Book a consultation

Privacy Policy

Last updated: 27 October 2026

1. Who I Am

I am Dawn Lankester, a Chartered Counselling Psychologist and Accredited CBT Psychotherapist based in Hazlemere, Buckinghamshire.

I am responsible for deciding how and why personal information is used in connection with this website and my services. Under data protection law, this means I act as the data controller for the personal information covered by this policy.

You can contact me about privacy or personal data using the following details:

2. What This Policy Covers

This Privacy Policy explains how I collect, use, store and protect personal information when you:

  • Visit my website.

  • Contact me through the website’s contact form, by email or by telephone.

  • Enquire about therapy or assessment services.

  • Arrange appointments or become a client.

  • Receive individual therapy, relationship therapy, adult ADHD assessment or adult autism assessment.

I handle personal information in accordance with applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

My Cookie Policy provides further information about cookies and similar technologies used on the website.

This policy does not cover third-party websites that you may visit through external links.

3. What Personal Information I Collect

The information I collect depends on how you interact with me and which services you use.

Contact and Enquiry Information

When you use the website’s contact form, I collect the information you provide, including:

  • Your name.

  • Your email address.

  • The subject of your enquiry.

  • The contents of your message.

If you contact me by telephone or email, I may also collect your telephone number, email address and other information you choose to share.

Please keep your initial enquiry brief and avoid including detailed health or psychological information until we have spoken.

Client and Appointment Information

If you arrange an appointment or become a client, I may collect information necessary to arrange and provide the relevant service. This may include your contact details, date of birth, appointment information and other administrative details.

Additional information will depend on the service you receive and what is necessary for your care or assessment.

Health and Clinical Information

When providing therapy or assessment services, I may collect sensitive personal information relating to your mental and physical health.

This may include:

  • Your reasons for seeking support.

  • Relevant personal, medical and psychological history.

  • Information discussed during therapy sessions.

  • Clinical notes and assessment findings.

  • Information relating to an ADHD or autism assessment, where applicable.

  • Reports, recommendations and relevant correspondence with other professionals.

I use this information only for appropriate professional, clinical, administrative and legal purposes.

Relationship Therapy Information

If you attend relationship therapy, I may process information about your relationship and the circumstances you discuss during sessions.

The handling of information provided by individual partners, including information shared separately, will be explained as part of the arrangements for the service.

Payment and Financial Information

Where applicable, I may retain invoices, payment records and information needed to manage fees and comply with accounting requirements.

Payment information processed by a third-party payment provider will also be subject to that provider’s own privacy practices.

Website Technical Information

When you visit the website, technical information may be recorded by the website host or other services supporting its operation. Depending on the configuration, this may include your IP address, browser type, device information, pages visited and server logs.

The precise technical information collected depends on the website’s hosting arrangements and any tools or technologies in use.

4. How and Why I Use Your Information

I use personal information for the following purposes:

Responding to Enquiries

I use your contact details and message to respond to your enquiry, answer questions about my services and arrange an initial conversation or appointment where appropriate.

The lawful basis may be my legitimate interests in responding to enquiries or taking steps at your request before entering into a contract.

Providing Therapy and Assessment Services

If you become a client, I use relevant personal and health information to provide the agreed service, support your care and conduct assessments where applicable.

The lawful basis for processing may include performing a contract or taking steps at your request before entering into one. Health information requires an additional lawful condition under Article 9 of the UK GDPR, which must be appropriate to the particular processing.

Maintaining Professional Records

I may use and retain relevant information to maintain clinical records, support professional accountability, manage complaints and meet applicable legal and professional obligations.

Managing Payments and Accounts

Where applicable, I process relevant information to manage fees, payments, invoices and accounting obligations.

Protecting Safety and Meeting Legal Obligations

In certain circumstances, I may need to process or disclose information to address serious safeguarding concerns, protect someone from significant harm, comply with legal requirements or establish, exercise or defend legal claims.

The applicable lawful basis depends on the circumstances.

Operating and Securing the Website

Technical information may be used to maintain website functionality, investigate technical problems, protect against malicious activity and improve website security.

Cookies and Similar Technologies

Where non-essential cookies or similar technologies are used, the relevant consent requirements will apply. Further information is provided in the Cookie Policy.

I do not sell personal information. I do not use personal information for automated decision-making or profiling that produces legal or similarly significant effects as part of the services described in this policy.

5. Special Category and Health Information

Health information, including information about mental health, is considered special category personal data under the UK GDPR and receives additional protection.

I process this information only where there is an appropriate lawful basis and special category condition, and where it is necessary for the relevant purpose.

Depending on the circumstances, this may include providing health care or treatment, maintaining professional records, complying with legal obligations or addressing specific safeguarding and legal situations.

I aim to collect only information that is relevant and necessary for the service or purpose concerned.

6. Confidentiality and Its Limits

Confidentiality is an important part of psychological therapy and assessment.

Information you share with me is handled confidentially, subject to applicable professional obligations and legal requirements.

There may be circumstances in which information needs to be shared without your consent, including where:

  • There is a serious risk of harm to you or another person.

  • There are safeguarding concerns involving a child or an adult at risk.

  • Disclosure is required by law or a court order.

  • Disclosure is otherwise permitted or required under applicable law.

Where it is safe and lawful to do so, I will discuss the situation with you before sharing information.

Where disclosure is necessary, I aim to share only the information reasonably required for the relevant purpose.

For relationship therapy, the arrangements for confidentiality and information shared by individual partners will be explained as part of the service agreement.

7. Who May Receive Your Information

I do not sell or rent your personal information.

