Privacy Policy Last updated: 30.04.2026
- How will my data be stored and used?
- This Privacy Policy explains how Sharon Mortimer (“the Practitioner”) collects, uses, stores, and protects your personal data in accordance with the Data (Use and Access) Act 2025 (DUAA), Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR).
- By using our website (www.believeachive.uk) or services, you agree to the terms of this policy.
- The Practitioner is registered with the Information Commissioner’s Office (ICO) and acts as the data controller for your personal data. ICO Registration Number: ZA754113
- Information We Collect
Your data is collected to provide safe, appropriate, and effective therapeutic care.
- Personal data (e.g. name, address, contact details, payment and booking details)
- Special category data (e.g. Medical and psychological information, lifestyle information relevant to your treatment, session notes and therapeutic records.
- Communication data (e.g. emails, text messages, appointment records)
Your data is processed in a lawful, fair, and transparent manner for the purpose of delivering safe, ethical, and effective therapeutic services. This information is treated with strict confidentiality and a higher level of protection.
Children’s Data Where services are provided to individuals under 18:
- Additional care is taken to protect their data
- Appropriate parental or guardian consent is obtained
Information may be discussed within professional supervision to ensure safe and effective practice. In such cases:
- no identifying details are disclosed
- supervisors are bound by confidentiality and data protection obligations
- Limits to confidentiality Confidentiality may be breached where there is a legal or ethical obligation, including:
- risk of serious harm to yourself or others
- safeguarding concerns involving children or vulnerable adults
- compliance with legal requirements (e.g. court orders)
Where possible, this will be discussed with you in advance.
What if I see the Practitioner outside of a session? Your confidentiality will be maintained in all settings. The Practitioner will not initiate contact in public. If you acknowledge the Practitioner first, a polite response may be given, but therapy-related discussion will not take place outside a formal session.
- How Your Data Is Collected
We collect data through:
- Website forms and booking systems
- Email, phone, and direct communication
- Initial consultations and ongoing sessions
- Newsletter subscriptions
- How We Use Your Data
We use your data to:
- Provide safe and effective therapy services
- Maintain accurate client records
- Manage bookings and payments
- Communicate with you
- Meet legal, ethical, and insurance obligations
We do not sell or share your data for marketing purposes.
- Lawful bases for processing
Under UK GDPR and DUAA, the lawful bases relied upon include:
- Contract – to provide agreed therapeutic services
- Legitimate interests – to manage and improve services, records, and safety
- Legal obligation – to comply with regulatory, insurance, and safeguarding duties
- Vital interests – where necessary to protect life or prevent serious harm
- Explicit consent – for processing special category (health-related) data
- Website Usage Data
We collect usage data via web, which may include:
- IP address, browser type, and device information
- Pages visited and navigation paths
- Date, time, and frequency of visits
This data is used to:
- Improve website performance
- Maintain security
- Understand how visitors use the site
This processing is based on consent and legitimate interests.
- Enquiries and Communication
When you contact us, we may store:
- Your contact details
- The content of your message
- Communication history
This is used to:
- Respond to enquiries
- Maintain client relationships
- Keep accurate records
- Payments and Transactions
Payments are processed via Bank Transfer or SumUp
We only share data necessary to:
- Process payments
- Issue refunds
- Handle payment queries
Banks & SumUp processes your data according to their own privacy policies.
- Data Sharing
We may share your data only when necessary:
- With service providers (e.g. Wix)
- Where required by law
- In safeguarding situations
- For professional supervision (anonymised where possible)
- How long will you hold my information for?
Client records are retained in accordance with professional, insurance, and legal requirements:
- Adults: 7 years after the final session
- Children and young people: Will be kept for 20 years after the last contact or until age 25 (or 26 if treated at 17).
Records are securely destroyed in the January following the applicable retention period.
Retention periods reflect recognised health and social care standards and may be extended where required for legal claims, complaints, or safeguarding matters.
- What if I would like my data to be destroyed before this date?
You have the right to request erasure of your personal data under the Data (Use and Access) Act 2025 and UK GDPR, where applicable.
Requests must be made in writing. Upon verification of identity, the Practitioner will:
- securely destroy paper records
- permanently delete electronic records
This service is provided free of charge.
Please note:
The right to erasure is not absolute. Data may be retained where required for:
- legal obligations
- insurance purposes
- establishment, exercise, or defence of legal claims
- safeguarding responsibilities
A minimal record of the erasure request will be retained to demonstrate compliance.
- Your Data Protection Rights
You have the right to:
- Access your personal data
- Correct inaccurate data
- Restrict or object to processing
- Data portability
- Withdraw consent at any time
To exercise your rights, contact: b_a1900@hotmail.com
- Subject Access Requests (SARs)
If you request access to your data:
- We will respond within one month
- Searches will be reasonable and proportionate, in line with current legislation
- Complaints Procedure (DUAA Requirement)
If you are unhappy with how your data is handled, you can make a complaint.
How to complain
Email: b_a1900@hotmail.com
- Your complaint will be acknowledged within 30 days
- We will respond without undue delay
If you are not satisfied, you may contact the Information Commissioner’s Office (ICO):
https://www.ico.org.uk
- Cookies and Website Tracking
Our website may use cookies for:
- Functionality
- Basic analytics
Where used:
- You will be informed
- You can manage your preferences
- Automated Decision-Making
We do not use automated decision-making or profiling in relation to your care.
- Links to Other Websites
Our website may contain links to third-party sites.
We are not responsible for their privacy practices.
- Policy Updates
We may update this policy periodically.
The latest version will always be available on our website.
