Last updated: July 2026
For me as a UKCP-accredited Psychotherapist, protecting my psychotherapy clients’
personal data and privacy is an important part of my practice. This privacy policy
relates to all personal information being processed during the therapy process and
explains how and why I collect, use, store and protect your personal information, as
well as how complaints can be made in case of dissatisfaction with how your data
are being handled.
It is created with the intention to comply with the UK General Data Protection
Regulation (UK GDPR), the Data Protection Act 2018 and the Data Use and Access
Act 2025/26 (DUAA)
- Who is Responsible for Your Data
I, the psychotherapist, am the data controller for the personal information collected
and held in the course of providing psychotherapy services. I am registered with the
Information Commissioner’s Office (ICO) under registration number ZB671815
Name: Ljiljana Despotovic
Email: lila.innerlifecounselling@gmail.com
- What Personal Information is Collected
I collect and process the following categories of personal data in the course of
providing psychotherapy:
● Contact details: Name, phone number, address, email address, GP details,
emergency contact details
● Administrative information: Appointment dates/times, payment information.
I don’t store bank card details.
● Health and personal information: Information shared as part of our therapy
sessions (e.g. presenting issues, mental health history, life experiences)
● Sensitive data/Special Category Data: Information about your mental health,
sexual orientation, ethnicity, religion and other personal matters shared
during sessions, where applicable.
● Session notes: Brief anonymised notes of key themes discussed in our
sessions. The purpose of recording them is for the therapist’s own
recollection and to monitor therapeutic work and also need to retain them for
lawful purposes.
- How Information is Collected
I may collect your personal information in the following ways:
● When you make an enquiry or book a session with me
● During the initial consultation or in the course of ongoing therapy sessions
● Via secure forms or email correspondence
● From third-party referrers, with your explicit permission
- Legal Basis for Processing Personal Information
Under the UK General Data Protection Regulation (UK GDPR), as a Psychotherapist I
rely on the following lawful bases for processing personal data:
● Contract/Therapy Agreement: To provide and manage the psychotherapy
services requested by the Client
● Consent: For collecting and storing special category (sensitive) personal data;
where explicit consent is required
● Legal obligation: To comply with legal, accounting and tax purposes, and
regulatory requirements
● Vital interests: In rare situations where disclosure of information is necessary
to protect the life and safety of the Client or another individual
● Legitimate interests: To maintain appropriate records for clinical supervision,
practice development, or professional insurance purposes
- How Personal Information is Used
The Therapist uses personal data for the following purposes:
● To communicate with you about appointments and therapy-related matters
● To provide, review, and manage the agreed psychotherapy services
● To maintain accurate and up-to-date clinical records
● To issue invoices and process payments
● To fulfil professional, ethical, and legal obligations (e.g. supervision,
insurance, and record keeping)
Personal data is not used for marketing purposes and will never be shared with
third parties without the Client’s explicit consent, unless required by law.
- How Information is Stored and Protected
All personal data is stored securely in accordance with UK GDPR and the Data
Protection Act 2018. I take appropriate technical and organisational measures to
ensure the confidentiality, integrity, and availability of personal information and to
protect it from loss, unauthorised access or misuse.
The information may be stored in the following formats:
● Electronic records: Stored on secure, password-protected platforms and
devices
● Paper records: Stored in a locked and secure location
● Emails and online forms: Secured through professional password- protected
email systems.
● Client’s name, contact details, GP’s details, emergency contacts and therapy
agreement forms are kept separately from session notes.
Access to all data is restricted to the Therapist. No data is shared with third parties
unless required by law or with the individual’s explicit consent.
- How Long Personal Information is Retained
The Psychotherapist retains Client records for a period of seven years following the
end of the therapeutic relationship, in line with guidance from professional bodies
and professional indemnity insurers. After this time, all records are securely
destroyed.
If Psychotherapy ends before the first full session (e.g. following an initial
consultation only), any notes or personal information are typically deleted within
three months, unless required for legal or professional reasons.
