Privacy Policy | Sarah Masters

Privacy Policy

Welcome to Sarah Masters - Arts Psychotherapy (Drama) and Clinical Supervision services (“we,” “our,” or “us”). As a therapeutic practice dealing with sensitive personal and health information we understand the importance of confidentiality and are committed to taking our data protection responsibilities seriously. This privacy policy explains how we collect, use, and protect your personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025 (DUAA).

Contact

Practitioner Name: Sarah Masters (HCPC Registered)
Professional Title: Arts Therapist (Drama) and Clinical Supervisor
Email: sarahb.dramatherapy@gmail.com
Work Phone: 07733176784
Website: https://www.sarahbuxton.co.uk/

Professional Status: HCPC Registered Arts Therapist (Drama) and Member of the British Association of Dramatherapists (BADth)
Professional Bodies: Health Care and Professions Council (HCPC) and British Association of Dramatherapists (BADth)

Insurance: Fully insured
DBS: Enhanced DBS clearance held
ICO Registration reference: ZA744268

Data Controller: Sarah Masters (determines purposes and means of processing)

Information we collect, use and why

This privacy notice tells you what to expect us to do with your personal information. The GDPR states that there must be a lawful basis for processing your personal data, these vary dependent upon the stage at which your data is processed. If you are currently accessing services with us, or if you are in contact with us to consider services, we will process your personal data where it is necessary for the performance of our contract.

As detailed in the GDPR we will look after any sensitive personal information disclosed appropriately. This is known as ‘special category personal information’. The lawful basis for us processing any special categories of personal information is that it is for provision of health treatment (in this case therapy) and necessary for a contract with a health professional (in this case, a contract between us and you).

Information you provide, and we hold, for client care and services includes:

Personal Information

Full name, date of birth, age
Contact details (address, email address, phone number)
Gender
Pronoun preferences (where required)
Emergency contact information
GP details and other healthcare professionals involved in your care

Health and Therapeutic Information

Relevant medical history and current health conditions
Mental health history
Current medications (if relevant)
Previous counselling or therapy experience (if relevant)
Information about your reasons for seeking therapy
Session notes and therapeutic records
Assessment information
Therapy reports (if required)
Outcome measures and results
Goals and progress in therapy

Financial Information

Payment details for session fees
Billing information

Communication Records

Records of sessions – Written/printed notes are kept as hard copies and locked away in a secure cabinet
Reports (if applicable)
Emails, text messages, phone calls and other correspondence (when relevant)
Contact form submissions
Appointment information

Multiagency Working

If your support involves a multiagency team there may be occasions where information is shared to enhance your care. You will always receive a form prior seeking your consent before anything is actioned in this way. The only time this would be permissible without your consent would be as a result of safeguarding.

Safeguarding

We collect or use the personal information, when required, for safeguarding reasons.

Special Category Data

We process special category data, with your consent and for the delivery of mental health and wellbeing treatment. This includes:

Information regarding health and mental health
Information about ethnicity, religion, sexual orientation (where applicable to therapy)
Information about criminal convictions (where applicable, e.g. safeguarding)

Information collected automatically

Website Usage Data
IP address and browser type
Device information and operating system
Pages visited on our website
Date and time of visits
Referring website
Cookies and similar technologies (scroll down for further information)

How Data is Used

The purposes of processing your personal data include:

Delivery of Therapeutic Services: Arts psychotherapy (drama) and clinical supervision services
Managing appointments: To schedule, confirm, and manage appointments
Client Care: To maintain client/supervisee records and monitor progress
Communication: To reply to inquiries and communicate about services
Billing and Payments: To process payments and maintain financial records
Clinical Supervision: To receive professional supervision (as required by HCPC and BADth)
Safeguarding: To adhere to safeguarding requirements for children and vulnerable adults

We process your data based on:

Consent: we have permission from you after we have provided all the relevant information (particularly for sensitive health data)
Contract: we have to collect or use the information so we can enter into, or carry out, a contract with you
Legal Obligation: we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone
Vital Interests: collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk
Legitimate Interests: For legitimate practice management purposes

Data Sharing and Disclosure

We are subject to a common law duty of confidentiality. However, there are circumstances where we will share relevant health and care information. These are where:

You have provided us with your consent (we have taken it as implied to provide you with care, or you have given it explicitly for other uses). For example with your consent, if appropriate as part of your care, we would share relevant data with:

