Privacy

Body and Mind Therapy: Privacy Policy

This policy explains how Body and Mind Therapy handles personal information — whether you are visiting this website, making an enquiry, or using the services offered. It is written to meet the requirements of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For how confidential clinical information is handled within therapy itself, please also see the confidentiality policy.

Who is responsible for your information

Body and Mind Therapy is run by Dr Kayleigh Darch, a sole trader. Dr Kayleigh Darch is the data controller for your personal information and is registered with the Information Commissioner's Office (ICO), registration number ZB328353. Questions about your information or this policy can be sent to kayleigh@bamtherapy.co.uk.

Information that may be collected

Name and contact details (email address, phone number, postal address)
Occupation, and your goals in seeking the services offered
Health information you share when enquiring about or receiving therapy or yoga (this is “special category data” and receives extra protection — see the lawful bases below)
Insurance details where a private health insurer or other third party is funding your sessions (membership and authorisation numbers)
Payment and invoicing records
Other information relevant to an enquiry or referral

Information may be collected verbally, on paper, through the website contact form, by email, through social media, or from a referrer such as an insurer, case-management company or another health professional acting with your knowledge.

Why the information is used, and the legal bases

UK GDPR requires a lawful basis for each use of personal data, and an additional condition for health data. Body and Mind Therapy relies on the following:

Providing therapy and yoga services, and keeping clinical records — performance of a contract (Article 6(1)(b)); and, for health information, the provision of health or social care condition (Article 9(2)(h), given effect by Schedule 1 of the Data Protection Act 2018), which applies to care delivered by a registered health professional under a duty of confidentiality. Clinical records are not kept on the basis of consent, because they are a necessary part of providing the service safely.
Administration, security and improving the service — legitimate interests (Article 6(1)(f)), applied without overriding your rights.
Tax and accounting records — legal obligation (Article 6(1)(c)).
Marketing emails, session recordings, and contacting your GP or other professionals at your request — consent (Article 6(1)(a)), which you can withdraw at any time.

Marketing is only ever sent with your consent, and every marketing email includes a way to unsubscribe. You may occasionally be asked for permission to record a session for Dr Kayleigh Darch's professional development. You have the right to refuse. If you agree, the recording is stored on a password-protected, encrypted device and deleted as soon as it has served its purpose.

Who your information is shared with

Your details are only shared with organisations directly involved in providing and supporting the services. Those organisations act either as “processors” handling data on Dr Kayleigh Darch's instructions, or as controllers in their own right (for example your insurer). They are:

My-Therapy-Suite — UK-hosted practice-management platform (client records, bookings, secure forms and communications), acting as data processor under a data processing agreement. Messages sent through this website's contact form are received and stored on My-Therapy-Suite. Body and Mind Therapy does not use any AI tools on client information — the platform's optional AI features are not used.
Calendly — online booking of introductory calls and appointments (a US service).
Vercel — hosting for this website, served from a global content network.
Zoho Mail — email hosting for kayleigh@bamtherapy.co.uk, on servers in the European Union.
Healthcode — the secure medical billing platform used to send invoices to private health insurers.
Private health insurers — currently Bupa, Aviva and WPA — where your sessions are funded through insurance. What is shared is limited to your name, membership and authorisation numbers, appointment dates and times, and invoice amounts, under your contract and the insurer's authorisation.
Third-party referrers and payers — including Unite Professionals Case Management, Meela, and Prometheus Psychological Therapy Centre — where they refer you or pay for your sessions on your behalf, limited to the information needed to arrange and invoice your care.
Banks — payment is by bank transfer, so the bank processes payer names and payment references. Invoices carry a discreet payment reference.
HMRC and accounting support — statistical and financial information required for tax purposes.
Clinical supervisors and peer supervision — cases may be discussed to support safe, high-quality care, anonymised or with the minimum identifiable information necessary.

Personal information is never sold, and never shared with advertising networks.

International transfers

Client records are held on UK servers. Some of the services above (for example Calendly, and certain sub-processors used by My-Therapy-Suite) are based outside the UK, mainly in the United States. Where personal information is transferred outside the UK, appropriate safeguards are in place in accordance with UK GDPR, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

How long information is kept

Clinical records — 7 years from the end of therapy. This reflects the standard limitation period for civil claims in England and Wales and professional-indemnity requirements.
Financial records — 6 years from the end of the relevant tax year, as required by HMRC.
Enquiries that do not lead to work — deleted within 12 months.

Because clinical records may be needed to comply with legal obligations or to establish or defend a legal claim, requests to erase them during the retention period will usually be declined (as UK GDPR Article 17 permits). Anything genuinely no longer needed is deleted. When the retention period ends, records are permanently and securely destroyed.

Your rights

You have the right to access the personal information held about you (a “subject access request”), to have inaccurate information corrected, to request erasure (subject to the retention rules above), to restrict or object to processing, to data portability, and to withdraw consent at any time where consent is the basis relied on. There is no charge for exercising these rights, and requests are answered within one calendar month. Please email kayleigh@bamtherapy.co.uk with a description of your request; you may be asked for proof of identity, or for clarification, before it is actioned.

Complaints about data handling

Under the Data Protection Act 2018 (section 164A) you have the right to complain directly to Dr Kayleigh Darch about how your data has been handled. Please raise any concern in writing to kayleigh@bamtherapy.co.uk. Complaints are acknowledged within 5 working days and answered within one calendar month.

You also have the right to complain to the supervisory authority at any time: the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; telephone 0303 123 1113; www.ico.org.uk.

Security

Appropriate physical, electronic and organisational measures are in place to prevent unauthorised access to or disclosure of your information, whether collected online or on paper.

Cookies

This website sets no analytics or advertising cookies. Only strictly necessary cookies are used, and the embedded booking widget may set its own cookies when you use it.

Links to other websites

This website contains links to external websites, and Body and Mind Therapy interacts with people through social media platforms. Once you leave this website, this policy no longer applies — please check the privacy statement of any external site you visit.

Updates to this policy

This policy was last updated on 21 August 2026. It may be updated to reflect changes at Body and Mind Therapy or in regulation — updates will be posted on this page.

Psychologist-Led Mental Health & Wellbeing Support

Contact: kayleigh@bamtherapy.co.uk

Privacy Confidentiality Terms and Conditions Yoga Student Disclaimer and Waiver