PRIVACY INFORMATION

Blue Kangaroo Services Ltd (trading as Oak House Therapy)

Last reviewed: May 2026

The data controller for your personal information is Blue Kangaroo Services Ltd, trading as Oak House Therapy. We are registered with the Information Commissioner’s Office (ICO). If you have any questions about this notice, our data practices, or information about our clinical executor or data processor arrangements, please contact us:

Email: hello@oakhousetherapy.co.uk

In order to provide you with the best service possible we need to hold your personal contact details and strictly coded, pseudonymised records of your therapy sessions. This privacy notice tells you what we do with your personal information from initial point of contact through to after therapy has ended.

Your privacy is very important to us. You can be confident that your personal information will be kept safe and secure and will only be used for the purpose for which it was given to us. We adhere to the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003. We also adhere to the ethical guidelines regarding protecting client privacy and confidentiality set by the British Association for Counselling and Psychotherapy (BACP).

The UK GDPR requires us to have a lawful basis for processing your personal data. The following sets out what we process, why, and the lawful basis we rely on:

• Name and contact details — collected at initial contact to book, confirm and rearrange appointments. Lawful basis: performance of contract.
• Name, address, date of birth, contact details, GP contact information — collected on your personal details form at the start of therapy. Lawful basis: performance of contract.
• Pseudonymised session notes — kept as a clinical record to support our work together. Lawful basis: performance of contract.
• Name, date of birth, client reference number — retained after therapy ends to link your identity to your pseudonymised notes if needed. Lawful basis: legitimate interests.
• Financial records and invoices — retained to meet tax and accounting obligations. Lawful basis: legal obligation.
• Special category data: Your therapy sessions involve sensitive personal information about your health and mental wellbeing. This is classified as special category personal data under the UK GDPR. Our lawful basis for processing this is that it is necessary for the provision of counselling and psychotherapy services, including health treatment, and is carried out subject to a professional obligation of confidentiality. The relevant special category condition is Article 9(2)(h) of the UK GDPR, supported by Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018 — health or social care.

We use your personal data only for the provision, administration, safeguarding, supervision, legal, accounting and professional governance purposes connected with the services we provide. We will only retain your personal information for as long as is necessary.

4.1 When you first make contact

When you contact us to enquire about or book an appointment we will collect your name and a contact method (email address or phone number). This allows us to confirm appointments and to contact you if we are unable to attend due to unforeseen circumstances. You do not need to provide a contact method if you prefer not to be contacted.
In some cases an organisation such as your employer may refer you to us, or a relative may make an enquiry on your behalf. In these situations we will handle any personal data passed to us in accordance with this notice.
If you make an enquiry and decide not to proceed, all your personal data will be deleted within one month. If you would like it deleted sooner, please let us know.

4.2 While you are having therapy

We may contact you by email, phone or message where this is necessary to provide the service and where we have agreed that this is an appropriate way to communicate with you. We will only contact you for other purposes if we have specifically agreed this with you.
At the beginning of your first session we will ask you to complete a personal details form containing your name, address, date of birth, contact information and your GP’s contact details. This form is stored on a password-protected online drive accessible only to us.

4.2.1 Your GP: We will not routinely contact your GP to inform them of your attendance, as this is confidential. We will only contact your GP if it is necessary to fulfil our duty of care to you, and where possible we will discuss this with you before making contact.

4.2.2 Confidentiality in sessions: What you share in your sessions will be kept confidential. Therapists providing services under Oak House Therapy are members of the BACP and abide by their professional code of ethics. Confidentiality will only be broken if there are legal or ethical obligations to disclose, for example:

• if you disclose abuse or neglect of a child or vulnerable adult
• if you say something that implies serious harm to yourself or others
• if a court of law requires us to disclose information

In the event that confidentiality must be broken, we will always try to speak to you about this first, unless there are safeguarding issues or legal obligations that prevent this.

4.2.3 Supervision: Therapists are required to have regular supervision. We may discuss our work with a supervisor without identifying you. Our supervisor is a qualified counsellor who also abides by the BACP code of ethics regarding confidentiality.

4.2.4 Session notes: We keep brief, pseudonymised notes of our therapy sessions to assist our work together. These notes do not include any personal details that could be used to identify you. They are stored securely and separately from your personal details form.

4.3 After therapy has ended

4.3.1 Financial records: Personal information relating to invoices and payments is retained for as long as legally required for tax and accounting purposes.

