MAYDAY THERAPY PRIVACY NOTICE
Last updated: 3 November 2026
Who is responsible for your information
I am Amy May, a sole-trader psychotherapeutic counsellor practising as Mayday Therapy. I work with adults aged 18 and over.
I am the data controller for my practice, responsible for deciding how personal information is used and protected.
Email: info@maydaytherapy.com
ICO registration number: ZC285365
Please contact me with questions, to request this notice in another format, or to exercise your data-protection rights.
What information I collect
I collect information needed to respond to enquiries, arrange and provide therapy, and meet my professional responsibilities. This may include:
• Your name, preferred name, date of birth, address and contact details.
• Your location when attending online sessions.
• Relevant information about your health, medication, GP and circumstances.
• Information you share about your experiences, relationships and wellbeing.
• Brief clinical notes, including relevant concerns, decisions and agreed actions.
• Agreements, consent records, appointments, correspondence and payment records.
• Information needed to address complaints, safeguarding concerns or legal claims.
If you nominate an emergency contact, I collect their name, relationship to you and telephone number. These details are used where necessary under our emergency arrangements, or where otherwise legally and ethically justified. They are not used for routine updates about therapy.
Therapy can involve sensitive information about health, ethnicity, sexuality, religious beliefs or other matters described in data-protection law as “special category data”.
Most information comes directly from you. If it comes from another source, such as a referring professional, I will explain the source and purpose where appropriate and lawful.
Website enquiries
My website is hosted by Wix. If you submit an enquiry, your contact details and message are processed through Wix and my practice communication systems so I can respond.
Wix may also process technical information associated with website use, such as IP addresses, device and browser information and activity on the website.
Please keep your initial enquiry brief and avoid including detailed clinical information or information identifying other people.
Wix’s privacy information is available at:
https://www.wix.com/about/privacy
Why I use your information
I use relevant information to:
• Respond to enquiries and consider whether I can offer suitable support.
• Provide therapy and maintain continuity of care.
• Arrange appointments, send agreed reminders and manage payments.
• Obtain clinical supervision and maintain professional accountability.
• Respond to complaints and safeguarding concerns.
• Meet legal obligations and establish, exercise or defend legal claims.
I aim to collect and record only what is relevant and necessary.
The legal grounds for using information
For enquiries about therapy and providing our agreed service, I rely on taking steps at your request before entering a contract and performing our therapy contract: UK GDPR Article 6(1)(b).
For necessary professional administration, supervision, complaints management and appropriate record retention, I rely where appropriate on legitimate interests: Article 6(1)(f). These interests are providing a safe, accountable service and maintaining necessary evidence of my work. I balance them against your rights and privacy.
Where a specific law requires processing or disclosure, I rely on legal obligation: Article 6(1)(c).
For sensitive information used to provide therapy, I ask for your separate explicit consent under Article 9(2)(a). You can withdraw this by contacting me. Withdrawal does not affect processing already carried out lawfully. We would discuss whether and how therapy could continue safely without that processing.
Where sensitive information is needed to establish, exercise or defend legal claims, I rely on Article 9(2)(f).
Safeguarding and emergency disclosures require an applicable lawful basis and, where relevant, a special-category condition. An emergency does not automatically remove your confidentiality or data-protection rights.
Providing information
Some information is needed to arrange therapy and assess whether I can work with you safely. If you do not wish to provide something, please discuss this with me. I will explain why it is requested and whether another arrangement is possible.
Without essential information, I may be unable to offer or continue an appropriate service.
Confidentiality and sharing
I treat what you share in therapy as confidential.
I discuss my work with a clinical supervisor to support safe and ethical practice. My supervisor is bound by confidentiality, and I avoid identifying you wherever possible.
I may share relevant information where required by law, or where legally and ethically justified to protect you or someone else from serious harm, including safeguarding concerns.
Information may also need to be shared with relevant insurers, legal advisers, professional bodies or authorities to address a complaint or legal claim.
Where possible and appropriate, I will discuss proposed disclosures with you beforehand. If information must be shared without your agreement, I will limit disclosure to what is necessary and record my reasons.
I have appointed a confidential professional executor to contact clients if I die or become unable to manage my practice. The arrangements involve access to the minimum client contact information needed for that role. Any further access to or custody of records must have appropriate authority and safeguards.
