Privacy Policy for Remote Therapy Space

1. Introduction

Remote Therapy Space is a psychological therapy practice specialising in support for individuals with physical health conditions and trauma. This privacy policy explains how I collect, use, and protect your personal information.

I am the data controller for your personal data (ICO Registration Number: ZB619438). The practice is owned and operated by Chris Hutchins-Joss, an accredited CBT therapist accredited with the BABCP.

2. Contact Details

Data Controller: Chris Hutchins-Joss
Email: info@remotetherapy.space
Website: www.remotetherapy.space

If you have questions about this policy or how I handle your information, please contact me directly.

3. Types of Data I Collect

3.1 Enquiry and Administrative Data

• Basic contact details (name, email, phone)
• Information you provide when enquiring about my services
• Communication records between us

3.2 Clinical Data

• Information gathered during assessment and therapy sessions
• Health information relevant to your therapy
• Session notes and therapeutic records

3.3 Technical Data

• IP address and browser information
• Website usage data through cookies
• Information about how you interact with my website

4. How I Use Your Data

4.1 Enquiry and Administrative Data

• To respond to your enquiries
• To manage our therapeutic relationship
• To schedule appointments and process payments
• To provide you with information about my services

4.2 Clinical Data

• To deliver appropriate and effective therapy
• To maintain accurate clinical records as required by professional standards
• To monitor progress and adapt treatment as necessary

4.3 Technical Data

• To improve my website functionality
• To analyse user behaviour and optimise my online presence
• To ensure the security of my digital services

5. Legal Basis for Processing

I process your data under the following legal bases:

5.1 Contract

When you engage my services, I process your data to fulfil our therapeutic contract.

5.2 Legitimate Interests

I process certain data based on my legitimate interests in providing effective therapy services and running my practice efficiently.

5.3 Legal Obligation

I process data to comply with legal requirements including professional record-keeping standards.

5.4 Consent

Where required by law, I will obtain your explicit consent before processing your data.

5.5 Special Category Data

As a healthcare provider, I process special category data (including health information) under Article 9(2)(h) of GDPR for the provision of healthcare services.

6. Data Sharing

I treat all client information with the utmost confidentiality. I may share your data with:

• My professional supervisor (anonymised)
• Administrative service providers (e.g., secure booking systems)
• Legal and regulatory authorities when required by law

I will never sell your data or share it for marketing purposes.

7. Newsletter and Interactive Tools

My website offers a free email newsletter (“Beyond Symptoms”) and free interactive self-reflection tools, such as the values card sort and the flare plan tool. These tools run entirely in your browser: nothing you enter is sent to me unless you choose to have your results emailed to you.

• If you choose email delivery, the answers you selected are stored together with your email address by my email provider, MailerLite (an EU-based, GDPR-compliant company), solely so your results email can be sent to you and, if you confirm the subscription, so you can receive the newsletter.
• This processing is based on your consent. You can withdraw it at any time by unsubscribing or emailing me, and your details and tool entries will be deleted.
• Tool entries are never used for any other purpose and are never part of any therapy record.
• Printing or downloading your results from a tool requires no email address and sends nothing anywhere.
• Some tools save your in-progress answers in your own browser’s local storage so you can carry on later. This stays on your device and is not transmitted.

8. Data Security

I implement robust security measures to protect your personal data, including:

• End-to-end encryption for all digital communications
• Secure, GDPR-compliant therapy platforms
• Password-protected and encrypted storage systems
• Regular security reviews and updates

9. Data Retention

I retain different types of data for specific periods:

• Clinical records: 7 years from the end of treatment (as recommended by professional bodies)
• Enquiry data (where no treatment proceeds): 2 years
• Financial records: 7 years (as required by HMRC)
• Newsletter and interactive-tool data: until you unsubscribe or ask for it to be deleted

10. Your Rights

Under GDPR, you have rights regarding your personal data, including:

• Access to your data
• Correction of inaccurate data
• Erasure of data (subject to clinical and legal requirements)
• Restriction of processing
• Data portability
• Objection to processing

To exercise these rights, please contact info@remotetherapy.space.

11. Clinical Confidentiality

Confidentiality is fundamental to the therapeutic relationship. I maintain strict confidentiality in line with professional ethical standards. The limited circumstances where confidentiality might need to be broken include:

• Risk of serious harm to yourself or others
• Safeguarding concerns
• Legal requirements, such as court orders
• With your explicit consent

12. Online Therapy

Remote Therapy Space delivers therapy exclusively online. To ensure your privacy and security:

• I use professional healthcare-compliant video platforms with high-level encryption
• I recommend you connect from a private location where conversations cannot be overheard
• I advise using a secure, private internet connection rather than public Wi-Fi
• Technical information from sessions (such as connection data) is minimised and securely stored
• In case of technical failures, I establish backup contact methods before each session

13. Session Recordings

My standard practice is that therapy sessions are not recorded. However, occasionally recordings may be beneficial for specific purposes:

• Recordings are only ever made with your explicit consent
• The specific purpose of any recording (e.g., clinical supervision, training) will be clearly explained
• You can withdraw consent for recording at any time
• Recordings are stored securely with encryption and access controls
• Once the specific purpose has been fulfilled, recordings are permanently deleted

I will never use recordings for purposes other than those explicitly agreed with you.

14. Cookies

My website uses cookies to enhance your experience. You can adjust your cookie settings through your browser. Disabling cookies may impact website functionality.

15. Changes to This Policy

I may update this policy periodically. Significant changes will be communicated to you directly where possible.

16. Complaints

If you have concerns about how I handle your data, please contact me directly. You also have the right to complain to the Information Commissioner’s Office (ICO): www.ico.org.uk.

Last updated: 5 July 2026