following limited circumstances:

Clinical supervision: I discuss clinical work with my supervisor for professional and ethical reasons. This is done on an anonymised basis wherever possible. No identifiable data is shared. 

Your GP or other professionals: With your knowledge and consent, or in situations where I have a safeguarding duty to act without it.

Insurance providers: If you are using Bupa or another insurer, I will share the information required to process authorisations and invoices and requested progress reports if requested. 

Legal requirements: Where I am required to disclose information by law.

7. Data processors and third-party services

I use the following third-party services which may process your data on my behalf:

Kiku (wearekiku.com): My practice management system, used for scheduling, notes, and records. Hosted on AWS Ireland.

Squarespace: My website host. May collect data via contact forms and cookies.

Google Workspace / Gmail: I use email for administrative communication and online appointments. 

Bupa Providers Online: For processing insurance claims where applicable.

All third-party processors are required to handle your data securely and in accordance with UK data protection law.

Some processors may store data outside the UK. Where this is the case, I ensure that appropriate safeguards are in place, such as Standard Contractual Clauses or an adequacy decision.

8. How I keep your data secure

I take the security of your data seriously. Measures I use include:

  • Password-protected devices and accounts

  • Encrypted or secure storage for clinical notes

  • Secure email practices for any sensitive communication

  • Physical records (if any) kept in a locked location

No method of transmission or storage is completely secure. If you have concerns about a particular method of communication, please discuss this with me.

9. Your rights

Under UK GDPR, you have the following rights:

Right of access: You can ask to see the personal data I hold about you.

Right to rectification: You can ask me to correct inaccurate data.

Right to erasure: You can ask me to delete your data, subject to legal and professional obligations.

Right to restriction: You can ask me to limit how I use your data.

Right to portability: You can ask for your data in a portable format.

Right to object: You can object to processing based on legitimate interests.

To exercise any of these rights, please contact me at katebulltherapy@gmail.com.I will respond within 30 days.

10. Cookies and website data

My website (katebulltherapy.com) is hosted on Squarespace. Squarespace uses cookies for essential website functionality and, if you have consented, for analytics. You can manage your cookie preferences when you visit the site.

If you submit an enquiry via my contact form, the information you provide will be sent to me by email and stored in Squarespace. I will use it only to respond to your enquiry.

I use Google Analytics to understand how visitors use this website. This service collects anonymised data including pages visited, time on site, and device information. No personally identifiable information is collected. This only operates with your consent, which you can give or withdraw via the cookie banner on this site. Data is processed by Google Ireland Limited. For more information see Google's privacy policy at google.com/policies/privacy. 

11. How to raise a data protection concern or complaint

If you have a concern about how I have handled your personal data, please contact me in the first instance at katebulltherapy.com

I will acknowledge your complaint within 30 days and let you know the outcome of my investigation. My response will include a reminder of your right to escalate if you remain dissatisfied.

If you are not satisfied with my response, or if you wish to raise a concern directly with the regulator, you have the right to contact the Information Commissioner's Office:

  • Website: ico.org.uk

  • Phone: 0303 123 1113

  • Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

12. Changes to this notice

I will review and update this notice when my data processing practices change, or when required by changes in law. The current version will always be available on my website. The date at the top of this document shows when it was last reviewed.