Privacy Policy

Last updated: 1 June 2026

1. Who we are

This Privacy Policy is issued by Megan D. Colletta, LCSW ("Megan", "the practice", "we", "us"), trading as a sole-practitioner integrative psychotherapy private practice based in Devon, United Kingdom and operating online across the UK.

Megan is the data controller for personal data collected by the practice. You can contact the practice about any privacy matter at:

• Email: hello@megancolletta.com
• Post: Available on request.
• ICO registration number: ZC161352

2. What personal information we collect

We collect different categories of personal information depending on how you interact with us.

2.1 If you visit the website only

The website itself sets no analytics cookies and uses no behavioural tracking. We do not log IP addresses or browsing behaviour for marketing purposes. The website's hosting provider (Netlify, see §4) collects standard server-access logs for security and reliability purposes only.

2.2 If you use the contact form or newsletter form

We collect: the name and email you supply, and any text you enter into the form. For the contact form we additionally collect any "best times to talk" and "what brings you here" details, and your topic selection.

2.3 If you book a free 20-minute consultation

We collect, via our booking widget which writes directly to Cliniko (see §4): your first name, last name, email, optional phone number, optional notes, and the slot you have selected. Cliniko also records the IP address of the booking request for fraud-prevention purposes.

2.4 If you become a therapy client

In addition to the items above, we collect and process special-category personal data under UK GDPR Article 9 in order to provide therapy. This typically includes:

• Your full contact details (postal address, phone, emergency contact)
• Your date of birth
• Your GP's name and contact details (we ask for this so we can liaise with your GP where appropriate or in safeguarding situations — see §6)
• Medical, psychiatric, and mental-health history relevant to the work
• Session notes (brief notes Megan makes after each session to support continuity)
• Any assessment instruments completed (e.g. PHQ-9, GAD-7, PG-13)
• Payment information (handled via bank transfer; we do not store card details)

3. Lawful basis for processing

Under UK GDPR Article 6 and Article 9, the lawful bases on which we process your data are:

• Contract (Article 6(1)(b)) — for processing necessary to provide the therapy services you have engaged us to deliver, including scheduling, communication, and record-keeping.
• Legal obligation (Article 6(1)(c)) — for processing required to comply with our professional and statutory obligations (e.g. clinical record retention, safeguarding disclosures, response to court orders).
• Legitimate interests (Article 6(1)(f)) — for limited administrative purposes such as responding to your initial enquiry before a contract exists, and ensuring the security of our systems.
• Explicit consent (Article 9(2)(a)) — for processing the special-category health data inherent in therapy. You provide this consent when you sign the consent form at the start of treatment, and you may withdraw it at any time (see §8).
• Provision of healthcare (Article 9(2)(h)) — as an alternative ground for processing health data in the course of providing therapy under our professional duty of care.
• Vital interests (Article 9(2)(c)) and substantial public interest (Article 9(2)(g)) — for the limited circumstances in which we may need to disclose information without your consent to prevent serious harm (see §6).

4. Who we share your information with (sub-processors)

We do not sell your personal data, and we do not share it for marketing purposes. We share with the following third-party providers solely to deliver our services. Each is bound by a written data-processing agreement that requires data-protection standards at least equivalent to UK GDPR.

Sub-processor	What for	Where data is held	Safeguard
Cliniko (Red Guava Pty Ltd, Australia)	Practice management: appointment scheduling, clinical records, secure telehealth video sessions, automated reminder and confirmation emails. The complete list of Cliniko's own sub-processors (AWS for hosting, SendGrid for email, etc.) is published at help.cliniko.com/privacy/data-processing/cliniko-subprocessors.	EU (Ireland) region, with Red Guava Pty Ltd in Australia	UK Addendum to the EU Standard Contractual Clauses, signed UK Data Processing Addendum (v20221226)
Netlify (Netlify Inc., United States)	Website hosting, form submissions (contact + newsletter), edge computing for the booking widget.	United States (with edge locations globally)	EU-US Data Privacy Framework + Standard Contractual Clauses
GitHub (GitHub Inc., United States)	Source code and content storage for the website; powers the Decap CMS editor. No client data is stored here — only the website's public content.	United States	EU-US Data Privacy Framework + Standard Contractual Clauses
Google Fonts (Google LLC, United States)	Serves two web fonts (Alice + Work Sans). Loads from Google's CDN on page view. Google may log the IP address of the requesting browser for the brief moment of font delivery.	Global CDN	EU-US Data Privacy Framework

We will keep this sub-processor list up to date. If you would like to be notified in advance when we change a sub-processor, write to hello@megancolletta.com and we will add you to a notification list.