- Sharing Personal Information
I will not share a Client’s personal information without their explicit consent, except
in the following situations:
● Risk of harm: If there is reason to believe the Client, or someone else, is at
serious risk of harm
● Legal obligation: If disclosure is required by law or court order (e.g. under
legislation relating to safeguarding, terrorism, or criminal activity)
● Professional requirements: If disclosure is required by the Psychotherapist’s
insurer or professional accrediting body
● Clinical supervision: To ensure ethical and effective practice, the
Psychotherapist discusses clinical work in supervision. Client identities are
anonymised wherever possible, and supervisors are bound by professional
confidentiality
● Incapacity or death of the Psychotherapist: In this unlikely event, a Clinical
Executor may access Client contact details to manage the transition. See
Section 12 for more information. This process is governed by strict
confidentiality and data protection standards
In all other circumstances, the Therapist will only contact or share information with
third parties (e.g. a GP, solicitor, or other healthcare provider) with the Client’s prior
written consent.
- Your Rights Under UK GDPR
Under the UK General Data Protection Regulation (UK GDPR), Clients have the
following rights regarding their personal data:
● The right to access the personal information held about them
● The right to rectify inaccurate or incomplete data
● The right to request erasure of data, in certain circumstances
● The right to restrict or object to the processing of data
● The right to data portability, where applicable
● The right to withdraw consent at any time (where processing is based on
consent)
● The right to lodge a complaint, initially with me, the psychotherapist, and
afterwards if needed with the Information Commissioner’s Office (ICO) at
www.ico.org.uk
Requests to access, amend, or delete personal data should be made in writing. I will
aim to respond within one calendar month, in accordance with GDPR requirements.
This privacy policy applies only to the personal data collected and processed
directly by the Psychotherapist in the course of providing psychotherapy services.
If you find or contact me through a third-party platform (such as the UKCP, BACP,
Bupa or other insurance company, Psychology Today or other directory websites), I
encourage you to consult the privacy policies of those platforms directly. In these
cases, the responsibility for how those websites collect, store, or process personal
data will be theirs.
- Complaints
In case of any concerns about how their personal data is handled, I will encourage
you to contact me in the first instance (email lila.innerlifecounseling@gmail) to
discuss and resolve the issue. You will then expect to receive the information within
30 days of receipt of the request.
If the concern cannot be resolved, you have the right to lodge a complaint with the
Information Commissioner’s Office (ICO), the UK’s independent authority for data
protection:
www.ico.org.uk
Telephone: 0303 123 1113
- Policy Changes
This privacy policy may be updated periodically to reflect changes in the law,
professional guidelines, or my psychotherapy practice. The most current version
will be available on my website or it can be provided upon request.
- In the Event of My Inability to Practice
In the unlikely event of becoming physically incapacitated or die during the therapy
process, a qualified psychotherapist appointed as my Clinical Executor will access
your contact details and inform you of the situation and offer appropriate support,
such as referral options.
Client contact details (Name and email address) are securely stored on a password-
protected platform. The Clinical Executor is professionally and ethically bound to
maintain strict confidentiality and will only use your data to manage this transition
in accordance with data protection legislation and professional standards.
- Client Consent
By engaging in therapy, you will be invited to give your informed consent in writing
before any personal or sensitive data is collected, stored, or shared. This includes:
● Consent for your personal data to be collected, stored, and processed as
outlined in this Privacy Policy
● Consent for data to be shared only in specific circumstances (e.g. risk of harm,
legal obligations, supervision, or clinical will execution)
● Optional consent for anonymised material from our work to be used for
professional purposes such as supervision, training, or writing
You are free to decline or withdraw your consent at any time. Please note that, if this
is the case, the therapeutic work may be terminated as I am required to keep
appropriate records in line with my insurance and governing Bodies as well for legal
and safeguarding matters.
A written consent form is provided at the start of therapy. You are welcome to ask
questions or request changes if needed.
- Cookies and Tracking
My website does not use cookies, tracking technologies, or analytics tools. No
personal data is collected automatically when you visit https://innerlife-
counselling.co.uk
Your visit is not monitored, and no consent banner is required because no non-
essential cookies are in use.
If this changes in future (for example, if analytics tools are added), this Privacy
Policy will be updated and a cookie banner will be introduced in line with UK GDPR
requirements.