Privacy notice

I’m Rebecca Freestone. I’m a Registered Psychotherapist in Training, working towards accreditation with the UKCP. I practise from 33 Gay Street, Bath BA1 2NT, and online.

My practice operates through Freestone House Ltd, company number 09874714, which is the data controller for the information described here and is registered with the Information Commissioner’s Office under registration number ZC245754.

You can email me at hello@rebeccafreestone.com.

If you write to me or use the form on my contact page, I receive your name, your email address, your telephone number if you give it, and whatever you tell me in your message. I hold this in order to reply and to decide with you whether to begin therapy – under Article 6(1)(b) of the UK GDPR, steps taken at your request before our work together begins.

If we go on to work together, I keep the details you give me when we begin, which may include your contact details and an emergency contact. I also keep a record of session dates and fees, and brief notes on our work. I hold these to provide the therapy we have agreed, again under Article 6(1)(b), and to meet legal obligations such as keeping financial records, under Article 6(1)(c).

The law treats much of this as a special category of information, held to a higher standard of privacy. My basis for holding it is Article 9(2)(h) – the provision of health care by a professional who owes a duty of confidentiality.

If we speak but do not go on to work together, I delete your enquiry after six months. If we do work together, I keep clinical notes for seven years after our final session, the period my professional indemnity insurer requires, and financial records for six years, as HMRC requires. After that, everything is securely destroyed.

What you tell me is confidential. I regularly discuss and reflect on my work with trusted colleagues, as the UKCP requires, who are bound by the same confidentiality. In those conversations I do not reveal names or personal details.

Very occasionally it may be necessary for me to contact another professional, particularly if I feel that anyone’s safety is at risk – but never without discussing it with you first. The law also requires me to disclose information in very specific circumstances, such as those involving terrorism or money laundering.

This website is hosted by Netlify, which stores messages sent through my contact form until I delete them, which I do once I have replied. I use Google Workspace for my email and video calls. My accountant sees financial records.

Netlify and Google are based in the United States, so information they hold may be processed outside the UK. Both commit to safeguards for these transfers in their data processing terms.

I do not sell your information, and I do not use it for marketing.

I keep my notes digitally, protected by a password and two-factor authentication. They are stored separately from your contact information and do not include identifying details.

You can ask what I hold about you and be given a copy; have anything inaccurate corrected; ask me to delete it or to restrict how I use it; object to my using it; and receive it in a portable form. Where you have given your agreement to something, you can withdraw it at any time.

If you are unhappy with how I have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk. I would be glad to hear from you first, if you feel able.

This site sets no cookies unless you agree to them. If you accept, Google Analytics stores cookies on your device so that I can see how many people visit, which pages they read and how they found the site. It does not tell me who you are. My lawful basis is your consent, under Article 6(1)(a).

You can decline, and you can change your mind at any time from the footer of any page. If you withdraw your agreement, the cookies are deleted. Google processes this information outside the UK.

Netlify keeps standard server logs that include visitors’ IP addresses, for security, and the typefaces are served by Google Fonts, which means Google receives your IP address when a page loads.

If this notice changes, the updated version will appear here. Last updated October 2026.