Privacy Policy (GDPR)
Who we are
Data Controller: weRcurious (Naomi Taylor)
Email: hello@wercurious.com
This policy explains what personal information we collect, store and share, and your rights under the UK GDPR and the Data Protection Act 2018.
I work with adults (18+) only.
What we collect
From website forms (contact/newsletter/downloads): name, email, phone, location, nature of enquiry.
Please avoid including detailed personal or sensitive information in website forms; this can be discussed securely during an initial call or session.
From calls/messages, client intake forms, and during therapy (only what’s relevant/necessary): name and contact details, date of birth, address, gender identity (if shared), nationality/ethnicity/religion (if shared), occupation/education, GP details, emergency contact, medical history/medication, presenting issues, relevant background and prior therapy, and the therapist’s brief clinical/process notes.
Lawful bases for using your information
- Therapy for adults & couples; scheduling; clinical records: Contract (Art. 6(1)(b)). Where appropriate, we may also rely on legitimate interests (Art. 6(1)(f)). Special-category health data are processed under Art. 9(2)(h) and Schedule 1 of the Data Protection Act 2018 (health and social care purposes) with appropriate safeguards.
- Enquiries/curiosity calls: Legitimate interests (Art. 6(1)(f)) or pre-contractual steps (Art. 6(1)(b)).
- Newsletter / free downloads (e.g., resources/tips): Consent (Art. 6(1)(a)). You can withdraw consent anytime.
- Payments & accounting: Legal obligation (Art. 6(1)(c)).
- Website security/performance, spam prevention, basic analytics: Legitimate interests (Art. 6(1)(f)).
Email & communications
We may email you about bookings, service changes or essential updates. These are not marketing and you can’t opt out of essential communications related to your care. Between sessions, email/message use is kept to practical matters (e.g., scheduling or payment).
Newsletter / free downloads: If you opt in, we’ll send the item and occasional emails. You can unsubscribe at any time (reply “unsubscribe” or use the link provided).
Cookies & analytics
This site uses essential cookies (security/basic functionality) and may use privacy-respecting analytics to understand overall usage. You can control cookies in your browser. Third-party tools used by weRcurious—such as Calendly (scheduling) and Zoom (video)—have their own cookies and privacy policies.
Browser/device information (e.g., IP address, device, referrer, timestamps) may be processed for security, performance, troubleshooting and aggregated statistics. Disabling cookies may affect site features.
How we store your information
- Paper notes (if used): kept securely and/or confidentially destroyed if transferred to electronic storage.
- Electronic records: stored on password-protected devices and secure email/cloud services. Devices are kept up-to-date and protected. Personal data may be accessed securely by the therapist from outside the UK where services are delivered internationally. Appropriate safeguards are used to maintain confidentiality and data protection.
- Digital administrative tools: administrative and writing tools, including secure digital technologies, may occasionally be used to assist with drafting or organising practice materials. Identifiable client information is not entered into such systems.
- Phone/text/IM: practical communications only; retained during your work and deleted shortly after it ends.
- Email: stored in a secure email account.
- Website forms: entries are emailed to us and may be stored in the site’s secure database as a backup.
- Scheduling & video: if you book online, your name/email and appointment details are processed by Calendly; sessions are conducted via Zoom.
Who we share your data with (processors/third parties)
Only what’s necessary to deliver the service:
- Website & hosting/CMS: WordPress (and our hosting provider), plus performance/security tools (e.g., caching, anti-spam).
- Scheduling: Calendly (processes appointment details on our behalf).
- Video sessions: Zoom (processes session connection data).
- Email & cloud storage: secure email and cloud service providers with appropriate security safeguards.
- Payments: UK bank transfer, Wise and/or PayPal (we do not receive your full card/bank details).
- Supervision & quality of care: see below.
- Safeguarding/legal: information may be shared if there’s a serious risk of harm or a legal duty to disclose.
Some providers may process data outside the UK. Where they do, appropriate safeguards are used (such as adequacy regulations or Standard Contractual Clauses with the UK Addendum).
We do not sell or rent your personal information.
Confidentiality, Supervision & EAPs
Confidentiality
Your information is confidential. It is used for your care and service administration. Records are kept securely with appropriate safeguards.
Supervision
In line with BACP requirements, the therapist at weRcurious receives regular supervision with a suitably qualified therapeutic supervisor to maintain standards of care. Aspects of your work may be discussed in minimised/anonymised form. Your full name and contact details are not revealed. Supervisors are also bound by confidentiality and GDPR.
Employee Assistance Programmes (EAPs)
If you are referred through an Employee Assistance Programme (EAP), some limited personal information (for example, attendance, session dates, and general progress/engagement reports) may be shared with the EAP provider as required under their agreement with you or your employer. The information shared is kept to the minimum necessary; detailed clinical notes are not disclosed unless required by law or safeguarding duties.
Breaking confidentiality
Confidentiality may be broken without consent if there is a serious risk of harm to you or others, or where the law requires disclosure (e.g., terrorism, money laundering, ongoing abuse of a minor or vulnerable adult). Where safe and practicable, we will seek to inform you before disclosure.
Data retention
- Therapy records: normally 7 years from your last session.
- Enquiries that don’t proceed: up to 12 months.
- Newsletter subscribers: until you unsubscribe or after 24 months of inactivity.
- Invoices/financial records: 6 years (tax law).
- Phone numbers and transient messages: these are removed shortly after work ends.
Recording: weRcurious does not permit recording of sessions (in any medium) without prior written agreement. This includes screen recordings, screenshots, or any other method of capturing session content.
Your rights
You can:
- Request access to the data we hold about you.
- Ask for corrections to inaccurate or incomplete data.
- Request erasure or restriction (we may decline where records are required to practise lawfully/ethically).
- Withdraw consent for marketing at any time.
Access requests are considered on a case-by-case basis. Some information may be withheld where disclosure could cause serious harm to the physical or mental health of any individual or would disclose information about another person.
We will normally respond to requests concerning your rights within one calendar month, in accordance with UK GDPR.
Data Protection Concerns and Complaints
If you have any concerns about how your personal information has been collected, stored or used, please contact weRcurious in the first instance at hello@wercurious.com.
We will acknowledge your concern as soon as reasonably practicable, and in any event within 30 days, and will investigate and respond as appropriate.
We aim to resolve concerns informally wherever possible. If you remain dissatisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection matters.
Information about how to make a complaint can be found at ico.org.uk or by calling 0303 123 1113.
Links to other websites
Third-party sites (e.g., Calendly, Zoom, PayPal) have their own policies. Please review them before use.
Changes to this policy
This policy may be updated periodically. Material changes will be shown on this page. Continued use of the website indicates awareness of the updated policy.
Last updated: 10 June 2026