Who I am
weRcurious is the counselling and psychotherapy practice of Naomi Taylor.
Data Controller: Naomi Taylor, weRcurious
Email: hello@wercurious.com
This Privacy Policy explains what personal information I collect, why I collect it, how it is used and stored, when it may be shared, and your rights in relation to your personal information.
I work with adults aged 18 and over.
Information I may collect
If you contact me about counselling, psychotherapy or another professional service, I may collect information such as your:
- name and contact details
- date of birth and address
- location or country of residence
- occupation or education
- GP and emergency contact details
- relevant medical history and medication
- presenting concerns and reasons for seeking support
- relevant personal, family and relationship history
- previous therapeutic support
- information you choose to share about matters such as gender identity, nationality, ethnicity, religion or other aspects of your identity
During our work together, I may also keep brief clinical or process notes relevant to the therapeutic work.
If you comment on a blog post on this website, information you provide in the comment form may be collected together with technical information used for website security and spam prevention. Approved comments may be publicly visible. Please do not include personal, sensitive or confidential information in public comments.
The website may also process limited technical information, such as IP address and information about website requests, for security, fraud prevention and website operation.
Lawful basis for processing
Different lawful bases may apply depending on the information and the reason it is being processed.
For counselling, psychotherapy and related professional services, personal information may be processed because it is necessary to provide the service you have requested and to manage our therapeutic agreement.
I may also process information where I have a legitimate interest in doing so, for example in responding to enquiries, maintaining appropriate professional records, managing my practice and maintaining the security and operation of my website.
Where information concerns health or other special-category personal data, it is processed only where an appropriate lawful condition for processing such information applies.
Some information must be retained or processed because of legal, financial, safeguarding or professional obligations.
Email and communications
Email is used for enquiries, appointments, administrative communication and, where appropriate, information connected with our work together.
Emails are stored within a secure, access-controlled Google Workspace account and may be accessed through email applications on password-protected personal devices.
Client intake and client details forms returned by email may remain within the secure email account. Copies used as part of the client record may also be printed and stored securely.
Phone, text or messaging services such as WhatsApp may be used for practical communication where appropriate. These communications are normally deleted when our work ends or shortly afterwards, usually within two weeks.
Please avoid sending highly sensitive information through ordinary email or messaging unless necessary.
Therapy records
Brief clinical or process notes are normally kept as paper records in secure locked storage.
Client intake and details forms may also be held as paper records in secure locked storage, with the original electronic forms retained within my secure email account.
Records are kept only to the extent reasonably necessary for professional practice, continuity of care, safeguarding, legal or regulatory responsibilities.
Website analytics
This website uses Matomo Analytics to help me understand how the website is being used.
Matomo is hosted within the website rather than using Google Analytics. It has been configured to minimise the information collected about visitors. Tracking is cookieless, IP addresses are anonymised, and unnecessary information contained in referring URLs is removed.
Detailed raw analytics data is automatically deleted after 180 days. Aggregated statistical reports may be retained for longer so that I can understand general website use and longer-term trends.
Matomo is not configured to track logged-in WordPress user IDs or ecommerce activity.
Cookies and third-party website services
This website uses essential technologies necessary for its operation and may use additional services such as Calendly and YouTube.
Where required, non-essential services are prevented from loading until you make a choice through the website’s consent banner.
You can accept or deny non-essential services and change your preferences later using the website’s consent management controls.
The website uses Complianz to manage cookie and service consent.
Full details of cookies and services detected on the website are available in the Cookie Policy (UK).
Scheduling and video sessions
Calendly is used for online appointment scheduling and may process information such as your name, email address and appointment details.
Online sessions are generally conducted using Zoom. Sessions are not routinely recorded. Any recording would require a specific reason and prior agreement.
Calendly, Zoom and other technology providers process information in accordance with their own privacy arrangements.
Payments and financial information
Payments may be made through a UK bank account, Wise or PayPal.
These providers process payment information in accordance with their own privacy policies and legal obligations. I retain appropriate financial and transaction records for accounting and tax purposes.
Supervision and professional consultation
As part of ethical and professional practice, aspects of therapeutic work may be discussed in clinical supervision or professional consultation.
Information is minimised or anonymised wherever reasonably possible. Full names and contact details are not ordinarily disclosed. Supervisors and other appropriate professionals are themselves bound by professional confidentiality and applicable data-protection requirements.
EAP-funded counselling
Where counselling is provided through an Employee Assistance Programme (EAP), I may be required to provide the EAP with limited information about the service provided.
Depending on the EAP, this may include attendance, cancellation or non-attendance, session dates and duration, goals or areas of focus, general progress or change, therapeutic interventions used, arrangements for further sessions and identified risk.
Detailed therapy or process notes are not routinely disclosed to an EAP.
Insurance-funded counselling
Where sessions are funded by an insurer, I may need to provide limited information for authorisation, administration, claims and payment.
This may include attendance, session dates, fees, invoice or claim references, a general reason for therapy or presenting symptoms, and the type of therapeutic intervention provided.
Detailed therapy or process notes are not routinely disclosed to insurers.
When information may be shared
Your information is treated confidentially.
