Privacy Policy

1. Data Controller Contact Information

The Data Controller is Charlie Nagy. You can contact us at info@safespacestherapy.online or the practice address for any questions or concerns regarding your personal data.

2. Personal Information We Collect

When you visit Safe Spaces Therapy Online, we may collect information in the following ways:

Automatically Collected Information

• Your web browser, IP address, and time zone.
• Details about how you interact with our website, including pages viewed and referral sources.
• Cookies and other tracking technologies to enhance your experience. For more information, please refer to our Cookies Policy.

Information Provided During Registration or Sessions

• Name, contact details (email, phone number, address or What3Words location).
• GP name and surgery (where appropriate).
• Emergency contact details.
• Information shared during referral, assessment, or therapy sessions.
• Payment or invoice information.

3. How We Use and Store Your Information

• Encrypted USB Drive (offline): Client identifying information (contact form, GP info, consent) stored securely, partitioned by current/archive.
• Proton Drive (online): Clinical notes, wellbeing forms, and session-related materials stored under ciphered reference codes (non-identifiable).
• ProtonMail: All communications encrypted end-to-end and deleted routinely.
• Proton Contacts: Only used for active clients and stored securely.
• Time-Limited Retention: Records are retained for 5 years in line with insurance/legal guidance and then securely deleted.

4. Why We Process Your Data

We process your personal data for the following reasons:

• To provide therapy services and fulfil contractual obligations.
• To communicate with you, including arranging, confirming, or adjusting appointments.
• To maintain accurate records for statistical and administrative purposes.
• To ensure compliance with legal and ethical standards, including safeguarding and confidentiality.

5. Confidentiality

Confidentiality is central to our practice. All therapy sessions are conducted in confidence, and session notes are recorded without using client names. Confidentiality is maintained in line with GDPR, except in the following circumstances:

• Consent is given to share information.
• Risk of serious harm to you/others is identified.
• Legal obligation (e.g., court order, safeguarding, terrorism, fraud).

No information is sold or shared for marketing purposes.

6. Your Rights

If you are a European resident, you have the following rights under GDPR:

• The right to be informed.
• The right of access to your data.
• The right to rectification of inaccurate information.
• The right to erasure (in certain circumstances).
• The right to restrict processing.
• The right to data portability.
• The right to object to data processing.
• Rights in relation to automated decision-making and profiling.

If you wish to exercise any of these rights, please contact us at info@safespacetherapy.online. We will respond to your request within one calendar month.

7. Controlling Your Personal Information

We take privacy seriously and use a layered model to safeguard sensitive information:

• Air-gapped encrypted storage: Identifiable data (e.g., contact forms, GP info) is stored offline on a USB drive with encryption and secure partitioning.
• End-to-end encrypted platforms: Client communication and clinical material are stored and shared via Proton services (Mail, Drive, Calendar).
• Account-level protection: All devices and accounts use two-factor authentication, password managers, and restricted access protocols.

While no system is completely invulnerable, Safe Spaces Therapy Online implements robust and reasonable measures in line with current best practice.

8. Controlling Your Personal Information

• You may withdraw consent for the use of your information for professional development or marketing purposes at any time by contacting us.
• We will not sell, distribute, or lease your personal information to third parties without your permission unless required by law.

9. Information Security

We implement reasonable administrative, technical, and physical safeguards to protect your personal data from unauthorized access, use, or disclosure. However, no data transmission over the internet can be guaranteed to be entirely secure.

For clients using ProtonMail, Proton Drive, and Proton Calendar, we rely on their end-to-end encrypted infrastructure. You can learn more in the Proton Privacy Policy

10. Legal Disclosure

We may disclose information if required by law or in good faith that such action is necessary to comply with legal obligations, protect your safety or the safety of others, or investigate fraud.

11. Use of Cookies

Our website uses cookies to personalize your experience and collect statistical information. You can review our Cookies Policy for details on the types of cookies used and how to manage your preferences.

12. Links to Other Websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of these external sites. We encourage you to review the privacy policies of each site you visit.

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically. Any changes will be communicated to you via email or through the website. Continued use of the website signifies your acceptance of any changes.

Contact Us

For further information or to exercise your data rights, please contact us at: