How we collect, use, store, and protect your personal data.
This document is the property of Kensington Square Therapy Ltd. It must not be reproduced in whole or in part without written permission. Uncontrolled when printed.
Confidentiality, Privacy and Safeguarding
At Kensington Square Therapy (KST), privacy and trust are central to the work we do. Therapy involves sharing personal experiences and feelings, and we are committed to protecting the information entrusted to us.
Everything shared in sessions is treated with care, dignity, and respect. In most circumstances, what is discussed remains confidential between the client and their therapist.
However, there may be times when we are legally or ethically required to share limited information to protect someone from serious harm — for example, if a child or vulnerable person is at risk of abuse or significant danger. We take these responsibilities seriously and share information only when necessary, in line with safeguarding law and professional ethical standards.
This Privacy Policy (Privacy Notice) explains how Kensington Square Therapy Ltd (“KST”) collects, uses, stores, shares, and protects personal data in the course of delivering therapy, counselling, and wellbeing services to children, young people, families, and schools.
This notice fulfils KST’s transparency obligations under Articles 13 and 14 of the UK General Data Protection Regulation (UK GDPR) and informs data subjects of their rights under UK data protection law.
This policy applies to all personal data processed by KST, across all settings:
It applies to data relating to children and young people, parents and carers, school staff, referrers, subcontracted therapists and facilitators, website visitors, and enquirers.
This notice should be read alongside the KST Data Protection Policy, Cookie Policy, Safeguarding Policy, and Consent Form.
This policy operates within the following legal and statutory framework:
KST is the independent data controller for all personal data processed in connection with its services. Where KST provides services within a school, KST and the school may operate as independent controllers in respect of their own records. KST does not act as a data processor for schools.
The personal data KST collects depends on the data subject’s relationship with KST. KST collects only information that is necessary and relevant.
KST processes personal data under the following lawful bases as defined by Article 6(1) UK GDPR:
| Processing Activity | Lawful Basis (Art. 6) | Explanation |
|---|---|---|
| Delivering therapy and counselling | Contract (Art. 6(1)(b)) | Necessary for performance of the therapy service agreement with the client or their parent/carer. |
| Safeguarding and child protection | Legal obligation (Art. 6(1)(c)); Vital interests (Art. 6(1)(d)) | Required by Children Act 1989/2004, Working Together 2023, and KCSIE 2024. |
| Clinical record keeping | Legal obligation (Art. 6(1)(c)); Legitimate interests (Art. 6(1)(f)) | Professional and regulatory requirement; legitimate interest in defensible clinical practice. |
| School reporting and communication | Legitimate interests (Art. 6(1)(f)) | Necessary for effective school-based provision; balanced against data subject rights. |
| Parent communication and updates | Contract (Art. 6(1)(b)); Consent (Art. 6(1)(a)) | Contractual where part of service agreement; consent-based for discretionary sharing. |
| Financial administration | Legal obligation (Art. 6(1)(c)) | HMRC accounting and tax obligations. |
| Supervision (clinical) | Legitimate interests (Art. 6(1)(f)) | Professional requirement; names typically anonymised. |
| Website contact form enquiries | Legitimate interests (Art. 6(1)(f)) | Responding to enquiries from prospective clients. |
| Website analytics (cookies) | Consent (Art. 6(1)(a)) | Consent obtained via cookie consent mechanism (see Cookie Policy). |
Therapy notes, clinical assessments, and safeguarding records contain health-related special category data. KST processes this data under the following conditions:
KST processes the personal data of children and young people in accordance with the ICO’s Children’s Code (Age Appropriate Design Code) principles. Where a child is assessed as Gillick competent, KST will seek the child’s own views regarding data sharing, particularly in relation to progress updates to parents and schools.
KST does not profile children, make automated decisions about children, or use children’s data for marketing purposes.
KST respects confidentiality and shares personal data only when necessary, lawful, and proportionate. KST will aim to discuss any necessary sharing with the data subject (or their parent/carer) in advance, unless doing so would increase risk to a child or vulnerable person.
KST may share limited personal data with the following recipients:
KST does not sell, rent, or trade personal data. KST does not share personal data for marketing purposes.
KST uses secure, encrypted systems to store and manage personal data:
Security measures include:
Google Workspace data may be processed on servers located outside the United Kingdom. Google LLC operates under UK International Data Transfer Agreement (IDTA) safeguards and has certified compliance with applicable data protection standards.
