Privacy Policy
How I look after your information
What you share with me is personal, and keeping it safe is part of what makes therapy work. This policy sets out, in plain terms, what information I hold, why I hold it, how I protect it and what your rights are.
I'm Madeleine Hayman, a cognitive behavioural psychotherapist offering eclectic cognitive behavioural therapy (CBT). I am the data controller for the information described here, which means I am responsible for how it is used and protected.
Email: info@mindfulwithme.co.uk or madeleine@mindfulwithme.co.uk
ICO registration number: Available upon request
What information I collect
I only collect what I need to provide therapy safely and run my practice. Depending on our work together, this may include:
your name, contact details, date of birth and address
your GP's details and an emergency contact, if you choose to give them
what you tell me when you first get in touch
information from your assessment and sessions, including brief session notes
questionnaires and outcome measures you complete (for example, mood and anxiety scales)
for some types of work, such as eating disorder treatment, measurements like weight (this is not recurrent)
appointment dates and attendance
emails and messages between us
payment and invoicing details, including any information you give me to agree a reduced fee
Some of this is about your physical or mental health. UK data protection law calls this special category data and gives it extra protection.
How I collect it
Most information comes directly from you: when you contact me by email, phone or through my website, complete forms or questionnaires, attend sessions, or message me about appointments.
Occasionally, with your agreement, I may receive information from someone else, such as a referrer or a third-party funder.
Why I use your information
I use your information to:
reply to your enquiry and decide together whether CBT with me is right for you
plan, deliver and review your therapy
arrange appointments and keep in touch with you
keep accurate clinical records
take payment and keep financial records
meet my professional, legal and insurance duties
I don't use client information for research, marketing or any purpose unrelated to your therapy.
The legal basis I rely on
For your general personal information:
Article 6(1)(b) UK GDPR — processing is necessary to carry out our therapy agreement, or to take steps you have asked for before we start.
For health and other special category information:
Article 9(2)(h) UK GDPR — processing is necessary to provide health care or treatment.
Data Protection Act 2018, Schedule 1, Part 1, paragraph 2 — processing for health purposes by a professional bound by confidentiality.
How I keep your information safe
I keep clinical notes and records electronically in [your records system, e.g. WriteUpp / Google Workspace], protected by a strong password and two-factor authentication. Only I can access them. Any paper materials, such as worksheets or questionnaires, are kept in a locked cabinet or scanned and shredded.
I take reasonable steps to protect your information from loss, misuse, and unauthorised access, changes or disclosure.
Clinical supervision
I have regular clinical supervision, as required by my professional bodies. It helps me reflect on my work and keep it safe and effective.
When I discuss our work in supervision, I do so anonymously. I don't share your name or anything that could identify you. My supervisor is also bound by professional confidentiality.
Services that help me run my practice
I use a small number of trusted providers, who may process limited information on my behalf: Google workspace, Squarespace, and Google with Proton Mail.
I don't sell your information or share it for marketing.
Confidentiality and its limits
What you share in therapy is confidential. There are a few situations where I may need to share information without your consent:
if I believe there is a serious risk of harm to you or someone else
if there is a concern about the safety of a child or an adult at risk
if a court or the law requires me to disclose information
Wherever it is safe and possible, I will talk with you first. We will go through these limits together at the start of our work.
If you take part in group work, other group members will hear what you choose to share. I ask everyone to keep what is said in the group confidential, but I can't guarantee how others will behave.
Your rights
You have rights over the information I hold about you. Depending on the situation, you can ask me to:
give you a copy of the information I hold about you
correct anything inaccurate or incomplete
delete your information — this right isn't absolute, and I may need to keep some records for professional, insurance, financial or legal reasons; if so, I'll explain why and for how long
restrict how I use your information
stop certain uses of your information, by objecting to them
To make a request, email me at info@mindfulwithme.co.uk. I will reply within one month and there is usually no charge.
Cookies and my website
My website uses cookies. Some are essential for the site to work. Others, such as analytics cookies, are only used if you agree to them through the cookie banner. You can change your choice at any time in the cookie settings.
My website host, Squarespace, may also process basic technical information to run and secure the site.
Concerns and complaints
If you have a concern about how I handle your information, please contact me first and I will do my best to put it right.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.
Changes to this policy
I review this policy regularly and will update it if the way I handle information changes.
Last updated: October 2026
Madeleine Hayman, Cognitive Behavioural Psychotherapist
Registered Member, British Association for Counselling and Psychotherapy (BACP) — #415472
Member, British Association for Behavioural and Cognitive Psychotherapies (BABCP) — 1052596-RED