Privacy notice

Your privacy matters.

Psychotherapy involves trusting another person with information that may be deeply personal. This notice explains what information I collect, why I need it, how I protect it and the rights you have in relation to it.

I have written it as clearly as possible so that it is accessible to both adults and young people. If anything is unclear, you are always welcome to ask me.

Last updated: August 2026

Who is Magenta Owl?

Magenta Owl is the name under which I offer psychotherapy and related services.

I am Lianne Crofts, a BACP-registered Psychotherapist and the data controller for the personal information collected through my practice. This means that I am responsible for deciding why and how your information is used, and for keeping it appropriately protected.

BACP membership number: 00813540
BACP Register number: 379409
Email: magentaowlsolutions@gmail.com

I am registered with the Information Commissioner’s Office (ICO), and my registration is current.

How and Where I Work

Psychotherapy sessions are available in person, online or by telephone, according to individual preference.

In-person sessions take place at:

St John’s Therapy Centre
9–11 New Road
Bromsgrove
B60 2JG

This is my session location only. Please do not send correspondence to this address, as it may not reach me reliably. If you need to contact me about your personal information, please email magentaowlsolutions@gmail.com.

Why I Collect Personal Information

To offer psychotherapy safely and responsibly, I need to hold a small amount of information about the people I work with.

I collect only what I genuinely need. I do not sell your information, use what you share in therapy for advertising or keep personal details simply because they might prove useful one day.

I may use your information to:

• respond to an enquiry about psychotherapy

• help us decide whether I am the right therapist for your needs

• arrange and provide your sessions

• contact you about appointments

• receive and record payments

• provide safe, ethical and professionally accountable care

• respond appropriately if I become seriously concerned about your safety or somebody else’s safety

• meet my legal, insurance and professional responsibilities

• respond to a complaint, dispute or legal claim if this is ever necessary.

What information might I hold?

The information I need will vary depending upon whether you are making an initial enquiry or we are working together therapeutically.

It may include:

• your name, date of birth and contact details

• information included in an enquiry or contact form

• appointment and attendance information

• payment and transaction details

• your GP’s contact details

• the name and contact details of your chosen emergency contact or next of kin

• information about your physical or emotional health, personal history, relationships and current circumstances

• information relating to safety, safeguarding or your support needs

• brief, coded notes written after therapy sessions

• relevant email, telephone or WhatsApp communications

• information provided by a parent, carer, GP or another professional, where this is appropriate and lawful.

Some of the things discussed in psychotherapy are especially sensitive. Information about health, neurodivergence, ethnicity, religious or philosophical beliefs, sexuality and certain other personal matters is given additional protection under data-protection law. This is known as “special-category data”, and I treat it with particular care.

My lawful reasons for using your information

Data-protection law requires me to have a valid reason for collecting and using personal information. The reason may differ according to what the information is and why I need it.

The lawful reasons I may rely upon are:

• Contract — to respond when you ask about psychotherapy and to provide the service we agree upon

• Legal obligation — where I need to use or retain information to comply with the law

• Legitimate interests — to administer my practice, maintain appropriate professional records, receive clinical supervision and protect my clients, my practice and my legal rights

• Vital interests — in a rare emergency where using or sharing information is necessary to protect someone’s life and they are unable to give consent.

Particularly sensitive information

Information about physical or emotional health and certain other particularly sensitive matters receives additional protection under the UK GDPR. I primarily use this information because it is necessary for the provision of health or social care or treatment. In exceptional circumstances, it may also be used to protect someone’s vital interests or to establish, exercise or defend a legal claim.

Where consent is the most appropriate lawful basis for a particular use or disclosure, I will ask for it. If the use of your information depends upon your consent, you may withdraw that consent at any time. This will not affect anything that has already been processed lawfully.

How I protect your therapy notes

I write brief notes after each therapy session. These help me to work safely, responsibly and with appropriate continuity from one session to the next.

Whether we meet in person, online or by telephone, your sessions are not audio-recorded or video-recorded.

My therapy notes:

• are handwritten

• use a client code rather than your name

• do not contain identifying details

• are stored securely in a locked file

• are kept separately from the information that identifies you

I use a paper diary to manage appointments and take care not to include unnecessary information about the nature of your sessions.

Email, telephone and online sessions

I use Gmail for practice emails and may use Google Meet or WhatsApp for online communication and therapy sessions.

I take reasonable care when using these services, but no ordinary email, messaging or online communication system can be guaranteed to be completely secure. For this reason, please avoid including highly sensitive information in an email or WhatsApp message unless it is necessary.

WhatsApp processes information such as your telephone number and communication metadata. You do not have to communicate with me through WhatsApp. You are welcome to choose email or telephone contact instead.

I do not record Google Meet, WhatsApp or telephone sessions. I also ask that clients do not record therapy sessions without prior discussion and agreement.

Google, WhatsApp and other technology providers may process or store some information outside the UK. Where this happens, their data-protection terms and recognised safeguards for international transfers apply.

When you contact me through this website

This website is provided through Webador. If you use the website contact form, Webador processes the information you enter and sends your message to my practice email account. Please include only the information I need in order to understand and respond to your enquiry.

Sending an enquiry does not, by itself, create a therapist-client relationship.

Webador may also process technical information needed to operate and protect the website, such as your IP address, device information and cookie data.

Where the website offers cookie choices, you can use those controls to decide whether optional cookies are used.

Payments

Fee payment is required by bank transfer at least 24 hours prior to a session.

