Privacy Policy
How we collect, use, share and protect your personal information, how long we keep it, and the rights you have.
About This Policy
Tavana Health Group ("Tavana", "we", "us", "our") offers Cognitive Behavioural Therapy (CBT) online to adults in the UK. Looking after your personal information carefully is part of looking after you. This policy explains what information we collect, why we need it, who we share it with, how long we keep it, and the rights you have.
We follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Standards of Conduct, Performance and Ethics of the British Association for Behavioural and Cognitive Psychotherapies (BABCP).
Who We Are
The data controller is:
Tavana Health Group Ltd
Company number: 16770307
Registered office: Bartle House, 9 Oxford Court, Manchester M2 3WQ
Registered with the Information Commissioner's Office (ICO): ZC023330
Our data protection lead is Mehran Khederhamzeh, Founder and Director. You can contact us about anything in this policy at info@tavana.co.uk.
Who This Policy Covers
This policy covers clients and prospective clients, people who book a free consultation, workshop or education session, gift card buyers and recipients, newsletter subscribers, people who contact us, and visitors to our website.
What Information We Collect
When You Enquire or Book
- Your name, email address, phone number, date of birth and address.
- The service you book and your appointment history.
When You Receive Therapy
- Health and wellbeing information you share with us, including the reasons you are seeking help, your history and your goals.
- The name and address of your GP, and an emergency contact if you choose to give one.
- Details of any other health professionals involved in your care.
- Your answers to intake, consent and outcome questionnaires (for example PHQ-9, GAD-7 and PCL-5).
- Session notes, your therapy agreement, and any safety plan we write together.
- Letters and emails between you and us, and between us and other professionals involved in your care.
When You Pay
- Invoices and payment records. Card payments are handled by Stripe. We never see or store your full card details.
When You Use Our Website or Sign Up to Our Newsletter
- Basic technical information, such as your browser type and the pages you visit. If you accept analytics cookies, Google Analytics also records how you use our website, such as the pages you visit and how long you stay. See our Cookie Policy.
- Your email address and name, if you subscribe to our newsletter.
We only collect what we need to provide safe and effective care. By law, we need your agreement to keep records about your care. We ask for this in your therapy agreement before therapy begins.
Why We Use Your Information & Our Legal Basis
| What We Do | Lawful Basis |
|---|---|
| Book and manage your appointments, send confirmations and reminders, and provide therapy | Performing our contract with you |
| Keep clinical records and use questionnaires to plan and review your care | Contract, and for health information, the provision of health care (UK GDPR Article 9(2)(h) and Data Protection Act 2018 Schedule 1, paragraph 2) |
| Write to your GP or other professionals about your care, with your agreement | Contract and the provision of health care |
| Share information to protect you or someone else from serious harm | Vital interests, or safeguarding as allowed by the Data Protection Act 2018 |
| Take payments and keep financial records | Contract and legal obligation (tax law) |
| Clinical supervision (see below) | Legitimate interests and the provision of health care |
| Respond to complaints, legal claims and regulators, including BABCP | Legal obligation and legitimate interests |
| Understand how our website is used so we can improve it (Google Analytics, only if you accept analytics cookies) | Your consent, which you can withdraw at any time through our cookie settings |
| Send our newsletter or news about workshops | Your consent, which you can withdraw at any time |
Clinical Supervision
BABCP requires accredited therapists to have regular clinical supervision with an experienced CBT supervisor. This helps keep your care safe and effective. When your care is discussed in supervision, we do not share your name or any details that could identify you.
Confidentiality & Its Limits
What you share in therapy stays confidential. There are a small number of situations in which we may need to share information without your agreement:
- If we believe you are at serious risk of harm, we may contact your GP so they can support you between sessions;
- If we believe someone else is at serious risk of harm, we may contact the relevant services, including the police in an emergency;
- If there is a safeguarding concern about a child or a vulnerable adult;
- If a court orders us to, or the law otherwise requires it.
Wherever it is safe and possible, we will talk to you first and explain why.
Working with Your GP & Other Professionals
With your agreement, we may write to your GP after your assessment and at the end of therapy, to summarise the work we are doing together. We will share these letters with you. If you are seeing other health professionals, we will agree with you how we keep in touch with them.