Other therapists or specialists involved in your care
Family members, carers or support persons
We have a legal requirement (including court orders) to collect, share or use the data; on a case-by-case basis, the public interest to collect, share and use the data overrides the public interest served by protecting the duty of confidentiality (for example sharing information with the police to support the detection or prevention of serious crime)
If in England or Wales – the requirements of The Health Service (Control of Patient Information) Regulations 2002 are satisfied or if in Scotland – we have the authority to share provided by the Chief Medical Officer for Scotland, the Chief Executive of NHS Scotland, the Public Benefit and Privacy Panel for Health and Social care or other similar governance and scrutiny

Confidentiality is maintained when accessing services however, we may share your data in the following cases:

Clinical supervision: case discussions and reflective practice with my professional supervisor or supervision group (as required by HCPC and BADth)
Other professionals: with your consent and for the best interests of the client in order to enhance care (where relevant)
Relevant professionals/organisations for safeguarding reasons, when applicable
Service providers: Trusted third parties for example, where we are contracted with a supplier to carry out specific tasks or sessions are funded and not privately financed. In such cases we have carefully selected which partners we work with. We take great care to ensure that we understand the third party and what they are allowed to do with the data we share with them. We ensure that they do not use your information in any way other than the task for which they have been contracted.

Payment processors (e.g. banks)

IT services (e.g. email)

Exceptions to confidentiality include:

Safeguarding: There is a risk of serious harm to you or others including child protection
Legal Requirements: Required by law, court order, or regulatory body
Terrorism: Prevention of terrorism (under Counter-Terrorism legislation)
Drug Trafficking: Prevention of drug trafficking offenses
HCPC/BADth Requirements: To comply with BADth Ethical Framework and HCPC Standards of conduct, performance and ethics

We do NOT sell your data to third parties

How long we keep information

Termination of therapy services: If you have engaged in therapy and we come to an end, from the date of completion, we adhere to the record retention guidance from the British Association of Dramatherapist’s code of practice (2022). This outlines that: “As a guide, records should be kept for eight years after the termination of therapy. In the case of a minor, notes should be retained until the client’s 25th birthday. However, if the young person was 17 at conclusion of treatment, notes need to be kept until the client’s 26th birthday. If contact resumed after therapy closed, notes need to be kept for 8 years after the last entry of client contact in their record. If client death occurred before their 18th birthday, notes need to be kept for 8 years after death.”
Clinical supervision records: 8 years
If you enquire and make initial contact however, you decide not to proceed working we will ensure all your personal data is deleted within 1 month. This is to align with GDPR that states personal data should not be kept for longer than necessary for the purposes it was obtained/created

Financial Records

Records of payment (including invoices) will be kept for 7 years for tax and accounting purposes.

Destruction of Data

Data will be securely destroyed after their retention period through secure digital deletion and confidential shredding of paper records.

Data Security

We apply the following measures to protect your data:

Location: Private, dedicated therapy room at private practice home address. The room is secure and confidential
Storage: Securely locked cabinets for paper records
Confidentiality: Adhere to HCPC and BADth’s code of conduct
Professional Indemnity Insurance: Fully insured
Enhanced DBS: Current Enhanced DBS clearance, use of update service.
Clinical Supervision: Access regular supervision to ensure best practice
Professional Development: Access regular training and information regarding confidentiality and data protection
Electronic devices and files are password protected
Secure email
Up to date security software
Password protected Wi-Fi

We use UK based systems and physical records at our practice however, it is important to be aware that email services and online counselling platforms may use international servers.

Online and Phone Services

We use:

Secure video conference platforms
Telephone services
Email and text messaging
Online we use encrypted platforms, where possible
You are responsible for your internet security, we recommend using private and secure connections
Sessions are facilitated from a private space

Additional Data Collected

Recordings are not permitted however, should there be a case in which this is relevant this would only take place with explicit consent
Usage data
Connection quality
Chat transcripts (if relevant)

Additional Information for Relevant Services

Associate Work - Therapy/Supervision
Invoicing and billing information shared with relevant organisation (this may include date of attendance)
Session content remains confidential

Clinical Supervision Services
Records maintained separately and confidentially.
Invoicing and billing information shared with relevant organisation if not paid privately by you
Confirmation of supervision shared with consent to relevant bodies/organisation (if required by supervisee)

Considerations

You have a right to access your therapy records
If at any point access could cause serious harm to your physical or mental health it may be limited. This is an extremely rare case
It may be your identity needs to be verified prior to sharing data
To protect other’s privacy, third party information may be redacted

You are responsible for:

Informing us of accurate and up to date information
Declaring any changes to your details
Use of secure communication methods
Use of platforms responsibly
Respect and adhere to cancellation policies
Pay fees as agreed

Lawful Basis for Collecting Data

UK data protection law states we must have a “lawful basis” for collecting and using your personal information. You can find out more about lawful bases on the ICO’s website.

The lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website.

Right of Access: You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for.
Right to rectification: You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
Right to erasure: You have the right to ask us to delete your personal information.
Right to restriction of processing: You have the right to ask us to limit how we can use your personal information.
Right to object to processing: You have the right to object to the processing of your personal data.
Right to data portability: You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
Right to withdraw consent: When we use consent as our lawful basis you have the right to withdraw your consent at any time.

Data Breach Procedures

In the event of a data breach:

Immediate containment and assessment
Notification to ICO within 72 hours (if required)
Notification to affected individuals (if high risk)
Documentation and review to prevent recurrence

How to Complain

The new law means we must offer a clear way to raise a data protection complaint; acknowledge it within 30 days of receipt; without undue delay, take appropriate steps to investigate and keep people informed; and to tell the complainant of the outcome.

Break down of the complaints process

We take all complaints seriously and aim to be responsive and work towards resolution.To make a complaint please contact us via emailing us at: sarahb.dramatherapy@gmail.com

What to include

Your full name and contact details
Clear details of your data protection concern
What has happened and when
How this has impacted you
Copies of relevant documents or correspondence
The outcome you are seeking

Our Response

1.We will confirm receipt of your complaint within 30 days of receiving it. We will, at this point, provide a reference number, explain who will handle your complaint and give you an approximated timeline for a full response. Typically, this would be within one calendar month (or we will inform you of expected timeframe). For any cases that involve more complexities we will continue to keep you informed of progress.

2. We will thoroughly investigate your complaint without undue delay. We will take appropriate steps to addressing your concerns and keep you informed. We will review our data protection practices.

3. We will provide you with a full written response and explanations of our findings. We will share any actions we have taken or will be doing. We will inform you of further steps you can take should you remain dissatisfied.

4. If the investigation into your complaint takes longer than expected we will continue to update you and explain the reasons behind any delays and we will offer a new timeframe for a full response.

Record

Throughout the complaints process we will maintain a record consisting of:

The details of the complaint
Timeline of handling
Actions
Outcomes and resolutions

The Role of the Information Commissioners Office (ICO)

If you are dissatisfied with our response or have not responded within the expected timeframe you have the right to complain to the ICO.

Website: www.ico.org.uk/make-a-complaint
Phone: 0303 123 1113
Email: icocasework@ico.org.uk
Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Prior to contacting the ICO

Please allow us the opportunity to resolve your complaint first and wait for a response for up to one month.

If you remain unsatisfied and the complaint need escalating to the ICO be sure to provide them with copies of your complaint and our responses.

Subject Access Requests (‘SAR’)

You have the right to access and receive a copy of their personal data, and other supplementary information
You can make SARs verbally or in writing
A third party can also make a SAR on behalf of another person
A fee would not be charged
We should respond without delay and within one month of receipt of the request.
The time limit may be extended by a further two months if the request is complex or if a number of requests from the individual have been received
A reasonable search for the requested information should happen
Information should be provided in in an accessible, concise and intelligible format and disclosed securely
Refusal to provide the information can occur if an exemption or restriction applies, or if the request is manifestly unfounded or excessive

Wix websites states their use of cookies is due “to identify your registered members (users who registered to your site), to monitor and analyze the performance, operation and effectiveness of Wix's platform and to ensure our platform is secure and safe to use.”

We use Usercentrics, the cookiebot for Wix websites and consent management service, which complies with GDPR. It offers an auto scan to detect components and third-party trackers requiring consent
Usercentrics is applied as a processor for the purpose of consent management
We only use essential cookies for website functionality
We use analytics which provides anonymous data collection to help us understand website usage and improve performance
Site visitors are made aware of the use of cookies through the cookie banner and thumbprint icon
Visitors to the site can click on the icon anytime to change their consent
Remember your settings and preferences
You can control cookies through your browser settings.

Alterations to Privacy Policy

The privacy policy may be updated periodically
Any changes will be posted on this page
Any significant changes will be directly communicated
Through accessing and using the services this signifies agreement and acceptance with the privacy policy and procedures

This Privacy Policy is compliant with: UK General Data Protection Regulation (UK GDPR), Data Protection Act 2018, Data (Use and Access) Act 2025 (DUAA), Privacy and Electronic Communications Regulations (PECR), BADth Code of Practice, HCPC Standards of conduct, performance and ethics.

Link to ICO