My bank will process the information attached to the transfer, which may include your name, payment reference, account details and transaction information. I do not receive your full banking credentials. I retain the financial records needed to manage my accounts and meet my tax and legal responsibilities.

Confidentiality and sharing information

Whatever you share with me in psychotherapy is treated as a confidential matter, with a few rare and specific exceptions. I will not normally share identifiable information about you without your knowledge and agreement.

Confidentiality is very important, but it cannot be absolute. There are a small number of circumstances in which I may need to disclose important information, if doing so protects someone vulnerable or is required by law.

These circumstances may include:

• when I believe there is a serious and immediate risk of harm to you or another person

• when there is a safeguarding concern involving a child or an adult at risk

• when you ask me to share information with your GP or another professional

• when disclosure is required by law or ordered by a court

• when information is needed to establish, exercise or defend a legal claim

• when disclosure is otherwise necessary to meet a specific legal or professional obligation.

Wherever it is safe and appropriate to do so, I will try to discuss the situation with you before sharing information.

I will disclose only what is relevant and necessary. Depending upon the circumstances, this might involve your GP, nominated emergency contact, emergency services, safeguarding services, another healthcare professional, my insurer, a legal adviser or a relevant professional body.

Clinical supervision

Like other ethical psychotherapists, I receive regular clinical supervision. This gives me a confidential space in which to reflect upon my work, consider different perspectives and ensure that I continue to support my clients safely, thoughtfully and responsibly.

I may discuss aspects of our therapeutic work with my supervisor, but I avoid using names or identifying details wherever possible. My supervisor is also bound by professional confidentiality and does not have access to my client records.

Supervision is not about judging or scrutinising clients. It is one of the ways I remain accountable for the quality and safety of the care I provide.

Privacy for young people aged 13 to 17

Young people have privacy and data-protection rights of their own. If you are a young person coming to therapy, I will explain confidentiality and its limits in language that makes sense to you. You are welcome to ask questions at any time, and I will not expect you to understand complicated legal language.

I will not routinely tell a parent or carer what you have discussed in therapy. Information will normally be shared with a parent, carer or another person only with your knowledge and agreement. However, I may need to share relevant information if I believe that you or somebody else is at serious risk, if there is a safeguarding concern or if the law requires me to do so.

Wherever it is possible and safe, I will carefully explain what I am worried about, what information may need to be shared and who I may need to contact before I take any action.

A parent or carer may provide contact, payment or background information, but this does not give them an automatic right to know everything discussed in therapy or to receive every specific record relating to the young person. Any request for information will be considered carefully; taking account of the young person’s understanding, wishes, wellbeing, privacy rights and the law.

My aim is to create a space in which young people can speak honestly and feel respected, while responding responsibly if I become concerned that somebody may not be safe.

GP and emergency-contact details

I ask clients to provide the contact details of their GP and a nominated emergency contact or next of kin. I collect this information so that I can respond responsibly if a serious emergency arises or if I become concerned that somebody may be at immediate risk.

I will not routinely contact your GP, emergency contact or next of kin, and I will not automatically tell them that you are receiving psychotherapy. Wherever it is possible and safe, I will discuss the situation with you before making contact. I will share only the information that is relevant and necessary.

Please make sure that your nominated emergency contact knows that you have given me their name and contact details. You are also responsible for letting me know if your GP or emergency-contact information changes.

How long I keep your information

I keep personal information only for as long as there is a clear and justifiable reason to retain it.

• Enquiries that do not lead to therapy sessions taking place are normally deleted within six months of our final contact, unless there is a specific reason to retain them for longer

• Adult client records are retained for seven years from the date when therapy ends

• Records pertaining to clients who are under 18 when therapy ends are normally filed and saved until their 25th birthday (or their 26th birthday if therapy ends when they are 17)

• Financial and tax records are retained for the period required by tax and accounting law

• Information connected with a complaint, safeguarding matter or legal claim may be retained for longer than the periods outlined, where this is necessary and lawful.

At the end of the appropriate retention period, paper records are destroyed securely and confidentially, and electronic information is securely deleted. I review these decisions periodically and may update them if professional, insurance or legal requirements change.

Your data-protection rights

Data-protection law gives you rights over your personal information. These rights belong to young people as well as adults. Depending upon the circumstances and the lawful reason for using your information, you may have the right to:

• ask whether I hold personal information about you

• request a copy of your personal information

• ask me to correct details which are inaccurate or incomplete

• ask for information to be erased or deleted

• ask me to restrict how your information is used

• object to a particular use of your personal data

• receive certain electronically-held information in a portable format

• withdraw consent (where the use of your information depends upon consent).

These rights are important, but they are not absolute. For example, I may need to retain certain information to meet a legal obligation, protect another person’s rights or respond to a legal claim. Therapy records may also contain information affecting another person’s privacy, or information to which a legal exemption applies. If this limits what I can share, change or erase, I will explain my decision.

There is normally no charge for exercising your data-protection rights. However, I may charge a reasonable fee where a request is manifestly unfounded or excessive, or where additional copies of information are requested. I may ask for appropriate confirmation of your identity before releasing sensitive personal information and will usually respond within one month.

To make a request, please email magentaowlsolutions@gmail.com.

Questions or concerns

If you have a question or concern about how I collect, use, store or share your personal information, please contact me at magentaowlsolutions@gmail.com.

I will take your concern seriously and respond as promptly as I can. You also have the right to raise a concern with the Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: www.ico.org.uk

Changes to this notice

I may update this Privacy Notice if my practice, professional requirements or data-protection law changes. The current version will always appear on this website with the date of its latest update.