Who we are
Our website address is: http://sherreerussell.com
Last updated: September 2026
Your privacy and confidentiality are important to me. This Privacy Notice explains what personal information I collect, why I collect it, how I use and protect it, and your rights in relation to your information.
I am a sole practitioner and am the Data Controller for personal information collected through my practice.
Information I may collect
When you contact me, make a booking or become a client, I may collect information including:
- your name, address, telephone number, email address and date of birth;
- appointment, booking and payment information;
- information provided on your registration or assessment form;
- information about your physical or psychological health, medication or previous treatment where relevant;
- information you provide about your personal circumstances and reasons for seeking therapy;
- brief clinical/session notes; and
- correspondence between us where this is relevant to your care or the administration of your appointments.
Information concerning your physical or mental health is classed as special-category personal data and receives additional protection under UK data-protection law.
I aim to collect only information that is reasonably necessary to provide my services safely and effectively.
Why I use your information
I use personal information to:
- respond to enquiries;
- arrange and manage appointments;
- provide psychotherapy, hypnotherapy, coaching and related services;
- understand relevant health, personal and therapeutic information;
- maintain appropriate professional records;
- communicate with you about your appointments or therapy;
- process payments and maintain financial records;
- meet my professional, insurance, safeguarding and legal responsibilities; and
- protect the legitimate interests of my practice and clients where appropriate.
Lawful basis for using your information
Under UK data-protection law, I must have a lawful basis for processing personal information.
Depending upon the circumstances, information may be processed because it is necessary to provide the service you have requested, because I have a legitimate professional or business reason for processing it, because I have a legal obligation to do so, or because you have given your consent.
Health and therapeutic information is special-category data. Where I process this information, I will ensure that an appropriate additional legal condition for processing special-category information applies.
Where processing relies specifically upon your consent, you may withdraw that consent.
Confidentiality and sharing your information
Information discussed during therapy is treated as confidential.
I do not routinely share identifiable information about clients with other people or organisations.
There may, however, be circumstances in which information needs to be shared. These may include:
- where you have asked or agreed that information should be shared with another healthcare professional;
- where there is a serious safeguarding concern or significant risk of harm;
- where disclosure is required by law or by a court;
- where information is necessary for the establishment, exercise or defence of legal claims; or
- where another overriding legal or professional obligation applies.
Where appropriate and lawful, I will discuss this with you before information is disclosed.
Only information reasonably necessary for the particular purpose will be shared.
Some organisations providing services to my practice, such as booking, payment, email, communications or IT providers, may process limited personal information on my behalf. I take reasonable steps to use reputable service providers and appropriate privacy and security arrangements.
Online sessions and electronic communication
Sessions may be provided in person or remotely using services such as Microsoft Teams, FaceTime or WhatsApp.
Email, telephone, text messaging and other electronic communications may also be used to arrange and manage appointments.
Although reasonable precautions are taken to protect confidentiality, no method of electronic communication can be guaranteed to be completely secure. I therefore encourage clients not to send unnecessary sensitive information through ordinary email or messaging services.
International data transfers
Some technology and communications providers may process or store information outside the United Kingdom.
Where this occurs, I take reasonable steps to use services that provide appropriate safeguards for personal information in accordance with UK data-protection requirements.
How I store and protect your information
I take reasonable steps to keep your information confidential and secure.
Paper records are stored securely. Electronic devices and accounts used for professional purposes are protected using appropriate passwords, PINs and security measures.
Access to clinical records is normally restricted to me.
I aim to record only information that is relevant and necessary for professional and therapeutic purposes.
How long I keep your information
I do not keep personal information indefinitely without a reason.
As a general practice, adult client records may be retained for seven years following the end of therapy, subject to any different legal, professional, safeguarding or insurance requirement.
Records relating to clients who were under 18 when treatment was provided may need to be retained for a longer period.
Information relating to enquiries that do not result in therapy will normally be deleted when it is no longer reasonably required.
Financial records are retained for the period required by HMRC.
At the end of the appropriate retention period, information is securely deleted or destroyed unless there is a legitimate reason for retaining it for longer.
Your rights
Depending upon the circumstances and the lawful basis being used, you have rights in relation to your personal information. These may include the right to:
- ask what personal information I hold about you and request a copy;
- ask for inaccurate information to be corrected;
- request deletion of information in certain circumstances;
- request restriction of processing in certain circumstances;
- object to certain uses of your information; and
- request transfer of information where the right to data portability applies.
Not all of these rights apply in every circumstance.
If you would like to exercise any of your data-protection rights, please contact me using the details below.
You also have the right to object to processing based upon legitimate interests. If you wish to object to such processing, please contact me.
Withdrawing consent
Where I am relying specifically upon your consent to process information, you may withdraw that consent at any time by contacting me.
Withdrawal of consent does not affect processing that was lawful before consent was withdrawn, and it does not necessarily require information to be deleted where there is another lawful reason for retaining it.
Information about other people
If you provide personal information about another person, such as a partner, family member or emergency contact, I will only use that information where reasonably necessary for the purpose for which it was provided.
If information about you is supplied to me by another person or professional, I will handle it in accordance with applicable data-protection and confidentiality requirements.
Automated decision-making and AI
I do not use solely automated decision-making or profiling to make decisions about whether or how therapy is provided.
Digital or artificial-intelligence tools may occasionally be used to support administrative, educational or professional work. Identifiable confidential client information will not be entered into such systems unless I have established an appropriate lawful and confidential basis for doing so. Wherever reasonably possible, information used with such tools will be anonymised or minimised.
AI does not replace my professional judgement or responsibility for clinical decisions or client records.
Cookies and website information
My website may use cookies or similar technologies that are necessary for the operation, security and functionality of the website.
Where non-essential cookies or analytics technologies are used, appropriate information and consent mechanisms will be provided where required.
Contacting me about your information
If you have a question about how your personal information is used, would like access to your information or wish to exercise one of your data-protection rights, please contact:
Sherree Russell-Kulin
Psychotherapist & Clinical Hypnotherapist
Email: info@sherreerussell.com
Telephone: 07880 336059
Website: www.sherreerussell.com
Complaints
If you have concerns about how I have handled your personal information, please contact me first so that I have an opportunity to address your concerns.
You also have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK’s independent regulator for data protection.
Information about making a complaint is available from the Information Commissioner’s Office website.
Changes to this Privacy Notice
I will review this Privacy Notice periodically and update it when necessary, for example if my working practices, technology or legal obligations change.
Last reviewed: September 2026