Privacy Notice

I, Gosia Garstka, am the data controller and handle your personal information in accordance with the UK GDPR and Data Protection Act 2018.

Email: gosia.therapy@gmail.com
ICO registration number: ZC244207

Information I collect and why

When you contact me about therapy, I may collect your name, contact details and information you choose to provide about why you are seeking therapy.

If you are referred to me by another therapist, I may receive your name, contact details and relevant information about the referral from them.

If we work together, I may also hold information necessary for our therapeutic work, including relevant personal and health information, GP or emergency contact details, appointment information and brief therapy notes.

I use this information to respond to enquiries, provide therapy, manage appointments and maintain appropriate professional records.

My lawful basis for processing your personal information while you are considering or receiving therapy is that it is necessary for the performance of our contract. After therapy has ended, I rely on legitimate interests to retain appropriate records for professional and insurance purposes and in case they are needed in relation to a legal claim.

Some information you share with me, including information about your physical or mental health, is special category personal data. I rely on your explicit consent to process this information where appropriate and may retain relevant records where necessary for the establishment, exercise or defence of legal claims. You may withdraw your consent at any time.

You are not required to provide personal information before entering therapy, but I may be unable to provide therapy without information that is necessary for our work.

Confidentiality and sharing

Everything you discuss with me in therapy is confidential. I attend regular clinical supervision, where clients are anonymised and my supervisor is also bound by confidentiality.

I will not normally share your personal information without your consent. There may be circumstances where disclosure is necessary, for example because of serious safeguarding concerns or a legal requirement. Where possible and appropriate, I would discuss this with you first.

I use trusted third-party services to run my practice: Squarespace for my website, Gmail for email, Google Meet for online sessions, Microsoft OneDrive for secure cloud storage, and Google Analytics and Squarespace Analytics for website analytics.

Some of these providers may process personal information outside the UK using safeguards recognised under UK data protection law. You can contact me for further information about these safeguards.

Storage and retention

I store personal information electronically only, using an encrypted, password-protected laptop and password-protected cloud storage.

I keep therapy records for seven years after our work ends, after which they are securely deleted. Other personal information is kept only for as long as necessary for the purpose for which it was collected.

Your rights

Depending on the circumstances, you have rights to access and correct your personal information, request its deletion or restriction, receive or transfer certain information, and withdraw consent where processing is based on consent.

You also have the right to object to processing based on legitimate interests.

If you have concerns about how I handle your information, you can contact me or make a complaint to the Information Commissioner’s Office (ICO).

Website and cookies

My website is hosted by Squarespace. I use Squarespace Analytics and Google Analytics to understand how visitors use my website and to help improve it. Non-essential cookies are restricted.

If you contact me through the website, the information you provide will be used to respond to your enquiry.

Last updated: October 2026