5. International transfers

Because Cliniko is an Australian company (with EU/Ireland-region servers) and Netlify, GitHub, and Google are based in the United States, your personal data is transferred outside the United Kingdom in the course of our operations.

We rely on the following safeguards:

• Cliniko: the UK Addendum to the EU Standard Contractual Clauses, executed via Red Guava's UK Data Processing Addendum (v20221226), which forms part of Cliniko's Terms of Service. A copy of the executed addendum is held on file and is available on request.
• Netlify, GitHub, Google: a combination of the EU-US Data Privacy Framework (with which each provider self-certifies) and the UK Addendum to the Standard Contractual Clauses.

6. Confidentiality and its limits

Therapy with Megan is confidential by default. Information you share in session, in writing, or in records held by the practice will not be disclosed to third parties without your explicit consent, with the following exceptions required by law or professional standards:

• Risk to life: where Megan judges there is a serious and imminent risk of harm to you or to another identifiable person, information may be shared with relevant authorities (your GP, emergency services, the police) without your consent. Wherever possible, Megan will discuss this with you before disclosing.
• Safeguarding of children or vulnerable adults: under the Children Act 1989/2004, Care Act 2014, and Mental Capacity Act 2005, disclosures may be made to social services or police without your consent if there is reasonable concern of abuse, neglect, or harm.
• Court order or statutory requirement: e.g. a court subpoena, a Crown Prosecution Service request for therapy notes in criminal proceedings (current CPS guidance: May 2022), a disclosure required under the Terrorism Act 2000 or Proceeds of Crime Act 2002.
• Clinical supervision: Megan discusses anonymised aspects of her work with a clinical supervisor as required by BABCP and Social Work England standards. No identifying details are shared.

The consent form explains these limits in more detail.

7. How long we keep your information

Type of record	Retention period
Enquiry-only contact (no therapy commenced)	12 months from last contact, then deleted
Newsletter subscription	Until you unsubscribe, then deleted within 30 days
Clinical records (clients who started therapy)	8 years from last contact, in line with NHS and BABCP guidance. For clients who were under 18 at the time of therapy: until age 25.
Financial records (invoices)	6 years from issue, as required by HMRC
Audit logs in Cliniko	Per Cliniko's retention policy

Records are securely destroyed at the end of the retention period (digital records erased per Cliniko's deletion process; any paper records cross-cut shredded).

In the event that the practice closes (planned or unplanned), you will be notified in advance about arrangements for your records, including secure destruction or transfer to another practitioner of your choice. A clinical continuity plan is in place to ensure this — see the Terms of Service §10.

8. Your rights under UK GDPR

You have the right to:

• Be informed about how we use your data (this Policy).
• Access the personal data we hold about you ("subject access request"). Free, normally fulfilled within one month.
• Rectification of inaccurate or incomplete data.
• Erasure ("right to be forgotten") — subject to our obligation to retain clinical records for the legal retention period.
• Restriction of processing — pause processing while a dispute is resolved.
• Portability — receive your data in a structured, machine-readable format.
• Object to processing based on legitimate interests.
• Withdraw consent at any time, where consent is the lawful basis. Withdrawal does not affect the lawfulness of any processing already carried out.
• Not be subject to automated decision-making. We do not use any automated decision-making or profiling.

To exercise any of these rights, email hello@megancolletta.com. We will respond within one month.

9. Cookies

The website does not set any cookies of its own and does not use behavioural-analytics or advertising trackers. The Decap CMS at /admin/ (used only by Megan, not by visitors) uses session cookies for authentication. Google Fonts may set technical cookies as part of font delivery.

No consent banner is shown because no non-essential cookies are set.

10. How to complain

If you are unhappy with how we have handled your personal data, please raise it with us first at hello@megancolletta.com. We aim to respond within 14 days.

If we cannot resolve your concern, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113

You may also raise concerns with the relevant professional body:

• Social Work England — socialworkengland.org.uk/concerns
• BABCP — babcp.com/about/raising-a-concern

11. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practice or in data-protection law. The "Last updated" date at the top of this page indicates the most recent revision. Material changes that affect existing clients will be communicated by email.