Privacy Policy | Fiona Croston Therapy

Last Updated: June 2026

1 INTRODUCTION

This Privacy Policy explains how Fiona Croston Therapy ("I", "me", "my") collects, uses, stores and protects your personal information. I am committed to protecting your privacy and handling your personal information with transparency, care and in accordance with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other relevant legislation.

This Privacy Policy explains how your personal information is collected, used, stored and protected when you visit my website, contact me, book services, or engage in psychotherapy, hypnotherapy or Rapid Transformational Therapy® (RTT®).

By booking a session or engaging in services, you confirm that you have read, understood and agree to this Privacy Policy.

2 WHO I AM

Practice Name: Fiona Croston Therapy

Practitioner Name: Fiona Croston, Accredited Psychotherapist UKCP and Certified Hypnotherapist.

Email: fiona@croston.karoo.co.uk

Phone: 07841867225

Website: [Your Website URL]

For the purposes of data protection law, I am the “data controller” responsible for your personal information.

3 INFORMATION I COLLECT

I only collect personal data you choose to provide to me. This may include:

Name
Email address
Telephone number
Postal address
Date of birth
Emergency contact details
Appointment information
Payment information (process securely through third-party payment providers)

Special Category Data

As part of providing psychotherapy, hypnotherapy and RTT® services, I may collect and process information relating to your physical, mental and emotional wellbeing. This information is classified as "special category data" under UK GDPR and is subject to additional protections.

Such information is processed only where necessary for the provision of therapeutic services, compliance with legal and professional obligations, the establishment or exercise of legal claims, or where another lawful basis applies under applicable data protection legislation.

I take appropriate measures to ensure that any special category data is handled securely, confidentially, and in accordance with professional and legal requirements. You are not required to provide personal health information; however, in some circumstances, this may limit my ability to provide services safely and effectively.

Technical Information

When you visit the website, certain information may be collected automatically, including:

IP address
Browser type
Device information
Operating system
Website usage statistics
Cookies and tracking technologies

4. WHY YOUR DATA IS COLLECTED

Your data is collected for the following purposes:

To respond to enquiries
To schedule consultations and appointments
To provide psychotherapy and RTT services and tailor my approach to your specific needs
To maintain client records
To process payments and invoices
Comply with legal and professional obligations
Protect the safety of clients and others where required by law
To improve website functionality and user experience

I will only use your information where there is a lawful basis for doing so.

Testimonials and Marketing

You may choose to provide a testimonial about your experience. Testimonials are entirely optional and are only used where you have given clear consent.

If you provide a testimonial, it may be used for marketing purposes, including on the website and social media. Testimonials may be edited for clarity while preserving their original meaning. You can choose how your testimonial is attributed (eg first name, initials or anonymously). You may withdraw your consent at any time, and your testimonial will be removed from future use where reasonably possible.

Testimonials are kept separately from clinical or session records and are not used to inform therapeutic work.

5 LEGAL BASES FOR PROCESSING

Consent (Article 6(1)(a))

Contract (Article 6(1)(b))

Legal Obligation (Article 6(1)(c))

Legitimate Interests (Article 6(1)(f))

Special Category Data – Where I process special category data, including information relating to health, I do so only where permitted by applicable data protection legislation and subject to appropriate safeguards. The legal basis relied upon will depend on the nature of the information processed and the purpose for which it is used.

6. HOW YOUR INFORMATION IS STORED AND PROTECTED

I take reasonable and appropriate technical and organisational measures to protect your information from:

Unauthorised access
Loss or theft
Misuse
Disclosure
Alteration or destruction

I take the security of your data seriously. Security measures may include:

Password-protected devices and accounts
Encrypted storage where appropriate
Secure practice management systems
Secure email providers
Limited access to records

Despite best efforts, no method of electronic transmission or storage can be guaranteed to be completely secure.

