Happier Self CBT Ltd
Company Number: 16262072
Company Registered address: 111 Ditchling Road, Brighton, BN1 4SE
Privacy Notice
Updated 28 February 2025
This privacy notice tells you what to expect us to do with your personal information.
Who we are:
Happier Self CBT Ltd
Email: sleahy2023@gmail.com
Telephone: 07880 628002
• What information we collect, use, and why
• Lawful bases and data protection rights
• Where we get personal information from
• How long we keep information
• Who we share information with
• How to complain
What information we collect, use, and why
We collect or use the following information to contact you:
First name, email address and/or telephone number
If you provide this information via the website: the Website Host is Go Daddy which is GDPR compliant. It will collect electronic personal data when you first visit the website where a small text file that is commonly known as a cookie is automatically placed on your computer. Cookies are used to identify visitors, to simplify accessibility, to monitor visitor behaviour when viewing website content and navigating the website, and when using features or downloading files. You can choose not to allow cookies when visiting the website. Google's privacy policy can be found by clicking on the link at the bottom of the form.
If you provide this information by phone or email, all that is required is your first name and how you would like to be contacted.
We collect or use the following information should you wish to proceed to an initial 30 minute telephone consultation:
· First name, telephone number and/or email address
· Current difficulty and reason for looking for support
· Previous therapy
· Any questions you have
An Initial Enquiry Consultation form may be sent to you to complete and return (if possible and if you choose to) prior to the call. You can choose to have this sent to you as a Google form via email, as an attachment to an email (gmail), or in the post (in which case this will not be returned to us prior to the call).
This form is to enable us to consider together if CBT and Happier Self CBT will be useful options for you going forward, or what other support options might be suitable.
Should you not wish to proceed with an appointment following this stage, then all information will be deleted at end of that calendar month. The only exclusion to this is if information has been shared during contact that raises concerns about risk to yourself or others, in which case we may be required to retain the information and break confidentiality. I am required to break confidentiality if I become aware of acts of terrorism, safeguarding issues, illegal activity, or misuse of vulnerable adults. You should therefore be cautious about sharing any information that may mean confidentiality may be broken.
Should we proceed to an appointment, with your consent (by you providing us with your email and agreeing for us to send this), we will send you a copy of the therapy contract. Should you consent to, you can return this by email to us prior to the first appointment. Please be aware that we do not currently use an encrypted email system (this is under review), so do not return the signed therapy contract by email if you have concerns about this. A paper copy can be signed at the first appointment as an alternative.
From the first appointment, we collect or use the following information to provide assessment and treatment:
• Name, address and contact details
• Date of birth
• Emergency contact and next of kin details including any support networks
• Health information – including previous and any current mental health treatment, previous and current physical health treatment (if relevant for treatment)
• Risk information – previous risk history (risk to self, risk to others, risk from others, risk to children) and current risk assessment
• Payment details (including card or bank information for transfers and direct debits)
• Insurance policy details
• Session notes
We collect or use the following information for safeguarding or public protection reasons:
• Name, address and contact details
• Date of birth
• Emergency contact and next of kin details including any support networks
• Health information – including previous and any current mental health treatment, previous and current physical health treatment (if relevant for treatment)
• Risk information – previous risk history (risk to self, risk to others, risk from others, risk to children) and current risk assessment
• Session notes
• Video recordings of public areas - at Fiveways Hub, for security purposes only, there is CCTV covering the entrances to the building. This video recording is kept for 28 days and then deleted unless there is a security issue that requires investigation.
We collect or use the following personal information for dealing with queries, complaints or claims:
• Name, address and contact details
• Payment details
• Account information
• Video recordings of public areas - at Fiveways Hub, for security purposes only, there is CCTV covering the entrances to the building. This video recording is kept for 28 days and then deleted unless there is a security issue that requires investigation.
• Health information – including previous and any current mental health treatment, previous and current physical health treatment (if relevant for treatment)
• Risk information – previous risk history (risk to self, risk to others, risk from others, risk to children) and current risk assessment
• Session notes
Lawful bases and data protection rights
Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.
Our lawful bases for the collection and use of your data:
Our lawful bases for holding and using information you have provided to contact you are:
Consent (you have contacted us and had this privacy notice information available to you); vital interest (if there is a concern about risk to yourself or risk to others); legal obligation.