4.3.2 Session notes: Your pseudonymised therapy notes are retained for seven years after therapy ends, in line with BACP guidance. After seven years they will be confidentially destroyed.

4.3.3 Identifying information: We will retain your name, date of birth and client reference number for seven years after therapy ends. This allows us to locate your pseudonymised notes if necessary. Your personal details form is destroyed at the end of therapy.

4.3.4 Minors: Where a client is under 18 at the start of therapy, we may retain records for a longer period in line with legal, insurance and professional requirements.

We have made arrangements for a clinical executor to manage our client records responsibly in the event that we become unable to practise. This person is bound by professional confidentiality obligations and would ensure that records are stored securely and destroyed in accordance with our retention policy. If you would like details of this arrangement, please contact us at hello@oakhousetherapy.co.uk.

We share a limited amount of personal data with third parties only where necessary to provide our services or to meet our legal obligations. We do not pass your contact details to any third-party organisations for sales, marketing or research purposes.

• Our accountant — invoices (which may include your name) are shared for tax and accounting purposes.
• Referring organisation (where applicable) — if your appointments are paid for or arranged by a third party such as your employer, we share only your dates of attendance and non-attendance for invoicing purposes. The content of your sessions remains confidential.
• Data processors — We use trusted third-party providers to support the secure running of the practice, including email, website hosting, cloud storage, video calls, accounting, secure record administration and messaging where relevant. These providers process personal data only where necessary to provide services to us. Where required, appropriate data-processing agreements or contractual safeguards are in place. These providers act as data processors on our behalf and are contractually bound to process your data only on our instructions and not for any other purpose. If you would like details of the specific processors we use, please contact us at hello@oakhousetherapy.co.uk.
• International transfers —Some of the technology providers we use may process data outside the UK. Where this happens, we rely on appropriate safeguards under UK GDPR, such as adequacy regulations, standard contractual clauses, or equivalent contractual protections.

We take the security of your personal data very seriously. Our measures include:

• Password protection on all email accounts, mobile phones and laptops used in our work
• Anti-virus protection on all devices used to process your data
• Secure, password-protected online storage for your personal details form
• Email correspondence that is no longer needed is deleted within one month; where it is necessary to retain information, it is stored securely within our encrypted digital environment
• Session notes are stored separately from your personal details

8.1 Data breaches

In the unlikely event of a personal data breach, we have a breach response procedure in place. Where a breach is likely to result in a risk to individuals’ rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it, as required by the UK GDPR. Where a breach is likely to result in a high risk to you personally, we will also notify you directly without undue delay.

8.2 Your rights

Under the UK GDPR you have the following rights in relation to your personal data:

• Right of access — you can ask to see the personal information we hold about you
• Right to rectification — you can ask us to correct inaccurate information
• Right to erasure — you can ask us to delete your personal data in certain circumstances
• Right to restriction — you can ask us to restrict how we use your data in certain circumstances
• Right to object — you can object to processing in certain circumstances
• Right to data portability — where processing is carried out by automated means and based on your consent or a contract, you can ask us to provide your data in a portable format

You can read more about your rights at ico.org.uk/your-data-matters.

To make a request relating to any of the rights above, please contact us in writing at hello@oakhousetherapy.co.uk. We will respond within one month. Requests are processed free of charge, though we reserve the right to charge a reasonable administrative fee or to refuse requests that are manifestly unfounded or excessive. In certain situations we may be unable to comply — for example if we are required to retain records by a court of law.

Complaining to us directly

If you have a concern about how we have handled your personal data, we encourage you to raise it with us first. You can do this by emailing hello@oakhousetherapy.co.uk with the subject line “Data complaint”. We will acknowledge your complaint within 5 working days and aim to resolve it within 3 months. We will also inform you of your right to escalate to the ICO if you are not satisfied with our response. We keep a record of all complaints and our responses for six years.

You can read our full Data Protection Complaints Procedure here.

9.1 Escalating to the ICO

If you are unhappy with how we handle your personal data, please contact us first so we can try to resolve the issue. You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection matters here.

This privacy notice may be updated from time to time to reflect changes in our practice or in data protection law. The date of the most recent review is shown at the top of this notice.

Blue Kangaroo Services Ltd (trading as Oak House Therapy) is registered in England and Wales No. 14382429
Registered office: 7 Wheatcroft Business Park, Edwalton, Nottingham NG12 4DG
Registered with the Information Commissioner’s Office No. ZC152904