Privacy Policy
Last updated: 2 November 2026

At Creative Refresh, I respect your privacy and am committed to protecting your personal data. This Privacy Policy explains how I collect, use, store, and protect personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025, the Privacy and Electronic Communications Regulations 2003 (PECR), and relevant professional standards.

This policy applies to information collected through my website, during initial enquiries, and as part of the therapeutic services provided by Creative Refresh.

1. Data Controller Details

Creative Refresh is the data controller responsible for your personal data.

  • Business Name: Creative Refresh

  • Data Controller / Practitioner: Paul Weedon

  • Contact Email: paul at creativerefresh.co.uk

  • ICO Registration Number: ZC072123

If you have any questions about this Privacy Policy or how I handle your personal data, please contact me at the email address above.

2. Professional Memberships and Standards

Creative Refresh operates in accordance with applicable professional, ethical, and practice standards. These professional standards help ensure that client information is managed securely, ethically, and in accordance with legal and professional requirements.

3. What Personal Data I Collect

I may collect and process the following types of personal data:

  • Contact & Identity Data: Name, address, email address, and telephone number.

  • Emergency Contacts: Name and contact details of an emergency contact.

  • Enquiry Data: Information submitted through my website contact form, email, or social media channels.

  • Therapeutic & Health Data: Information relevant to therapy, including personal circumstances, psychological wellbeing, and health-related information.

  • Session Records: Clinical notes, session records, and client records.

  • Correspondence: Direct communications between you and me.

  • Financial Data: Payment information and transaction records, where applicable.

I only collect personal data that is necessary to respond to enquiries, provide safe and effective therapeutic services, manage appointments, maintain clinical records, and meet legal, safeguarding, professional, and insurance obligations.

4. Website and Initial Enquiries

When you contact Creative Refresh through my website, by email, or via social media, I collect the information you provide (e.g. name, email address, phone number, and brief enquiry details) to respond to your request and arrange an initial consultation.

  • Unconverted Enquiries: If an initial enquiry does not proceed to therapy, your enquiry details and correspondence will be securely deleted after 6 months.

  • Sensitive Details: Please avoid submitting highly sensitive medical or personal information through initial website contact forms unless necessary.

5. Special Category Data

As part of providing therapy, I process special category data (specifically health-related information, emotional wellbeing details, and therapy history). This type of data requires additional protection under UK GDPR.

6. Lawful Basis for Processing

Under UK data protection law, I rely on the following lawful bases to process personal data:

  • Article 6(1)(b) Contract: Where processing is necessary to deliver, or take pre-contractual steps to deliver, therapeutic services.

  • Article 6(1)(f) Legitimate Interests: Where processing is necessary for the effective, safe, and lawful running of my practice (e.g., responding to initial enquiries, managing appointments, maintaining clinical records, safeguarding, supervision, managing insurance, and legal compliance).

For processing special category (health) data, I rely on additional conditions under UK GDPR Article 9:

  • Article 9(2)(h): Provision of health or social care treatment and management.

  • Article 9(2)(a): Explicit consent, where applicable.

7. Why I Use Your Data

I use your personal data to:

  • Respond to initial enquiries and manage bookings.

  • Provide tailored, safe, and ethical therapeutic support.

  • Maintain appropriate clinical records and session notes.

  • Respond to and manage safeguarding concerns.

  • Meet legal, ethical, professional, safeguarding, and insurance obligations.

  • Defend or establish legal claims, if required.

8. Confidentiality and Data Sharing

Your personal and clinical information is treated with strict confidentiality. I will not sell, rent, or share your personal data with third parties for marketing purposes.

Your information will only be shared without your consent in exceptional circumstances, including:

  • Where there is a serious risk of harm to you or another person.

  • Where child or adult safeguarding concerns arise.

  • Where required by law, statutory obligation, or court order.

  • To prevent or detect serious crime.

  • Where required for legal, insurance, or professional defense reasons.

Any decision to share information without consent will be made carefully, proportionately, and in line with legal and professional codes of conduct.

9. Clinical Supervision

In accordance with professional body standards, I participate in regular clinical supervision to ensure safe, high-quality, and ethical practice.

During clinical supervision, client work may be discussed. Identifying information (such as full names or specific location details) is removed or minimised. Clinical supervisors are bound by strict professional confidentiality duties.

10. Safeguarding Responsibilities

I have professional and statutory responsibilities to safeguard young people and vulnerable adults. If safeguarding concerns arise, information may be shared with relevant safeguarding lead professionals, local authorities, statutory bodies, or medical professionals. Where appropriate and safe to do so, I will discuss safeguarding referrals with you beforehand.

11. Data Processors and Third-Party Services

I use trusted third-party service providers (data processors) to support the running of my practice and website. These technical services include:

  • Web hosting and domain service providers.

  • Secure email and cloud storage providers.

  • Online communication platforms (e.g. Zoom).

All third-party processors are expected to process personal data securely in compliance with UK GDPR standards and under strict confidentiality obligations.

12. Online and Remote Therapy

Where therapy or consultations take place online (via video call) or over the telephone:

  • Sessions are conducted using secure, password-protected communication tools with waiting rooms enabled where appropriate.

  • Sessions will not be recorded (audio or video) without prior written consent from both parties.

  • Clinical notes taken during or after online sessions are stored with the same security measures as face-to-face practice records.

  • Clients are encouraged to attend sessions from a private, secure location with a stable internet connection.

13. Social Media and External Links

My website links to my official Instagram account (@creativerefreshtherapy). Instagram operates independently under Meta and maintains its own privacy policies. I am not responsible for the data collection and tracking practices of external social media platforms.

14. Data Retention

I keep personal data only for as long as necessary to fulfill the purposes for which it was collected, and to comply with legal, professional, safeguarding, and insurance requirements:

  • Initial (Unconverted) Enquiries: Retained for 6 months from the date of last contact, after which emails and messages are deleted.

  • Adult Client Records: Retained for 8 years following the conclusion of therapy.

Upon reaching the end of the mandatory retention period, digital records are permanently erased and paper records are securely shredded.

15. Security Measures

I implement appropriate technical and organizational measures to keep your data safe from loss, unauthorised access, misuse, or disclosure. Security measures include strong password protection, device encryption, restricted file access, secure email protocols, and regular review of digital security arrangements.

16. Your Data Protection Rights

Under UK data protection laws, you have rights regarding your personal data:

  • Access: The right to request copies of your personal data and clinical notes.

  • Rectification: The right to request correction of inaccurate or incomplete data.

  • Erasure: The right to request deletion of your data (subject to legal or insurance requirements to retain clinical notes).

  • Restriction: The right to request that I restrict the processing of your data.

  • Data Portability: The right to request transfer of your data to another provider where applicable.

  • Objection: The right to object to processing based on legitimate interests.

  • Withdraw Consent: Where processing is based on consent, you have the right to withdraw it at any time.

To exercise any of these rights, please contact me at [email protected].

17. Complaints

If you have any questions or concerns about how your data is handled, please contact me in the first instance so I can investigate and address your concern.

If you remain dissatisfied, you have the right to lodge a complaint with the UK supervisory authority:

  • Information Commissioner’s Office (ICO)

  • Website: ico.org.uk

  • Helpline: 0303 123 1113

If your concern relates to professional conduct or standards of care, you may also contact my registering professional body.

18. Changes to This Policy

I may update this Privacy Policy from time to time to reflect changes in legal requirements or my clinical practice. The most recent version will always be published on my website.