I do not sell your information. Any proposed use of material from our work in a training assignment or presentation would be discussed separately and require your separate written consent.
Services used by my practice
I use:
• Wix for my website and website enquiries.
• Zanda for client forms, agreements, appointments, invoices and administration.
• Google Workspace, including Google Drive and email, for electronic records and correspondence.
• Zoom for online therapy.
• Stripe through Zanda for card payments.
• Monzo Business for practice banking and bank transfers.
• WhatsApp and text messaging for practical arrangements using agreed contact methods.
These providers process information relevant to their functions. Some also process information for their own legal, regulatory, security and operational purposes, as explained in their privacy notices.
Please do not send payment-card details by email, text or WhatsApp.
Contact between sessions
Email, text and WhatsApp are for enquiries and practical arrangements rather than ongoing therapy between sessions.
I send current clients booking reminders where relevant, pausing these when I know someone is away. You can ask me to stop reminders or change your contact method.
Please keep sensitive matters for sessions where possible. Messages are not continuously monitored, and these channels are not an emergency service.
Security and storage
Handwritten notes and printed clinical records are kept in a locked filing cabinet in my office. Electronic records are held in my practice accounts.
I use access restrictions and account-security measures to reduce the risk of unauthorised access, loss or disclosure. No electronic communication or storage system can be guaranteed completely secure.
International processing
Some providers operate internationally, so information may be stored, accessed or processed outside the UK.
Zanda describes UK hosting for UK accounts, although overseas support and connected services may involve international processing. Wix, Google, Zoom, WhatsApp, Stripe and Monzo also use international operations or service providers.
Transfer protections depend on the provider, destination and service. These can include UK adequacy regulations and approved contractual safeguards, such as Standard Contractual Clauses with the UK Addendum or the UK International Data Transfer Agreement.
Further information is available from:
Wix:
https://www.wix.com/about/privacy
Zanda:
https://zandahealth.com/uk/privacy-policy/
Google Workspace:
https://workspace.google.com/terms/dpa_terms.html
Zoom:
https://www.zoom.com/en/trust/privacy/privacy-statement/
WhatsApp:
https://www.whatsapp.com/legal/privacy-policy-uk
Stripe:
https://stripe.com/gb/privacy
Monzo:
https://monzo.com/legal/privacy-notice/
Please contact me for information about transfers relevant to my practice and how to obtain details of applicable safeguards.
AI notes and recordings
I no longer use AI to transcribe therapy sessions or generate session notes. I make my own clinical notes.
Previously, Zoom generated AI session notes, with copies transferred to Google Drive. Connected Zoom and Google Drive tools within ChatGPT were also used to transfer notes. Existing copies and the handling of those records are being reviewed, including appropriate retention and secure deletion. Stopping AI use does not automatically delete existing information.
Any proposed future audio or video recording would be explained beforehand and require your separate informed consent.
How long I keep information
I normally retain clinical records, therapy contracts and relevant consent records for seven years after our final session, supporting professional accountability and potential legal claims.
Longer retention may be necessary for a specific, documented reason, such as an ongoing complaint, legal claim or legal requirement.
For enquiries that do not lead to therapy, information is kept only while reasonably necessary to respond, manage follow-up or address an associated concern.
Routine administrative messages are kept only while needed. Information relevant to care, complaints or claims may be retained with the appropriate record. Financial records follow applicable accounting and tax requirements.
When no longer needed, paper records are confidentially destroyed and electronic records securely deleted. Provider backup copies may remain until those backups expire or are replaced under the provider’s arrangements.
Your rights
Depending on the information and legal basis involved, you may ask to:
• Access your personal information.
• Correct inaccurate or incomplete information.
• Have information erased.
• Restrict its use.
• Receive certain information in a portable format.
You can object to processing based on legitimate interests and withdraw consent where processing relies on it.
These rights have legal conditions and exceptions. If I cannot fulfil a request, I will explain why.
I do not make decisions about your access to therapy solely through automated processing.
Questions and complaints
Please contact info@maydaytherapy.com with questions, concerns or requests.
You can also complain to the Information Commissioner’s Office:
https://ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113
You do not need my permission to contact the ICO.
Changes to this notice
I review this notice and will bring significant changes affecting your information to your attention.
Reading or acknowledging this notice does not itself give consent to a particular use of your information.