Privacy Notice

Last updated: October 2026

Effective from: November 2026

Your privacy is important to me. I handle your personal information confidentially and take appropriate steps to protect it. This notice explains what information I collect, why I use it, how it is stored and shared, how long I keep it, and the data-protection rights you have.

1. Who is responsible for your information?

The data controller is Dezrika Ramsey, 

ICO registration number: ZB847698

Email: dezrika@figuringforward.com
Telephone: 07596 168815
Website: https://figuringforward.com

You can use these details to ask a question about this notice, exercise your data-protection rights or raise a concern about how your information has been handled.

This notice is intended to be read alongside your Therapy / Counselling Working Agreement.

2. What information do I collect?

Depending on your contact with my practice, I may collect and use:

• Your name, contact details and preferred method of communication.
• Information you provide in an enquiry, referral or initial assessment.
• Information you share in therapy, including relevant health and mental-health information, personal circumstances, clinical notes, risk assessments and agreed plans.
• Appointment, attendance, cancellation, payment and invoice information.
• Relevant emails, messages and other communications.
• Records of consent, decisions and agreed arrangements.
• Emergency-contact details, where you choose to provide them and we agree they are appropriate.
• Where you agree to optional AI-assisted transcription, the resulting transcript and any AI-generated summary or draft clinical note. Carepatron also processes session audio to generate the written transcript while the feature is active.
• Website and technical information, such as server logs, cookie preferences and website-usage information, depending on the website’s configuration and your choices.

I normally collect information directly from you. In some circumstances, a health professional or another person may provide information or contact me on your behalf. Where relevant, I will explain the source of information that was not collected directly from you, subject to any applicable legal or safeguarding restrictions.

3. Why do I use your information?

I use personal information where necessary to:

• Respond to enquiries and consider whether my service may be suitable for you.
• Arrange and provide counselling or psychotherapy.
• Communicate with you and manage appointments, cancellations and payments.
• Maintain appropriate clinical records and support continuity of care.
• Reflect on my work in professional supervision, using safeguards to protect confidentiality.
• Meet relevant professional, insurance, safeguarding and legal responsibilities.
• Respond to emergencies, concerns, complaints or legal claims where necessary.
• Use AI-assisted transcription and documentation only where you have separately agreed to this optional process.
• Operate and protect my website and, where enabled and legally permitted, understand how visitors use it.

I do not sell your personal information.

4. Lawful bases for using your information

Data-protection law requires me to have a lawful basis under Article 6 of the UK GDPR for processing personal information. Where I process special-category information, such as health information, I must also have an applicable condition under Article 9 and comply with any additional requirements. The basis depends on the purpose of the processing.

Depending on the circumstances, the bases may include:

• Contract or steps taken before entering a contract (Article 6(1)(b)): for information needed to respond to your request, arrange therapy and provide the agreed service.
• Legitimate interests (Article 6(1)(f)): where appropriate for practice administration, security and establishing or defending legal claims, after considering your rights and interests.
• Legal obligation (Article 6(1)(c)): where I need to process information to comply with a legal requirement.
• Health or social care (Article 9(2)(h)): where the legal requirements and applicable confidentiality safeguards are met.
• Explicit consent (Articles 6(1)(a) and 9(2)(a)): where I validly rely on your explicit consent for a particular purpose, such as optional AI-assisted transcription.

I will not assume that signing the Working Agreement gives consent to every type of data processing. Your choice about optional transcription is separate from the other information I need to provide therapy and manage my practice.

5. Confidentiality and when information may be shared

Confidentiality is central to therapy. I do not routinely share your clinical information with your GP, family, employer or another professional without your permission.

Information may be shared with service providers who help me run the practice, with my clinical supervisor under appropriate confidentiality safeguards, or with a clinical notifier or executor where necessary under my clinical will.