Our lawful bases for collecting or using personal information to provide assessment and treatment are:
Contract (we have to collect or use the information so we can enter into or carry out a contract with you); legal obligation. All of your data protection rights may apply except the rights to object and erasure.
Our lawful bases for collecting or using personal information for safeguarding or public protection reasons are:
Contract; legal obligation. All of your data protection rights may apply except the rights to object and erasure.
Our lawful basis for collecting or using personal information for dealing with queries, complaints or claims are:
Contract; legal obligation. All of your data protection rights may apply except the rights to object and erasure.
Which lawful bases we rely on may affect your data protection rights, which are in brief set out below.
• Your right of access
• Your right to rectification
• Your right to erasure
• Your right to restriction of processing
• Your right to object to processing
• Your right to data portability
• Your right to withdraw consent
You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:
If you make a request, we must respond to you without undue delay and in any event within one month.
To make a data protection rights request, please contact us:
Sue Leahy
Happier Self CBT Ltd
Email: sleahy2023@gmail.com
Telephone: 07880 628002
Where we get personal information from
• You
• Your insurer if applicable
How long we keep information
When you contact us, we will collect your first name, email address and/or telephone number. If there is no further contact, then all of this information will be deleted at the end of that calendar month. If you have provided further information (this would be your choice) and a risk concern has been highlighted and a response has been required, this information will be retained for seven years (as required by BABCP, legal requirements and the insurer).
If you proceed with the initial 30 minute enquiry consultation call but do not proceed with further assessment and treatment, all information is deleted at the end of that calendar month, unless there has been a concern raised around risk in which case this information will be retained for seven years (as required by BABCP, legal requirements and the insurer).
If you proceed with appointments after the 30 minute enquiry consultation, then this information is kept in paper form, alongside all subsequent information, securely for seven years as required by BABCP, legal requirements and the insurer.
Who we share information with
Others we share personal information with
• Other health providers (eg GPs and consultants) at your request or if there is a safeguarding or risk concern
• Insurance companies, brokers and other intermediaries
• Emergency services if there is a safeguarding or risk concern
Duty of confidentiality
We are subject to a common law duty of confidentiality. However, there are circumstances where we will share relevant health and care information. These are where:
• you’ve provided us with your consent (we have taken it as implied to provide you with care, or you have given it explicitly for other uses);
• we have a legal requirement (including court orders) to collect, share or use the data;
• on a case-by-case basis, the public interest to collect, share and use the data overrides the public interest served by protecting the duty of confidentiality (for example sharing information with the police to support the detection or prevention of serious crime);
• If in England or Wales – the requirements of The Health Service (Control of Patient Information) Regulations 2002 are satisfied; or
• If in Scotland – we have the authority to share provided by the Chief Medical Officer for Scotland, the Chief Executive of NHS Scotland, the Public Benefit and Privacy Panel for Health and Social Care or other similar governance and scrutiny process.
Sharing of data
It will be part of our therapy contract that if there are concerns about current or increasing risk to yourself, then contact may be made with your emergency contact or GP or, in the event of immediate risk, the local crisis mental health team or 999. If there are concerns about immediate risk to others then referral/contact with appropriate services may be made.
As an accredited therapist, supervision is required to ensure best clinical practice. No information is shared that would enable a person to be identified, but the context of the difficulty and the treatment that is being provided is discussed. At times, we may request that a session be audio recorded (as part of accreditation it is recommended that supervisors listen to the therapist in session) - your consent would be requested and you would be under no obligation to consent to this. Any recording would be made within 7 days of supervision and would be deleted immediately after.
If you have been referred by a third party and/or your therapy is funded through an insurer or health care provider, we may have to give information about you but this is on the basis of you giving your consent.
How to complain
If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.
If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.
The ICO’s address:
Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF
Helpline number: 0303 123 1113
Website: https://www.ico.org.uk
We are registered with the ICO, Information Commissioner’s Office and follow their guidelines on compliance with the General Data Protection Regulation. If you have questions about any of the above or other aspects of confidentiality or data processing or want to know in more detail how we deal with information, please let us know.