If Your Therapist Becomes Unable to Work
BABCP requires therapists to have a clinical will, a professional arrangement that names a qualified colleague as clinical executor. If your therapist became seriously ill or died, the clinical executor would access your contact details and records only as needed to tell you, support you to find continuing care, and keep your records safe.
Who We Share Your Information With
We never sell your information. We use a small number of trusted providers to run the practice. Each one acts on our instructions under a written agreement and must keep your information secure.
| Provider | What They Do for Us | Where Data Is Held |
|---|---|---|
| Cliniko (Red Guava) | Client records, online booking, forms, invoices, video sessions, email and SMS reminders | UK |
| Stripe | Card payments | UK, EU and USA |
| Microsoft 365 | Email, documents and Microsoft Teams (used for workshops) | UK and EU |
| MailerLite | Our newsletter, only if you subscribe | EU |
| Webflow | Our website and contact forms | USA |
| Cloudflare | Protects our website and forms from spam and attacks, including Cloudflare Turnstile | USA |
| CookieYes | Our cookie banner, and a record of the choice you make, with your IP address partly hidden | EU |
| Google (Google Analytics) | Website statistics, only if you accept analytics cookies | USA |
Where a provider processes information outside the UK, we make sure appropriate safeguards are in place, such as the UK-US Data Bridge, UK adequacy regulations for the EU, or the UK International Data Transfer Addendum.
Online Sessions
Individual sessions take place through Cliniko's secure, encrypted video service. Workshops use Microsoft Teams. We do not record sessions, and we ask that you do not record them either. If recording would ever help your therapy (for example, for supervision), we would only do this with your explicit written consent, and we would explain how the recording is used, stored and deleted.
How Long We Keep Your Information
| Information | How Long We Keep It |
|---|---|
| Clinical records, therapy agreements, questionnaires, session notes and letters | 7 years after your last contact with us. This covers the time limits for legal claims, in line with guidance from BABCP and the requirements of our professional insurance |
| Invoices and payment records | 6 years after the end of the financial year they relate to (required by HMRC) |
| Enquiries that do not lead to therapy | 12 months |
| Newsletter subscriptions | Until you unsubscribe |
| Website statistics (Google Analytics) | Detailed records linked to your browser: 2 months. We keep only summary statistics that do not identify anyone |
| Complaints | Kept separately from your session notes, for as long as your clinical record is kept |
If a complaint, legal claim or safeguarding matter is still open at the end of these periods, we keep the relevant records until it is resolved. When information is no longer needed, it is permanently and securely deleted.
Keeping Your Information Secure
Your records are stored in Cliniko, which encrypts data and is protected by strong passwords and two-factor authentication. The devices we use are password protected and have up-to-date security software. Only the people who need access to provide your care or run the practice can see your information. We do not keep paper records.
If a security incident ever put your information at risk, we would act quickly to contain it, report it to the ICO where the law requires, and tell you if it could affect you.
Automated Decisions
We do not make decisions about you using automated processes or profiling.
Your Rights
You have the right to:
- Know how your information is used (this policy);
- Ask for a copy of the information we hold about you, including your clinical notes;
- Ask us to correct anything that is wrong;
- Ask us to delete your information, where we are not required to keep it;
- Ask us to limit how we use your information;
- Object to how we use your information;
- Ask for your information in a portable format;
- Withdraw your consent at any time, where we rely on consent.
To use any of these rights, email info@tavana.co.uk. We will reply within one month. There is normally no charge.
Some rights have limits. For example, we need to keep clinical and financial records for the periods above even if you ask us to delete them.
Cookies
Our website uses cookies, including analytics cookies if you agree to them. Please see our separate Cookie Policy.
Concerns & Complaints
If you are unhappy with how we have handled your information, please contact us first at info@tavana.co.uk so we can put it right. We will acknowledge your complaint and keep you updated until it is resolved.
You can also complain to the Information Commissioner's Office (ICO) on 0303 123 1113.
Changes to This Policy
We review this policy every year, and sooner if the way we work changes. The latest version is always on our website.