I may also disclose information where required or permitted by law, or where I consider disclosure necessary and proportionate to address a serious risk of harm or a safeguarding concern. Each situation is considered individually, taking account of the law, professional responsibilities, the circumstances and the information necessary to share.

Where safe and appropriate, I will discuss a possible disclosure with you beforehand. In an urgent situation, or where discussion could increase risk or is not permitted, I may need to act without prior discussion. I will limit any disclosure to what is reasonably necessary and record my reasoning and actions.

6. Digital providers and service systems

I use digital services to support the operation of my practice. Depending on the service you use, these may include:

• Carepatron: client administration, appointments, clinical records, video sessions and optional AI-assisted transcription and note drafting.
• Cal.com: introductory-call or consultation scheduling, where used.
• Email and form services: for communications and forms, including the relevant Microsoft or Google services used for a particular purpose.
• WordPress and website hosting or technical providers: to operate and maintain my website.
• Google Analytics or another analytics service: if enabled, to understand website use, subject to applicable consent requirements.
• The payment provider identified in your payment link or checkout: to process payments and support financial record-keeping.

The precise providers and services may change. I will keep this list accurate to the services actually in use and can provide further information about the providers processing your information.

These providers may process information on my behalf and may use authorised sub-processors. Some may use cloud infrastructure or process information outside the UK. I will review the relevant data-processing terms and use any transfer safeguards required by law.

You can find further information here:

• Carepatron: https://www.carepatron.com/uk-data-processing-addendum
• Carepatron sub-processors: https://help.carepatron.com/en/articles/8216691-carepatron-subprocessors
• Carepatron Trust Center: https://trust.carepatron.com

Before publishing this notice, I will check that the provider list, links and any information about international transfers reflect my actual accounts and the services currently used.

7. Optional AI-assisted session transcription

I may offer optional transcription using Carepatron’s AI Scribe to help me prepare for and reflect on our sessions. I will not use transcription for your sessions unless you have separately agreed to it. Declining or withdrawing your agreement for future sessions will not, by itself, affect your access to therapy.

When AI Scribe is active, Carepatron processes session audio using AI to generate a written transcript. It may also generate a summary or draft clinical note.

This process produces written material rather than a playable audio recording for me to listen back to through Carepatron. However, audio is processed by the service to generate the text, and its technical processing may involve temporary handling or storage. I cannot independently guarantee the precise timing of deletion from every part of the provider’s systems or backups.

The transcript and any retained summary or clinical note may form part of your clinical record.

AI-generated text may contain errors, omissions or misunderstandings. I use the output as a reference to support my work; it is not necessarily a verified, word-for-word account of the session. I remain responsible for the clinical record and all professional decisions and do not delegate clinical decision-making to AI.

Carepatron states that data processed by its AI Scribe are not used to train its AI models. The service and its authorised providers may process information using cloud infrastructure. Please refer to the Carepatron information linked above for details of its processing arrangements.

Transcription carries risks, including inaccurate output, unauthorised access and technical or service-provider failures. I consider these risks and take reasonable steps to protect confidentiality, limit the purpose of use and assess AI-generated material critically.

You can ask questions before making your choice. You can withdraw your agreement for future transcription at any time. Withdrawal does not automatically delete existing transcripts or clinical notes; I will consider any request about existing records under data-protection law and my record-retention responsibilities.

8. How long do I keep your information?

My retention periods depend on the type of information and why I hold it.

• Enquiries that do not lead to therapy are normally deleted within one month of the last communication. I may retain limited information for longer where necessary and lawful, for example to deal with a complaint or legal claim.
• My practice policy is to retain clinical records for seven years after therapy ends. This includes relevant clinical notes, communications, consent records and retained AI transcripts or notes. Seven years is my chosen retention policy, not a universal legal requirement.
• I may retain relevant records for longer where there is a justified legal, safeguarding, insurance or complaint-related reason. Any extended retention will be limited to what is necessary and reviewed appropriately.
• Financial records may need to be kept for a different period to meet applicable accounting or tax requirements.
• Information held temporarily by digital service providers during processing may be subject to their own technical retention and deletion arrangements.

