Privacy Notice

Last updated: 17 June 2026

Introduction

This privacy notice explains how I, Christian Hughes, collect, use, store and protect personal information in connection with my psychotherapy, EMDR, clinical supervision and training services, and through my website at www.christiankhughes.com.

I am the data controller for the information described here, which means I am responsible for deciding how your personal information is held and used. For the purposes of UK data protection law, my contact details are:

Christian Hughes St John's Chambers, 11 St John's Road, Stourbridge, West Midlands, DY8 1EJ Email: hello@christiankhughes.com Telephone: 01384 931 056

I am registered with the Information Commissioner's Office as a data controller, registration number ZB546616.

I take the confidentiality of your information seriously, both as a legal obligation under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and as a core part of my professional and ethical duties as a BABCP-accredited psychotherapist.

This notice applies to clients, prospective clients, supervisees, workshop participants, and visitors to my website.

The information I collect

Depending on how you interact with me, I may collect and process the following:

Identity and contact information: your name, date of birth, postal address, email address and telephone number.

Health and clinical information: this is the core of what I hold if you become a client. It includes the reasons you are seeking therapy, your relevant history, assessment and session notes, risk information, and any correspondence with your GP or other professionals involved in your care.

Other special category and sensitive information: in the course of therapy you may disclose information about your physical or mental health, your sexual life or orientation, your religious or philosophical beliefs, your racial or ethnic origin, or information relating to criminal offences. I process this only where it is necessary for your care.

Supervision information: if you are a supervisee, I hold your professional and contact details and records of our supervision. Where you discuss your own clients in supervision, I expect that information to be anonymised.

Financial information: records of payments and invoices. I do not collect or store your card or bank details. Payments are taken through third-party providers (see "Payments" below).

Enquiry and correspondence information: the content of any enquiry or message you send me, and my replies.

Website and technical information: when you visit my website, limited technical data such as your IP address, browser type, device information and pages visited may be collected, largely through my website platform and any cookies you consent to (see "Cookies" below).

Where your information comes from

Most of the information I hold comes directly from you. In some cases I may receive information from a third party, for example a GP, an organisation funding your treatment, an insurer, or a person referring you, where you have agreed to that referral.

How I use your information, and my lawful bases

Data protection law requires me to have a lawful basis for processing your personal information. The bases I rely on are set out below.

To provide the therapy, EMDR, supervision or training you have asked for. Lawful basis: performance of a contract with you, or taking steps at your request before entering into a contract.

To process the health and other special category information necessary for your care. As this is special category data, I rely on an additional condition: that the processing is necessary for the provision of health treatment and is carried out by a health professional who owes a duty of confidentiality (Article 9(2)(h) UK GDPR), together with the associated condition in Schedule 1 of the Data Protection Act 2018.

To manage and administer my practice, including scheduling, record-keeping, taking payment and responding to enquiries. Lawful basis: my legitimate interests in running my practice safely and efficiently, where these are not outweighed by your rights.

To meet my legal and professional obligations, for example keeping financial records for HMRC, complying with a court order, or acting on my safeguarding and duty-of-care responsibilities. Lawful basis: compliance with a legal obligation, and, where safeguarding involves health information, the vital interests or substantial public interest conditions where they apply.

To send you service updates or marketing, only where you have asked to receive them. Lawful basis: your consent, which you can withdraw at any time.

If I ever needed to use your information for a purpose not described here, I would tell you and, where the law requires it, ask for your consent first.

Confidentiality and its limits

Everything you share with me as a client is treated as confidential and is held within a professional therapeutic relationship governed by the BABCP Standards of Conduct, Performance and Ethics.

There are limited circumstances in which I may need to share information without your consent, in line with my professional obligations. These include where I judge there is a serious risk to your safety or the safety of others, where there is a safeguarding concern involving a child or vulnerable adult, or where I am required to disclose by law or by a court order. Wherever it is safe and appropriate to do so, I will discuss this with you first.

