This privacy notice (“Notice”) will help you, as someone accessing and using this website (the “User”) understand how Kate Blanshard, trading as Illuminate Therapy, collects, stores, uses and protects the personal data you provide when you use the Illuminate Therapy website https://illuminatetherapy.co.uk (“Website”).

If you have any questions or feedback about this Notice please get in touch through the Website contact page.

I reserve the right to change this Notice at any time, to ensure ongoing compliance with legal and regulatory requirements and good business practice. You are advised to re-read the Notice whenever you are using the Website, to be sure you are up to date with the current Notice.

What User data is collected?
Data that relates to and can identify an individual directly or indirectly, is “personal data”.
When you visit the Website, the following data may be collected:

• Personal identification information: if you choose to submit a contact form, your name, email address and any information you choose to provide will be collected.
• Personal information about your, or your child’s, health and wellbeing: if you choose to submit a contact form through the Website, you may mention relevant health information in relation to the services you are enquiring about. 
• Browser and Website visit information: this data is provided by your browser and records your behaviour on the Website including information such as your browser type, operating system, IP address, demographics, etc.
• Cookie-related information: see cookie policy for cookie-related details.

Your data protection rights
I will always do my best to protect and uphold your data protection rights. To support your awareness of your rights, I will list below the rights that every User is entitled to. You can find out more about your data protection rights, and the exemptions that may apply, on the ICO’s website.

• Your right of access: you have the right to ask me for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for that I have collected, which you have provided to me.
• Your right to rectification: you have the right to ask me to correct or delete personal information that you think is inaccurate or incomplete.
• Your right to erasure: you have the right to ask me to delete your personal information. There may be exceptions that apply that prevent me from deleting everything.
• Your right to restriction of processing: you have the right to ask me to limit how I can use your personal information.
• Your right to object to processing: you have the right to object to the processing of your personal data, under certain conditions.
• Your right to data portability: you have the right to ask me to transfer the personal information you gave me to another organization or directly to you, under certain conditions.
• Your right to withdraw consent: where I use consent as my lawful basis for collecting and handling your data, you have the right to withdraw your consent at any time.

Why is your data collected?
Under UK data protection law, I must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis I rely on may affect your data protection rights which are set out in brief above.

The lawful bases I rely on for collecting or using your personal data are:

• Consent: when you submit a contact form through this Website, you gave me permission to collect your data in order to respond to your message. You give further permission for me to hold and use your contact information, if you request to be added to a mailing list to receive email notifications of services that you have indicated are of interest. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
• Contract: I am required to collect or use some personal information (e.g. your full legal name) to enable us to enter into a contract for my services, and for us to perform our obligations under that contract. All of your data protection rights may apply except the right to object.
• Legitimate interests: I collect or use your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. My legitimate interests are:
  • collection of data to enable me to assess whether it is appropriate for me to provide therapy and/or coaching services to you or your child, and to gain appropriate clinical oversight over my practice, to ensure I offer my services ethically;
  • to collect data to enable me to respond to you when you submit a contact form, including to arrange further contact between us to help you to decide whether you would like to work with me;
  • provide your contact details to be notified of services that you have indicated are of interest;
  • to enable me to provide effective therapy and/or coaching services to you or your child; 
  • to record visitor IP addresses and browser user agent string to help spam detection and protect the integrity and security of the Website; and
  • To better understand your needs and navigation of the Website to bring about improvements.

How is your personal information collected?
Your data is collected in the following ways:
• submission of the Website contact form.
• Visiting the Website using your browser’s cookies.
• Completion of any survey or emails to provide feedback on the Website or services I offer.

Where you are in contact with me concerning my Play Therapy services, I may also receive information about your child from:
• Family members or carers
• Schools, alternative education providers, or other education organisations (this will generally only be provided with your informed consent).
• Councils and other public sector organisations, where they have referred your child or your family to me (this will generally only be provided with your informed consent).
• Charities or voluntary sector organisations that are also support your child or your family (this will generally only be provided with your informed consent).

Who do I share information with?
I may share some of your or your child’s personal information with the following organisations:
• those I need to share information with for safeguarding reasons,
• those I am legally obliged to share personal information with, and
• PTUK, to ensure appropriate clinical oversight and enable my revalidation as a Certified Play Therapist. Access PTUK’s privacy policy for more details about how it handles personal data. 

Duty of confidentiality
I am subject to a common law duty of confidentiality. However, there are circumstances where I will share specific information. These are where:
• you’ve provided me with your consent (either I have taken this as implied consent in order to provide the services or communications you have requested, or you have given it explicitly for those uses);
• I have a legal requirement (including court orders) to collect, share or use the data; or
• on a case-by-case basis, the public interest to collect, share and use the data overrides the public interest served by protecting the duty of confidentiality (for example, sharing information with the police to support the detection or prevention of serious crime).

How long will I keep your information?
Information submitted  with a query or feedback through the Website contact form:
• I will keep your name, email address and message for six months from the date that you last contacted me, unless you consent to your details being held for longer, e.g. if you opt to receive email updates about future service availability.

If your child receives Play Therapy from me:
• I am required by my accrediting body, Play Therapy UK (PTUK), to keep basic details about you, your child and my work with them for my lifetime, and will do so on PTUK’s secure data site.
• Written records of my Play Therapy work with your child shall be kept for a minimum of seven years after our work together ends, or longer if required by insurers.

If you receive parenting or teacher support from me (e.g. coaching, attending a workshop):
• I will keep your details and the record of our work together for a minimum of seven years after our work together ends, or longer if required by insurers.

Email correspondence in relation to services being received by you or your child:
• significant emails will be attached to client records and deleted from email inboxes within one year of the services ending.  

Details of any accidents that happen while my services are being offered:
• details of adults involved in an accidents shall be kept for six years from the date of the accident.
• details of children involved in an accident shall be kept until the child turns 25 (as required by PTUK). 

Data used for marketing
Based on the preferences you express through the contact form or by email, I may send you marketing emails informing you about services that are becoming available that you have indicated you may be interested in. You have the right at any time to ask me not to contact you again, or to opt-out of any marketing related emails.

How do I complain?
If you have any concerns about my use of your personal data, you can make a complaint to me using the Website’s contact form.

If you remain unhappy with how I’ve used your data after raising a complaint with me, you can also complain to the ICO:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline number: 0303 123 1113
ICO website complaints page

Contact me
If you have any queries related to my data privacy practices or this Notice, feel free to contact me through the Website contact form.