Kiku stores clinical data on UK-based servers. No clinical data is transferred outside the United Kingdom.
KST reviews the transfer mechanisms of its data processors annually and will update this notice if the legal basis for international transfers changes.
KST retains personal data only for as long as necessary. The following retention periods apply:
| Record Type | Retention Period | Legal Basis |
|---|---|---|
| Therapy notes (child clients) | Seven years after end of therapy, or until the child reaches age 25, whichever is longer | Limitation Act 1980; professional guidance |
| Therapy notes (adult clients) | Seven years after end of therapy | Limitation Act 1980 |
| Safeguarding records | Retained in line with local authority guidance; may exceed standard retention | Children Act 1989; Working Together 2023 |
| Consent forms | Duration of therapy plus seven years | Contractual and legal obligation |
| Invoices and financial records | Six years from end of financial year | HMRC requirements; Finance Act |
| Subcontractor records (DBS, insurance) | Duration of engagement plus six years | Legal obligation; insurance requirements |
| Website contact form submissions | Twelve months, or until enquiry resolved | Legitimate interests |
| Complaints records | Six years from date of closure | Limitation Act 1980 |
| DSAR records | Three years from date of response | ICO accountability requirements |
After the applicable retention period, records are securely deleted (electronic) or destroyed by cross-cut shredding (paper). Deletion is logged.
Under UK GDPR, data subjects have the following rights:
To exercise any of these rights, contact the Data Protection Lead at [email protected]. KST will respond within one calendar month. Identity verification may be required before information is released. Complex or numerous requests may be extended by a further two months, with notification provided within the first month.
Where a request is made by a parent on behalf of a child who is assessed as Gillick competent, KST will consider the child’s own views before responding.
Confidentiality is central to effective therapy but cannot be absolute. KST may share limited personal data without the data subject’s consent where:
Any such sharing is proportionate, recorded, and reported to the Director (as DSL). For full details, see the KST Safeguarding Policy.
When therapy concludes, records are securely stored for the applicable retention period set out in Section 11.
If a child changes school or moves to another therapist, KST can provide a brief handover summary to the new provider with written consent from the parent (and the young person’s consent, where the child is Gillick competent). Records are never transferred automatically.
At the end of the retention period, records are securely deleted or destroyed. KST encourages discussion about record management at the conclusion of therapy.
In the event of a personal data breach, KST will follow the KST Data Breach Response Plan (v1.0-2026). Where a breach poses a risk to the rights and freedoms of individuals, KST will notify the Information Commissioner’s Office within 72 hours and, where the risk is high, will notify affected individuals without undue delay.
| Risk | Mitigation | Likelihood | Impact |
|---|---|---|---|
| Unauthorised access to clinical records | Kiku access controls; MFA; device encryption; annual access review | Low | High |
| Data shared without lawful basis | Lawful basis documented per processing activity; consent forms; staff training | Low | High |
| Retention periods not enforced | Retention schedule maintained; annual deletion review; deletion logged | Medium | Medium |
| DSAR not responded to within statutory timeframe | DSAR procedure documented; response template maintained; Director tracks deadlines | Low | Medium |
| International transfer safeguards change | Annual review of processor transfer mechanisms; IDTA monitoring | Low | Medium |
| Child’s Gillick competence not assessed before sharing | Gillick assessment documented; therapist training; consent form addresses this | Low | High |
| Data breach not detected or reported | Breach response plan; incident reporting training; Kiku audit logs; Google Workspace audit | Low | High |
All records are stored securely within Google Workspace with access restricted to the Director.
Training completion is recorded in the KST Training Log.
If you have any questions or concerns about how KST handles your personal data, please contact:
If you are dissatisfied with how your data has been handled, you have the right to lodge a complaint with the Information Commissioner’s Office:
KST recommends raising any concern with the Data Protection Lead in the first instance, as many issues can be resolved directly and promptly.
This policy will be reviewed annually or sooner if:
| Version | Author | Approved By | Date Issued | Review Date | Summary of Changes |
|---|---|---|---|---|---|
| 1.0 | Sam McManus | Sam McManus | October 2025 | October 2026 | Initial release |
| 2.0 | Sam McManus | Sam McManus | February 2026 | February 2027 | Major revision: restructured to 24-section governance format; lawful basis table added; retention schedule table added; international transfers section added; children’s data and Gillick competence addressed; risk register added; DPIA position stated; governance maturity assessment added |