Information may be shared with third parties where this is necessary for providing or administering services, meeting professional or legal responsibilities, or maintaining the website and practice. This may include:
- relevant technology and hosting providers
- Calendly and Zoom
- secure email, storage and backup providers
- payment providers
- professional supervisors
- EAPs or insurers where they are funding your sessions
- appropriate safeguarding, legal or regulatory bodies where necessary
I do not sell or rent personal information.
Some service providers may process information outside the UK. Appropriate safeguards are used where required.
Because I provide services internationally, personal information may also be securely accessed by me while I am working outside the UK. I take reasonable steps to maintain confidentiality and security wherever I am working.
Confidentiality and its limits
What you discuss in therapy is confidential, subject to professional, ethical and legal limitations.
There may be circumstances in which I need to consider sharing information without your consent, for example where there is a serious concern about risk of harm, safeguarding, or where disclosure is required by law.
Where it is appropriate and safe to do so, I will normally discuss this with you before information is shared.
Where services are provided across national borders, different legal or safeguarding obligations may apply depending on where I am practising and where you are located.
Digital and AI tools
Digital tools may be used for appropriate administrative or professional purposes.
I do not enter identifiable client information into generative AI tools as part of routine therapeutic practice. If use of a digital or AI tool would involve processing identifiable personal information in a way that requires your informed consent, this would be discussed with you beforehand.
Professional decisions and clinical responsibility remain mine and are not delegated to automated systems.
How information is protected
Reasonable technical and organisational measures are used to protect personal information.
These include secure locked storage for paper records, password-protected devices, access-controlled accounts, website security measures and appropriate security arrangements for electronic services.
Electronic information may be securely stored or backed up using services including Google Workspace and Apple services.
How long information is kept
Therapy records are normally retained for seven years after the last session and are then securely destroyed.
Information relating to an enquiry that does not proceed to therapy may normally be retained for up to 12 months where there is a legitimate reason to do so.
Routine phone, text and messaging communications are normally deleted when therapeutic work ends or shortly afterwards, usually within two weeks.
Financial and transaction records are retained for the period required by applicable tax and accounting requirements.
Raw Matomo website analytics data is automatically deleted after 180 days. Aggregated statistical reports may be retained for longer.
Other information is retained only for as long as reasonably necessary for the purpose for which it was collected and any applicable professional or legal requirements.
Your rights
Depending on the circumstances and the lawful basis for processing, you may have rights to:
- request access to personal information held about you
- request correction of inaccurate information
- request deletion of information
- request restriction of processing
- object to processing based on legitimate interests
- withdraw consent where processing is based on consent
- request data portability where applicable
These rights are not absolute and some information may need to be retained where there is a lawful, professional or regulatory reason for doing so.
To exercise your rights or ask a question about how your information is handled, contact:
hello@wercurious.com
I will respond within the timescales required by applicable data-protection law.
You also have the right to raise a concern with the UK Information Commissioner’s Office (ICO).
External links
This website may contain links to external websites. I am not responsible for the privacy practices or content of external websites. Please review their privacy information separately.
Safeguarding Policy and Procedure
I work with adults aged 18 and over. However, safeguarding concerns may arise in relation to a client, a child, or another adult who may be at risk of harm.
I take safeguarding concerns seriously and will consider any information that suggests that you or another person may be experiencing, or be at risk of, abuse, neglect, exploitation or serious harm, or that you or another person may pose a serious risk of harm to someone else.
Where a safeguarding concern arises, I will normally discuss this with you wherever it is appropriate and safe to do so. I may also seek professional consultation or supervision to help me consider the concern and determine an appropriate course of action. Wherever possible, identifying information will be limited to what is necessary.
There may be circumstances in which I need to share relevant information without your consent. This may include situations involving a serious risk of harm, safeguarding concerns relating to a child or an adult at risk, or where disclosure is required by law. Any decision to share information will be considered carefully and only information that is necessary and proportionate to the concern will be disclosed.
Because I provide therapy internationally, safeguarding responsibilities and reporting requirements may differ depending on where you are located and where I am practising. Where necessary, I will consider the relevant legal and professional requirements and may seek appropriate professional or legal consultation before deciding what action to take. In an urgent situation, it may be necessary to contact emergency, safeguarding or other appropriate services in the country where you are located.
Safeguarding concerns, decisions, consultations and any action taken will be recorded appropriately as part of my professional records.
Emergency contact information: As part of the information I collect when we begin working together, I ask you to provide details of an emergency contact. This information is held in case a serious concern about your immediate safety or welfare arises and it is necessary and appropriate to contact someone who may be able to help. Providing an emergency contact does not mean that I will routinely contact that person, and I would normally discuss this with you first wherever it is appropriate and safe to do so.
If you have a safeguarding concern relating to your work with me, or wish to raise a concern about the safety or welfare of yourself or someone else connected with the therapeutic work, you can contact me at hello@wercurious.com. If you or someone else is in immediate danger, please contact the emergency services or appropriate emergency or safeguarding service in the country where the person at risk is located.
Changes to this policy
This policy may be updated from time to time to reflect changes in my practice, technology, professional requirements, safeguarding responsibilities or applicable law.
Last updated: September 2026