When information is no longer required, I will securely delete it or arrange for it to be securely deleted, subject to any applicable retention requirement.

You can ask me to delete information earlier. I will consider your request under data-protection law, but the right to erasure is not absolute. I may need to retain some information for legal, professional, safeguarding, insurance or complaint-related reasons. I will explain the outcome of your request.

9. Your data-protection rights

Depending on the circumstances and legal conditions, you may have the right to:

• Be informed about how your information is used.
• Request access to the personal information I hold about you.
• Ask me to correct inaccurate or incomplete information.
• Request erasure of information in certain circumstances.
• Ask me to restrict processing in certain circumstances.
• Object to certain types of processing, including processing based on legitimate interests where the right applies.
• Request a copy of certain information in a structured, commonly used format where the right to data portability applies.
• Withdraw consent where I rely on consent for the relevant processing. This does not affect the lawfulness of processing carried out before withdrawal.
• Complain to me about how I have handled your information, and complain to the Information Commissioner’s Office (ICO).

These rights are subject to legal conditions and exceptions. For example, I may need to protect another person’s information or retain records where a lawful exception applies.

I will respond to rights requests without undue delay and normally within one calendar month. Where the law allows an extension for a complex request or multiple requests, I will tell you within the initial response period. I may ask for clarification or information to verify your identity where reasonably necessary.

To make a request, email dezrika@figuringforward.com. Please describe what you are asking for. I may need to verify your identity before responding.

10. Website analytics and cookies

My website uses WordPress as its content-management system. Depending on its current configuration, it may use cookies or similar technologies to support the website and, where enabled, measure website usage.

Where Google Analytics or another analytics service is enabled, it may collect information about visits and interactions, such as pages viewed, technical information about your browser or device, and online identifiers. The precise information depends on the configuration.

I will ensure that non-essential cookies or similar technologies are used only in accordance with applicable legal requirements, including obtaining consent where required. You can use the website’s cookie controls, where available, to manage your preferences.

The information in this section must be checked against the live website and its actual cookies, analytics tools and consent settings.

11. Data-protection concerns and complaints

If you are concerned about how I have collected, used, stored or shared your personal information, you can raise a data-protection complaint directly with me. You can email dezrika@figuringforward.com with the subject line “Data Protection Complaint”. You may also raise a concern verbally or through another communication channel. You do not have to use this exact subject line or particular wording for me to consider your concern.

I will:

• Acknowledge receipt of your data-protection complaint within 30 days.
• Take appropriate steps to investigate it without undue delay.
• Keep you informed about progress.
• Tell you the outcome without undue delay.

I will keep an appropriate record of the complaint, the steps taken and the outcome. The 30-day period is for acknowledging receipt, not necessarily for completing the investigation.

If you are not satisfied with my response, you can also complain to the Information Commissioner’s Office (ICO). Raising a complaint with me does not remove your right to contact the ICO.

ICO website: https://ico.org.uk
Make a complaint: https://ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113

Further guidance: https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/

12. Subject access requests

If you ask for a copy of the personal information I hold about you, I will handle your request under the applicable data-protection rules. I will normally respond within one calendar month. In circumstances permitted by law, the time limit may be extended for a complex request or multiple requests, and I will tell you if an extension is needed.

You can email dezrika@figuringforward.com with the subject line “Subject Access Request”. Please include enough information to help me understand your request. I may ask for further details or identity verification where reasonably necessary.

I will not charge a fee for an ordinary request. The law permits a fee or refusal in limited circumstances, such as where a request is manifestly unfounded or excessive.

13. Changes to this notice

I may update this notice when my practice, technology, legal requirements or professional guidance changes.

The latest version will be available at https://figuringforward.com/privacy-policy/.

If a change materially affects how I use your personal information, I will take reasonable steps to bring it to your attention and obtain any new consent required by law.