Where necessary, information may be shared with the following categories of recipients:

Website Hosting and Email Providers

Providers supporting the website and email communications may process information to host the website, deliver messages, maintain systems and protect against technical or security problems.

Online Appointment Providers

If a third-party platform is used for online appointments, it may process relevant technical or account information to facilitate the session.

Record-Keeping and Administrative Providers

Where applicable, providers supporting clinical record-keeping, practice administration or document storage may process information necessary for those purposes.

Payment and Accounting Providers

Where applicable, payment providers, accountants or other financial service providers may receive information needed to process payments, maintain accounts or meet legal obligations.

Other Healthcare Professionals

I may share relevant information with your GP, another healthcare professional or a referrer where appropriate and with your consent, unless there is a lawful basis for disclosure without consent.

Professional Supervisors

Relevant clinical information may be discussed for professional supervision where appropriate. I aim to anonymise information wherever possible and follow applicable confidentiality and professional requirements.

Insurers, Regulators and Legal Authorities

Information may be shared with insurers, legal advisers, regulators, the police or courts where necessary and lawful, including for complaints, legal claims, safeguarding or compliance with legal obligations.

Where another organisation processes personal information on my behalf, appropriate contractual and data protection arrangements will be required where applicable.

8. International Transfers of Information

Some third-party providers may store or process information outside the United Kingdom.

Where personal information is transferred internationally, I will ensure that the transfer complies with applicable data protection law. Depending on the circumstances, this may involve a UK adequacy decision or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum.

You can contact me using the details in Section 1 if you would like further information about relevant international transfers.

9. How Long I Keep Your Information

I retain personal information only for as long as necessary for the purpose for which it was collected, taking account of applicable legal, professional, accounting and insurance requirements.

Different categories of information may require different retention periods.

Enquiries That Do Not Lead to an Appointment

Enquiry information may be retained for an appropriate period to respond to your enquiry, manage follow-up communications and maintain relevant administrative records. It will be deleted or anonymised when no longer necessary, subject to any applicable legal requirements.

Clinical Records and Assessment Reports

Clinical records, therapy notes and assessment reports may need to be retained in accordance with applicable professional guidance, legal requirements and insurance arrangements.

Financial Records

Invoices and other financial records will be retained for the period required by applicable tax and accounting rules.

Website Technical Records

Server logs and other technical information may be retained for a period determined by the relevant hosting provider or technical service, depending on operational and security requirements.

I will not retain personal information indefinitely without a valid reason. Where information is no longer required, I will take appropriate steps to delete it or securely dispose of it, subject to applicable retention obligations.

10. How I Protect Your Information

I take appropriate steps to protect personal information against unauthorised access, accidental loss, alteration, disclosure or misuse.

The measures used will depend on the type of information and the systems involved. I also take account of the sensitive nature of clinical information when considering appropriate safeguards.

No method of electronic transmission or storage can be guaranteed to be completely secure.

If a personal data breach occurs, I will assess the circumstances and take the steps required by applicable data protection law, including notifying the Information Commissioner’s Office or affected individuals where legally required.

11. Your Data Protection Rights

Under applicable data protection law, you may have the right to:

  • Access: request a copy of the personal information I hold about you.

  • Rectification: ask me to correct inaccurate or incomplete information.

  • Erasure: request deletion of personal information in certain circumstances.

  • Restriction: ask me to restrict the processing of your information in certain circumstances.

  • Object: object to processing based on legitimate interests, subject to the applicable legal rules.

  • Data portability: request your information in a portable format where the right applies.

  • Withdraw consent: withdraw consent where processing is based on your consent.

These rights are subject to legal conditions and exceptions. For example, certain clinical records may need to be retained to meet professional or legal obligations.

To exercise your rights, contact me using the details in Section 1.

I may need to verify your identity before responding. I will normally respond within one month of receiving a valid request, subject to any lawful extension or other applicable requirements. Requests are generally free of charge unless the law permits a reasonable fee or refusal in exceptional circumstances.

12. Marketing and Electronic Communications

I use the contact information you provide to respond to enquiries, manage appointments and communicate about relevant services.

I do not use an enquiry as automatic permission to send unrelated marketing communications.

Any electronic marketing I send in the future will be subject to applicable privacy and electronic communications requirements, including consent where required. Marketing messages will include an appropriate way to opt out.

13. Cookies and Website Technologies

This website may use cookies and similar technologies to support its operation and, where applicable, to provide additional functionality or analyse website usage.

The specific cookies and technologies used depend on the website’s configuration and any third-party integrations.

Please read the Cookie Policy for further information about cookie categories, consent and available controls.

14. Children and Young People

The services described on this website are directed towards adults.

I do not knowingly collect children’s personal information through the website as part of its intended adult enquiry process.

If you believe a child has submitted personal information through the website, please contact me so that the circumstances can be reviewed and appropriate action taken.

15. Complaints and the Information Commissioner’s Office

If you have concerns about how I collect, use or protect your personal information, please contact me first using the details in Section 1.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.

You can contact the ICO if you believe your personal information has been handled in a way that does not comply with applicable data protection law.

16. Changes to This Privacy Policy

I may update this Privacy Policy from time to time to reflect changes in my services, website functionality, data-processing practices or legal requirements.

The date at the top of this page indicates when the policy was last updated.

Where appropriate, significant changes will be communicated through the website or another suitable method.

17. Contact

If you have questions about this Privacy Policy or how your personal information is handled, please contact:

Dawn Lankester

Chartered Counselling Psychologist and Accredited CBT Psychotherapist