PRIVACY NOTICE
Last updated: 11 August 2026
This Privacy Notice explains how I collect, use, store and protect personal information when you visit this website, make an enquiry, book an appointment, participate in psychological work or contribute to WePainT.
WHO IS RESPONSIBLE FOR YOUR INFORMATION
The data controller is:
Anastasia Stavrou
Trading as Anastasia Stavrou Psychology
Email: ans.art.therapy@gmail.com
As the data controller, I am responsible for deciding how and why your personal information is processed.
WHO THIS NOTICE APPLIES TO
This notice applies to:
• visitors to this website;
• people making an enquiry;
• prospective, current and former clients;
• people booking an initial consultation;
• participants in arts-based workshops;
• people contributing to the development of WePainT.
My psychological services are intended for adults.
INFORMATION I MAY COLLECT
Depending on how you interact with me, I may collect:
Contact and identity information
This may include your name, email address, telephone number, preferred language and other contact details.
Enquiry and booking information
This may include the reason for your enquiry, availability, appointment details, communication preferences and information you choose to provide before an initial consultation.
Clinical and special-category information
Psychological work may involve information about your:
• physical or mental health;
• emotional experiences;
• relationships and personal history;
• identity, sexuality, culture or beliefs;
• medication, diagnoses or previous support;
• safety, risk or safeguarding circumstances.
This may also include written, visual or arts-based material you choose to share during the work.
Session and professional records
I may keep brief notes necessary to support continuity, reflect the work undertaken, manage risk and meet professional, legal or insurance requirements.
Sessions are not routinely recorded. Any recording would require a specific purpose and your explicit agreement in advance.
Payment and administrative information
This may include payment status, invoices, transaction references and information required for accounting or tax purposes. I do not normally receive or store complete payment-card details.
Website and technical information
When you visit the website, technical information may be processed automatically. This can include an IP address, browser or device information, security logs, cookie choices and interactions with forms or embedded services.
More information is provided in the Cookie Policy.
WePainT information
If you complete the WePainT development survey, I may collect the responses you choose to provide. The survey is intended to inform the development of WePainT.
You do not need to provide your name or contact details unless you choose an optional contact route. Information submitted through the survey is not treated as a clinical record unless it is separately provided within a therapeutic context.
HOW I RECEIVE INFORMATION
Most information is provided directly by you when you:
• complete the Contact form;
• send an email;
• arrange an appointment;
• use Calendly or ItsComplicated;
• participate in an initial consultation or session;
• make a payment;
• complete a Google Form or WePainT survey;
• attend a workshop.
In limited circumstances, information may be received from another person or organisation, such as a referrer, healthcare professional, emergency contact or platform provider. I will only use information obtained from another source when there is a legitimate and relevant reason to do so.
WHY I USE PERSONAL INFORMATION
I may use personal information to:
• respond to enquiries;
• arrange consultations, sessions or workshops;
• assess whether my services are appropriate for your needs;
• provide psychological services;
• maintain appropriate professional records;
• communicate about appointments and practical arrangements;
• receive and record payments;
• meet accounting, tax, insurance and legal requirements;
• support professional supervision and reflective practice;
• manage safeguarding concerns or serious risks to safety;
• protect the website and prevent misuse;
• respond to complaints or legal claims;
• develop WePainT using survey responses and feedback.
LAWFUL BASES FOR PROCESSING
Depending on the circumstances, I rely on one or more of the following lawful bases:
Contract
Processing may be necessary to take steps at your request before entering into an agreement or to provide a service you have arranged.
Legal obligation
Some information must be processed or retained to meet legal, tax, accounting, safeguarding or regulatory responsibilities.
Legitimate interests
I may process information where it is reasonably necessary to operate and protect my practice, respond to enquiries, maintain appropriate records, receive professional advice, ensure website security or establish and defend legal claims.
These interests are considered alongside your rights and reasonable expectations.
Consent
I may rely on consent where you have a genuine choice, including for optional cookies, voluntary survey follow-up, a specific recording or another optional use of information.
You may withdraw consent at any time. Withdrawal does not affect processing that took place lawfully before consent was withdrawn.
Vital interests
In an exceptional emergency, information may be processed or shared where necessary to protect your life or the life of another person.
SPECIAL-CATEGORY INFORMATION
Information concerning health, sexuality, racial or ethnic background, religious or philosophical beliefs and certain other matters receives additional legal protection.
Where special-category information is necessary for psychological services, I process it under the condition applicable to the provision of health or care services subject to professional confidentiality.