7. HOW LONG IS INFORMATION KEPT?

I retain personal information only for as long as necessary to provide our services and to comply with legal, professional, and regulatory obligations:

Enquiry and contact form information is retained for up to 12 months where therapy does not proceed
Client session records, including assessment information, session notes, correspondence and appointment records, are retained for 7 years after the end of therapy, unless a longer retention period is required by law or professional requirements.
Financial and payment records are retained for 6 years in accordance with UK tax and accounting obligations.
Website analytics data is retained in accordance with the settings of the analytics provider and is used only to monitor and improve website performance.

After the applicable retention period has expired, records are securely deleted or destroyed. You may request deletion of your personal information, subject to any legal, professional, insurance, safeguarding, or regulatory obligations requiring its retention.

8. SHARING YOUR INFORMATION

Your information will never be sold. I may share your information only in the following limited circumstances:

Professional Supervision - as part of professional standards, cases may be discussed with a supervisor, bound by confidentiality obligations.

Legal Obligation - Emergency services or safeguarding authorities where legally required.
Service Providers – Trusted third parties who assist us in operating our business. These include, payment processors, booking and appointment management provider, Email and communication providers, website hosting provider, Accountants or legal advisers and analytics providers,

These providers are only permitted to process personal data as necessary to provide their services to me and are required to protect your information in accordance with applicable data protection laws.

Where necessary to protect you or others from serious harm, or where safeguarding concerns arise, information may be shared with appropriate agencies in accordance with legal and professional obligations.

9. INTERNATIONAL TRANSFERS

If any service providers store or process data outside the United Kingdom, reasonable steps will be taken to ensure appropriate safeguards are in place to protect your personal information in accordance with UK GDPR.

10. COOKIES AND WEBSITE ANALYTICS

The website may use cookies and analytics tools to improve website performance and user experience.

Cookies are small text files stored on your device. You can control or disable cookies through your browser settings.

Analytics providers such as Google Analytics may collect anonymised information about website usage.

You may wish to add a separate Cookie Policy if using non-essential cookies or advertising tools.

11. MARKETING COMMUNICATIONS

If you subscribe to newsletters or updates, your contact information may be used to send occasional emails about services, resources, events, or updates. You may unsubscribe at any time by clicking the unsubscribe link in emails or contacting me directly. Marketing communications will only be sent where legally permitted.

12. YOUR RIGHTS UNDER DATA PROTECTION LAW

Under GDPR you may have the right to:

Access your personal information
Correct inaccurate personal information
Request deletion of your information
Restrict or object to certain processing
Withdraw consent where applicable
Request transfer of your information
Lodge a complaint with the Information Commissioner’s Office (ICO).

I would be pleased if you would contact me first so that I may attempt to resolve the issue. If you are located in the EEA you may also contact your local data protection authority.

To exercise any of these rights, please email: fiona@croston.karoo.co.uk. I may need to verify your identity before responding to requests.

13. THIRD-PARTY WEBSITES

This website may contain links to external websites. I am not responsible for the privacy practices or content of third-party sites.

Users are encouraged to review the privacy policies of any external websites visited.

14. CHILDREN AND YOUNG PEOPLE

My services are intended for adults aged 18 years and over. I do not currently provide therapeutic services to individuals under the age of 18.

15. CHANGES TO THIS PRIVACY POLICY

This privacy policy may be updated from time to time, to reflect changes in legal requirements, professional standards, or business practices. The latest version will always be available on this website with an updated revision date.

16. CONTACT INFORMATION

If you have questions about this Privacy Policy or how your information is handled, please contact me at:

Fiona Croston Therapy

fiona@croston.karoo.co.uk

17 PROFESSIONAL DISCLAIMER

Psychotherapy, hypnotherapy and RTT® services are not a substitute for medical advice, diagnosis, or treatment. Clients experiencing a medical or mental health emergency should contact emergency services or a qualified medical professional immediately.

RTT® is a registered trademark of Marisa Peer and is referenced descriptively in relation to the services offered by Fiona Croston Therapy.

Last Updated: June 2026

1 INTRODUCTION

This Privacy Policy explains how your personal information is collected, used, stored and protected when you visit my website, contact me, book services, or engage in psychotherapy, hypnotherapy or Rapid Transformational Therapy® (RTT®).

