Privacy policy

Updated: October 2026

Who I am

This privacy notice explains how I collect, use, store and protect your personal information. It applies to anyone who contacts me, whether or not you go on to become a client.

I am Samantha Devlin, trading as Sam Devlin Psychotherapy, a sole trader based in Worthing, West Sussex. I am the data controller for the personal information described here, which means I decide how and why it is used. I am registered with the Information Commissioner’s Office (ICO) and pay the annual data protection fee.

You can contact me about anything in this notice at hello@samdevlinpsychotherapy.com.

What I collect

  • Enquiry details: your name, contact details and anything you tell me when you get in touch through my website, by email or phone, or through a directory such as Counselling Directory, Psychology Today or the BACP therapist directory.

  • Intake details: your contact details, date of birth, GP details and an emergency contact.

  • Session records: brief, factual notes about our sessions, which may include information about your health and wellbeing.

  • Communications: emails and messages between us, which form part of your record.

  • Appointment and payment details: session dates, attendance, fees paid and how you paid.

Use of your information

I use your information to respond to your enquiry, provide therapy, manage appointments and payments, keep appropriate records, and protect you or others from serious harm.

UK data protection law requires me to have a lawful basis for this:

  • Most of what I hold is needed to provide the therapy we have agreed (contract).

  • I keep financial records because the law requires it (legal obligation).

  • I use your emergency contact and GP details only where needed to protect you or someone else (vital interests or legitimate interests).

Information about your health is special category data. I process it to provide a health service, under the professional duty of confidentiality that applies to therapists.

The tools and services I use

I assess the risks of any digital tool before I use it, in line with the BACP Ethical Framework. These are the services that hold or process your information:

  • Microsoft 365 (business account): email, online sessions on Microsoft Teams, and secure storage of my notes and records.

  • Squarespace: my website and its contact form.

  • Tap to Pay & Stripe: card payments taken in person.

  • My bank: payments made by bank transfer.

I don’t record sessions, and recording and transcription are switched off in Teams. I don’t use Microsoft Copilot or any other AI tool with your records, and I never put information that could identify you into AI tools.

Some of these providers may store or process data outside the UK. Where they do, they use the legal safeguards UK law requires.

Who I share it with

I don’t sell or share your information for marketing. I share it only in these circumstances:

  • Supervision: I discuss my work with my clinical supervisor, without your name or details that could identify you.

  • If I am unexpectedly unable to work: a trusted colleague, named in my clinical will and bound by confidentiality, would have access to your contact details and appointment times so they could let you know what is happening.

  • To keep people safe: if I believe there is a serious risk of harm to you or someone else, or there are safeguarding concerns about a child or an adult at risk, I may share necessary information with your GP, your emergency contact, safeguarding services or the emergency services. Wherever it is safe to do so, I will talk to you first.

  • Where the law requires it: for example, a court order.

  • My accountant: financial records only, never anything about our sessions.

How long I keep it

  • Session records and communication: 5 years after our work ends

  • Financial records: As long as tax law requires

  • Enquiries that don’t lead to therapy: Deleted within 12 months

At the end of these periods, I delete your information securely.

How I protect it

Your records are stored in my password-protected Microsoft 365 business account, with multi-factor authentication. Only I have access to them. Your notes are kept separately from your contact details.

If something goes wrong, such as an email sent to the wrong person, I will act quickly to limit any harm and tell you what happened. Where the law requires, I will report it to the ICO within 72 hours. If there is a high risk to you, I will let you know without delay.

Your rights

You have the right to:

  • ask for a copy of the information I hold about you

  • ask me to correct anything that is inaccurate

  • ask me to delete your information, unless I need to keep it by law

  • ask me to limit how I use it, or object to my using it

  • ask for your information in a format you can take elsewhere.

To make a request, email me at hello@samdevlinpsychotherapy.com. I will reply within one month.

Concerns and complaints

If you are unhappy with how I have handled your information, please contact me first at hello@samdevlinpsychotherapy.com. I will acknowledge your complaint within 30 days, look into it, and let you know the outcome.

If you are still not satisfied, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Using this website

My website is hosted by Squarespace, which uses cookies and collects anonymous visitor statistics. When you use the contact form, your name, email and message are sent to me so I can reply.

Changes to this notice

I review this notice regularly and will update it if anything changes.