Where appropriate, I may instead rely on explicit consent, vital interests or the establishment, exercise or defence of legal claims.
CONFIDENTIALITY AND PROFESSIONAL SUPERVISION
Information shared during psychological work is treated as confidential.
I may discuss aspects of my work in professional supervision. This supports safe and ethical practice. Identifying information is removed or minimised wherever reasonably possible, and supervisors are subject to professional confidentiality.
Confidentiality may be limited where:
• there is a serious and immediate concern about someone’s safety;
• a child or vulnerable adult may be at risk;
• disclosure is required by law or court order;
• information is necessary for the establishment or defence of a legal claim;
• you have asked me to share information and it is appropriate to do so.
Where possible and safe, I would normally aim to discuss a proposed disclosure with you first.
WHO MAY PROCESS OR RECEIVE INFORMATION
Depending on the service used, information may be processed through:
• ItsComplicated;
• Calendly;
• Zoom;
• Google services, including email, Forms and Sheets;
• WordPress, WPForms and website-hosting or security services;
• payment or practice-management providers;
• email-delivery and technical-support services.
Information may also be shared, where necessary, with:
• a professional supervisor;
• an accountant, insurer, solicitor or other professional adviser;
• a regulator, court or public authority;
• emergency services, a healthcare professional or another appropriate person where there is a serious safety concern.
Service providers should only process information for the agreed purpose and in accordance with applicable data-protection requirements.
I do not sell personal information.
INTERNATIONAL DATA TRANSFERS
Some service providers may process information outside the United Kingdom or European Economic Area.
Where this occurs, I take reasonable steps to ensure that an appropriate transfer mechanism is used, such as:
• a recognised adequacy decision;
• approved standard contractual clauses;
• the UK International Data Transfer Agreement or UK Addendum;
• another legally permitted safeguard.
The privacy information of each provider contains further details about its processing locations and safeguards.
HOW LONG INFORMATION IS KEPT
I keep personal information only for as long as it is reasonably required for the purpose for which it was collected and for relevant legal, professional and insurance requirements.
My usual retention periods are:
Enquiries that do not proceed
Normally up to 12 months after the last substantive contact.
Clinical and session records
Normally seven years after the psychological work ends. Information may be kept longer where this is required by law, insurance conditions, safeguarding circumstances or an ongoing complaint or legal claim.
Financial and accounting information
Normally up to six years, in accordance with applicable tax and accounting requirements.
WePainT survey responses
Normally for up to two years after submission, unless the information is anonymised earlier or continued retention is reasonably necessary for the project’s development.
Website and security information
For only as long as necessary to operate and protect the website, investigate technical problems or comply with provider and legal requirements.
Information that is no longer required will be securely deleted or anonymised.
HOW INFORMATION IS PROTECTED
I use reasonable technical and organisational measures to protect personal information. These may include:
• password-protected accounts and devices;
• access controls;
• secure and reputable service providers;
• encrypted connections where available;
• data minimisation;
• confidentiality procedures;
• secure deletion or anonymisation.
Access is limited to people who have a legitimate reason to use the information.
No internet-based service can guarantee absolute security. You should avoid sending highly sensitive or urgent information through an ordinary website contact form.
YOUR DATA-PROTECTION RIGHTS
Depending on the circumstances and the lawful basis used, you may have the right to:
• request a copy of your personal information;
• ask for inaccurate information to be corrected;
• ask for information to be deleted;
• request that processing be restricted;
• object to certain processing;
• receive information in a portable format;
• withdraw consent where processing relies on consent;
• complain to a data-protection authority.
These rights are not absolute. For example, some information may need to be retained because of legal, safeguarding, professional or insurance requirements, or because it also contains information about another person.
To exercise a right, contact:
I may need to confirm your identity before responding. Requests will normally be answered within one month, although the law allows additional time in certain circumstances.
AUTOMATED DECISION-MAKING
I do not use personal information to make decisions through solely automated processing or profiling that produces legal or similarly significant effects.
COMPLAINTS
If you have a concern about how your information has been handled, please contact me first so that I can try to address it.
You may also complain to the Information Commissioner’s Office:
Website: ico.org.uk/make-a-complaint
Telephone: 0303 123 1113
If you are located in the European Economic Area, you may also have the right to contact the data-protection authority in your country.
CHANGES TO THIS NOTICE
This notice may be updated when my services, legal obligations or service providers change.
The date at the beginning of the notice shows when it was last revised.
CONTACT
Questions about this Privacy Notice or the use of personal information may be sent to:
Anastasia Stavrou
Email: ans.art.therapy@gmail.com