By booking a session or engaging in services, you confirm that you have read, understood and agree to this Privacy Policy.

2 WHO I AM

Practice Name: Fiona Croston Therapy

Practitioner Name: Fiona Croston, Accredited Psychotherapist UKCP and Certified Hypnotherapist.

Email: fiona@croston.karoo.co.uk

Phone: 07841867225

Website: [Your Website URL]

For the purposes of data protection law, I am the “data controller” responsible for your personal information.

3 INFORMATION I COLLECT

I only collect personal data you choose to provide to me. This may include:

Name

Email address

Telephone number

Postal address

Date of birth

Emergency contact details

Appointment information

Payment information (process securely through third-party payment providers)

Special Category Data

As part of providing psychotherapy, hypnotherapy and RTT® services, I may collect and process information relating to your physical, mental and emotional wellbeing. This information is classified as "special category data" under UK GDPR and is subject to additional protections.

Such information is processed only where necessary for the provision of therapeutic services, compliance with legal and professional obligations, the establishment or exercise of legal claims, or where another lawful basis applies under applicable data protection legislation.

Technical Information

When you visit the website, certain information may be collected automatically, including:

IP address

Browser type

Device information

Operating system

Website usage statistics

Cookies and tracking technologies

4. WHY YOUR DATA IS COLLECTED

Your data is collected for the following purposes:

To respond to enquiries

To schedule consultations and appointments

To provide psychotherapy and RTT services and tailor my approach to your specific needs

To maintain client records

To process payments and invoices

Comply with legal and professional obligations

Protect the safety of clients and others where required by law

To improve website functionality and user experience

I will only use your information where there is a lawful basis for doing so.

Testimonials and Marketing

You may choose to provide a testimonial about your experience. Testimonials are entirely optional and are only used where you have given clear consent.

Testimonials are kept separately from clinical or session records and are not used to inform therapeutic work.

5 LEGAL BASES FOR PROCESSING

Consent (Article 6(1)(a))

Contract (Article 6(1)(b))

Legal Obligation (Article 6(1)(c))

Legitimate Interests (Article 6(1)(f))

6. HOW YOUR INFORMATION IS STORED AND PROTECTED

I take reasonable and appropriate technical and organisational measures to protect your information from:

Unauthorised access

Loss or theft

Misuse

Disclosure

Alteration or destruction

I take the security of your data seriously. Security measures may include:

Password-protected devices and accounts

Encrypted storage where appropriate

Secure practice management systems

Secure email providers

Limited access to records

Despite best efforts, no method of electronic transmission or storage can be guaranteed to be completely secure.

7. HOW LONG IS INFORMATION KEPT?

I retain personal information only for as long as necessary to provide our services and to comply with legal, professional, and regulatory obligations:

Enquiry and contact form information is retained for up to 12 months where therapy does not proceed

Client session records, including assessment information, session notes, correspondence and appointment records, are retained for 7 years after the end of therapy, unless a longer retention period is required by law or professional requirements.

Financial and payment records are retained for 6 years in accordance with UK tax and accounting obligations.

Website analytics data is retained in accordance with the settings of the analytics provider and is used only to monitor and improve website performance.

After the applicable retention period has expired, records are securely deleted or destroyed. You may request deletion of your personal information, subject to any legal, professional, insurance, safeguarding, or regulatory obligations requiring its retention.

8. SHARING YOUR INFORMATION

Your information will never be sold. I may share your information only in the following limited circumstances:

Professional Supervision - as part of professional standards, cases may be discussed with a supervisor, bound by confidentiality obligations.

Legal Obligation - Emergency services or safeguarding authorities where legally required.

Service Providers – Trusted third parties who assist us in operating our business. These include, payment processors, booking and appointment management provider, Email and communication providers, website hosting provider, Accountants or legal advisers and analytics providers,

These providers are only permitted to process personal data as necessary to provide their services to me and are required to protect your information in accordance with applicable data protection laws.

Where necessary to protect you or others from serious harm, or where safeguarding concerns arise, information may be shared with appropriate agencies in accordance with legal and professional obligations.

9. INTERNATIONAL TRANSFERS