Privacy Policy

Last updated: October 2026

This Privacy Policy explains how CRS Therapy collects, uses, stores and protects personal information when you visit crstherapy.com, make an enquiry or work with me as a counselling or psychotherapy client.

CRS Therapy is the private counselling and psychotherapy practice of Chris Sculthorp. For the purposes of UK data protection law, I am the data controller for the personal information I hold about you.

Information I may collect

Depending on how you interact with CRS Therapy, I may collect information including:

  • your name

  • email address

  • telephone number

  • information you provide through the website contact form, email, telephone or WhatsApp

  • appointment information

  • payment information

  • information relevant to providing counselling or psychotherapy

  • brief clinical notes relating to our therapeutic work

  • technical information generated when you use the website, such as cookie and analytics information

Because counselling and psychotherapy involve personal conversations, some of the information you choose to share may be classed as special-category personal data. This may include information about your physical or mental health, sexuality, sex life, relationships or other personal circumstances.

I encourage clients not to include unnecessary sensitive or clinical information in the website contact form, routine emails or bank-transfer references.

How I use your information

I may use personal information to:

  • respond to enquiries

  • arrange and manage appointments

  • provide counselling and psychotherapy

  • communicate with you about your sessions

  • maintain appropriate clinical records

  • receive and record payments

  • maintain financial records

  • meet professional, ethical, insurance and legal obligations

  • maintain the security and operation of the website

  • understand how the website is used through Squarespace analytics, where you have consented to optional analytics cookies

Email is primarily used for administrative communication, such as arranging, confirming or changing appointments.

I do not use your personal information for marketing emails or newsletters.

Lawful basis for using your information

Under UK data protection law, I must have a lawful basis for collecting and using personal information.

Depending on the purpose, I may rely on:

Contract – where processing is necessary to take steps at your request before entering into a therapy agreement, or to provide counselling or psychotherapy once we have agreed to work together.

Legal obligation – where I need to process or retain information to comply with legal requirements, including financial, accounting or tax obligations.

Legitimate interests – where processing is reasonably necessary for the administration, security and operation of my private practice, provided that these interests do not override your rights and freedoms.

Consent – where you are given a genuine choice about an optional use of your information, such as non-essential website cookies and analytics.

Counselling and psychotherapy may involve processing special-category personal data, including information relating to health, sexuality or sex life. Where this information is necessary for the provision of counselling or psychotherapy, I rely on the UK GDPR condition relating to the provision of health or social care, together with the relevant requirements of the Data Protection Act 2018.

I process this information only where it is necessary for the therapeutic work and in accordance with my professional duty of confidentiality.

How I collect information

Most personal information is provided directly by you when you:

  • complete the contact form on this website

  • contact me by email

  • contact me by telephone

  • contact me through WhatsApp

  • arrange an appointment

  • attend counselling or psychotherapy

  • provide information during the course of our therapeutic work

Some technical information may also be collected when you visit the website. More information about this can be found in the Cookie Policy.

Clinical records

I keep brief clinical records as part of safe and ethical practice.

Clinical notes are stored securely using Google Drive. They are kept deliberately brief, and identifying information is kept to a minimum wherever possible.

Clinical notes are intended to record information relevant to the therapeutic work rather than provide a detailed transcript of sessions.

Clinical records are normally retained for 7 years after therapy ends, in line with general UKCP best-practice guidance, unless there is a specific legal, insurance or professional reason to retain them for longer.

Once records are no longer required, they are securely deleted or destroyed.

Email and communication

Administrative email communication is handled using Gmail.

Email is primarily used for matters such as arranging or changing appointments. I encourage clients not to send detailed clinical information or unnecessary sensitive personal information by email.

You may also choose to contact me using WhatsApp, telephone or the website contact form.

Please be aware that communications sent through third-party services are also subject to the privacy and security arrangements of those providers.

Online therapy

Online counselling and psychotherapy sessions are provided using Doxy.me.

Doxy.me processes information necessary to provide its video communication service and operates under its own privacy and data-protection arrangements.

Online therapy sessions are not recorded.

Payments

Payment for sessions is made by bank transfer (BACS).

My bank may therefore process information associated with the payment, such as your name, account information, payment reference, amount and date of payment.

Financial records may be retained where required for accounting, tax or legal purposes.

Please do not include sensitive clinical information in your payment reference.

Professional supervision

Professional supervision is an important part of safe and ethical therapeutic practice.

Aspects of my clinical work may be discussed with my supervisor. Identifying information is kept to a minimum and, where a name is needed, only a client’s first name is normally used.

Supervision is conducted within professional confidentiality requirements.

Confidentiality and sharing information

Your personal information is not sold to third parties.

Information is only shared where it is necessary and appropriate. This may include:

  • professional supervision

  • service providers used to operate the practice

  • situations where disclosure is required by law

  • circumstances involving serious concerns about safety or safeguarding

The limits of confidentiality are also explained as part of the therapy agreement when we begin working together.

Third-party services

The following third-party services may process limited personal information in connection with CRS Therapy:

  • Squarespace – website hosting, website functionality and website analytics

  • Google / Gmail – administrative email communication

  • Google Drive – secure storage of clinical records

  • Doxy.me – online video sessions

  • WhatsApp – where you choose to communicate with me using WhatsApp

  • my bank – receiving and recording payments made by bank transfer

These organisations operate under their own privacy and data-protection arrangements.

Where personal data is processed or stored outside the UK, the relevant provider is responsible for implementing appropriate safeguards for international data transfers where required.

Website analytics and cookies

This website uses Squarespace Analytics to help me understand how the website is used.

Where analytics require non-essential cookies, they will only be used where you have chosen to accept them through the cookie banner.

I do not currently use third-party advertising, behavioural advertising or retargeting tools on this website.

More information is available in the Cookie Policy.

How I protect your information

I take reasonable steps to protect the personal information I hold and to restrict access to it.

Clinical records are kept brief and identifying information is minimised wherever practicable.

Personal information is only retained for as long as it is necessary for the purpose for which it was collected, taking account of professional, insurance, tax and legal requirements.

Your rights

Under UK data protection law, you may have the right to:

  • ask for access to personal information I hold about you

  • ask for inaccurate information to be corrected

  • ask for information to be deleted in certain circumstances

  • ask for the use of your information to be restricted in certain circumstances

  • object to certain uses of your information

  • withdraw consent where processing is based on consent

  • ask to receive certain personal information in a portable format where the law provides this right

These rights are subject to certain legal and professional limitations.

If you would like to exercise one of these rights, please contact me using the details below.

Complaints

If you have concerns about how your personal information has been handled, I would encourage you to contact me first so that I have an opportunity to address the issue.

You also have the right to raise a concern with the Information Commissioner’s Office (ICO), the UK regulator responsible for data protection.

Changes to this Privacy Policy

This Privacy Policy may be updated from time to time to reflect changes to my practice, the website, professional guidance or data-protection requirements.

The date at the top of this page will be updated when material changes are made.