Finding Therapy Ltd

Finding Therapy Ltd is the data controller for the purposes of UK GDPR.
Contact Information: info@findingtherapy.co.uk
Registered Address: Finding Therapy, Avenue HQ, 10-12 East Parade, Leeds, LS1 2BH
For all data protection queries, please contact our Data Protection Officer at the above email.

We collect and process data from:

• Children and young people receiving therapy
• Parents and legal guardians
• Self-employed therapists working via our platform
• Website visitors and users

For Parents and Children:

• Names and contact details
• Child’s date of birth
• GP and school details
• Referral information (mental health, SEN, medical history)
• Therapy session notes (held securely by therapists)
• Signed consent forms
• Payment records (processed via Stripe)

For Therapists:

• Full name and contact details
  
• Qualifications and safeguarding training certificates
  
• DBS information, ICO registration, insurance, professional memberships
  
• Bank details for payment
  

For Website Users:

• IP addresses and cookies
  
• Form submission details (e.g., contact forms, interest registration)

We use personal data to:

• Provide therapy services to children and families
• Match clients with suitable therapists
• Ensure therapists meet safeguarding and compliance standards
• Maintain accurate financial and clinical records
• Communicate with service users regarding service updates or changes
• Conduct anonymised analytics and service improvements
• Market our services where appropriate consent has been obtained

We rely on the following lawful bases under UK GDPR:

• Consent: For therapy participation and sharing of sensitive information
• Contractual necessity: To deliver our services effectively
• Legal obligation: To comply with applicable laws and safeguarding duties
• Legitimate interests: For operational, analytical, and security purposes

For special category data (e.g., health and mental health information), we process this under Article 9(2)(a) of UK GDPR (explicit consent), and where necessary to provide health-related services or safeguard children or vulnerable people.

We may share personal data with trusted third parties:

• Service providers such as Google Workspace, JotForm, Stripe
• Regulatory or safeguarding bodies (e.g., GP, school, social services) in urgent safeguarding situations
• Technology and hosting providers who support our platform infrastructure

‍
Safeguarding: In any situation where we believe a child or another person is at risk of harm, we may share relevant data with emergency or safeguarding services. We will always try to inform you of this, unless doing so would increase the risk.

‍
All data storage and transfers are secured. Some data may be stored outside the UK under appropriate data protection agreements (e.g., Standard Contractual Clauses).

We only keep your data for as long as necessary to fulfil the purposes outlined in this policy, unless a longer retention period is required or permitted by law.

• Children and young people (clients): Clinical notes and session information are stored securely for 8 years after the last session, or until the client’s 25th birthday — whichever is later — in line with professional guidance for child counselling services.
• Associate therapists: Profile data, payment records, contracts, and compliance materials are retained for the duration of the associate’s work with Finding Therapy and for up to 7 years after the end of their contract.
• General enquiries and website users: Data is kept for up to 12 months unless a longer period is justified (e.g., legal proceedings or complaints).

You can request the deletion of your data at any time, and we will comply unless we are legally required to retain it.