I also discuss my clinical work in supervision, which is a professional requirement. I keep your identity anonymised in supervision wherever possible.

Who I share your information with

I do not sell your information, and I do not share it for marketing. I may share it with:

Service providers who help me run my practice, including my clinical records and practice management system (WriteUpp), my website platform (Wix), video consultation software (Zoom) for online sessions, and payment providers (see "Payments" below). These act on my instructions and are bound to keep your information secure.

Your GP or other healthcare professionals, where this is necessary for your care and you have agreed, or in the limited risk and safeguarding situations described above.

Insurers or funding organisations, where your treatment is being paid for or arranged through them and you have agreed to this.

Professional or legal advisers, and regulators such as the Information Commissioner's Office, where I am required or permitted to do so.

Payments

I do not take or store your card or bank details. When you make a payment, you are passed to a secure third-party payment provider. Depending on how the payment is taken, this may be Stripe (which processes payments made through WriteUpp), PayPal, or Wix Payments. Their handling of your information is governed by their own privacy notices.

Storing your information and international transfers

Your information is stored securely, using access controls, encryption and other appropriate safeguards. Clinical records are held on a system designed for that purpose.

Some of the providers I use (for example for website hosting, video calls or email) may store or process data on servers outside the UK. Where that happens, I take reasonable steps to ensure your information is protected by safeguards recognised under UK data protection law, such as the UK's adequacy regulations or standard contractual clauses.

How long I keep your information

I keep your information only for as long as I need it.

For clients, I retain clinical records for seven years after the end of our work together, in line with professional and indemnity guidance.

For enquiries that do not become a working relationship, I keep correspondence for a short period and then delete it.

For financial records, I keep information for the period required by HMRC, currently at least six years.

Once the relevant period has passed, I securely destroy or delete your information.

Your rights

Under data protection law you have the following rights:

to be informed about how I use your information, which this notice is intended to provide;
to ask for a copy of the information I hold about you (a subject access request);
to ask me to correct information that is inaccurate or incomplete;
to ask me to delete your information, in certain circumstances;
to ask me to restrict or object to certain uses of your information;
to ask for your information to be transferred to another provider, where this applies; and
to withdraw your consent at any time, where I rely on your consent.

Some of these rights are qualified. For example, I may not be able to delete clinical records that I am professionally or legally required to keep, even if you ask me to. If a right does not apply to your situation, I will explain why.

I do not make decisions about you based solely on automated processing, and I do not use your information for profiling.

To exercise any of these rights, please contact me at hello@christiankhughes.com. I will respond within one month. I may need to confirm your identity first, in order to protect your information.

Cookies

My website is built on the Wix platform, which uses cookies. Cookies are small files placed on your device. Some are necessary for the site to work, while others help measure how the site is used. When you first visit, Wix displays a banner that lets you accept or decline non-essential cookies, and you can change or withdraw your choice at any time through that banner or your browser settings. Blocking some cookies may affect how parts of the site work.

How you can complain

If you are unhappy with how I have collected or used your personal information, you have the right to complain directly to me. You can do this by emailing hello@christiankhughes.com, or by writing to me at St John's Chambers, 11 St John's Road, Stourbridge, West Midlands, DY8 1EJ.

I will acknowledge your complaint within 30 days of receiving it, take appropriate steps to look into it, keep you informed of progress, and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator. You can do this online at https://ico.org.uk/make-a-complaint/, or by calling their helpline on 0303 123 1113. You do not have to raise your concern with me first, although I would welcome the opportunity to put things right before you approach the ICO.

Children

My services and website are intended for adults aged 18 and over. I do not provide therapy or supervision to anyone under 18, and I do not knowingly collect information from children through my website.

Changes to this notice

I may update this notice from time to time. The version published on my website is the one that applies. I recommend you review it occasionally.

If you have any questions about this notice or about how I handle your information, please contact me at hello@christiankhughes.com.