Last updated: January 2026

1. Introduction

I, Georgia Mancroft, understand that your privacy is important to you and I am committed to protecting your personal data. This Privacy Policy explains how I collect, use, store, and protect your personal data when you visit my website www.georgiamancrofttherapy.com (the “Website”) or use my therapy services (the “Services”).

I process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

This Privacy Policy applies only to my Website and Services. My Website may contain links to third-party websites, which are not governed by this Privacy Policy. I encourage you to review the privacy policies of any third-party websites you visit.

​

2. Data Controller

For the purposes of data protection law, I am the data controller.

Name: Georgia Mancroft
Status: Sole trader, self-employed
Data Protection Officer: Georgia Mancroft
Email: georgiamancrofttherapy@gmail.com
Telephone: 07944 100207
Postal address: 42B Digby Crescent, London, N4 2HR

I am a member of the UK Council for Psychotherapy (UKCP) and the British Psychological Society (BPS) (Graduate Member).

​

3. Personal Data I Collect

Personal data means any information that can identify you as an individual.

​

3.1 Personal data may include:

• Identity Data: name, title

• Contact Data: email address, telephone number, postal address

• Financial Data: payment and billing information (payments are processed securely via third-party providers)

• Transaction Data: details of services provided and payments made

• Technical Data: IP address, browser type and version, operating system, device information

• Usage Data: information about how you use my Website

• ​

3.2 Special Category Data

As a therapist, I also process special category personal data, including: - Mental health information - Therapy notes and clinical records - Relevant medical or psychological information you choose to share

This data receives a higher level of protection under UK GDPR.

​

4. How I Collect Your Data

I collect personal data in the following ways: - When you contact me by email, telephone, or via my Website - When you engage my therapy services - When you make payments for services - Through cookies and similar technologies on my Website (see Section 9)

​

5. Lawful Bases for Processing

I only process personal data where the law allows me to do so.

​

5.1 Article 6 UK GDPR lawful bases

I rely on the following lawful bases: - Contract: to provide therapy services to you - Legal obligation: to comply with tax, accounting, or regulatory requirements - Legitimate interests: to manage my practice, respond to enquiries, and maintain my Website

​

5.2 Article 9 lawful bases (special category data)

For special category data, I rely on: - Article 9(2)(h): provision of health or social care or treatment - Article 9(2)(a): your explicit consent, where required

​

6. How I Use Your Data

I use your personal data to: - Provide therapy services - Communicate with you about appointments and services - Process payments - Comply with legal and regulatory obligations - Maintain accurate records - Improve and manage my Website

I do not send unsolicited marketing communications.

​

7. Data Sharing

I may share your personal data only where necessary and lawful, including: - With healthcare professionals involved in your care (where appropriate and lawful) - With professional advisors (such as accountants) - With service providers who support my business (e.g. website hosting, secure email, payment processing) - Where required by law or to protect vital interests

All third parties are required to process your data securely and in accordance with data protection law.

​

8. International Transfers

If your personal data is transferred outside the UK, I ensure appropriate safeguards are in place, such as UK-approved contractual clauses, to protect your data in line with UK GDPR requirements.

​

9. Cookies

My Website uses cookies.

• Strictly necessary cookies are required for the Website to function and do not require consent.

• Analytics cookies (such as Google Analytics) are used only with your consent to help me understand how visitors use the Website.

You will be asked to provide consent for non-essential cookies via a cookie banner. You can withdraw or change your consent at any time through your browser settings or the cookie preferences tool.

​

10. Data Security

I take appropriate technical and organisational measures to protect your personal data, including secure storage, limited access, and encryption where appropriate.

I have procedures in place to deal with any suspected personal data breach and will notify you and the Information Commissioner’s Office (ICO) where legally required.

While I take all reasonable steps to protect your data, no method of transmission over the internet is completely secure.

​

11. Data Retention

I retain personal data only for as long as necessary: - Therapy records are generally retained for up to seven years after the end of the therapeutic relationship, unless a longer period is required by law or professional guidance. - Website and enquiry data is retained only as long as necessary to respond and manage my services.

​

12. Your Rights

Under UK GDPR, you have the right to: - Be informed about how your data is used - Access your personal data - Request correction of inaccurate data - Request erasure of your data - Restrict processing - Object to processing - Data portability - Withdraw consent (where consent is the lawful basis)

These rights are not absolute and may be subject to legal limitations.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk. I encourage you to contact me first so I can try to resolve any concerns.

​

13. Children and Young People’s Data

I also provide therapy services to children and young people under the age of 18.

When working with children and young people, I process personal data in accordance with UK GDPR, the Data Protection Act 2018, and relevant professional and safeguarding obligations.

​

13.1 Parental Responsibility and Consent

• Where required by law or professional guidance, I will obtain consent from a person with parental responsibility before providing services or processing personal data.

• Where appropriate, I will also seek the assent or consent of the child or young person, taking into account their age, maturity, and understanding (often referred to as Gillick competence).

​​

13.2 Confidentiality and Safeguarding

• Personal data relating to children and young people, including therapy records, is treated as strictly confidential.

• Information may be shared without consent where I have a legal or professional duty, including safeguarding concerns, risk of serious harm, or where disclosure is required by law.

• Any information sharing will be limited to what is necessary and proportionate.

​​

13.3 Special Category Data

When working with children and young people, I process special category data including mental health information and therapy records. This data is processed under: - Article 9(2)(h) UK GDPR (health or social care) - Article 9(2)(a) UK GDPR (explicit consent), where applicable

​

13.4 Data Retention for Children and Young People

Records relating to children and young people are retained in line with legal, regulatory, and professional guidance. In many cases, this may mean retaining records until the child reaches the age of 25, or longer where required by law or safeguarding considerations.

​

14. Contact

If you have any questions about this Privacy Policy or how I use your personal data, please contact me:

Email: georgiamancrofttherapy@gmail.com
Telephone: 07944 100207
Postal address: 42B Digby Crescent, London, N4 2HR

​

15. Changes to This Privacy Policy

I may update this Privacy Policy from time to time to reflect changes in law or my services. The latest version will always be available on my Website.

​

​

Child and Parent Privacy Notice​

​

Last updated: January 2026

​

This notice explains how personal information is used when Georgia Mancroft Therapy works with children and young people under the age of 18, and how this information is handled for both children/young people and their parents or carers.

​

This notice should be read alongside the main Privacy Policy available on my website.

​

1. Who I Am

My name is Georgia Mancroft. I am a self-employed therapist and the data controller for any personal information collected.

​

Contact details:
Email: georgiamancrofttherapy@gmail.com
Telephone: 07944 100207
Address: 42B Digby Crescent, London, N4 2HR

​

2. Whose Information I Collect

I may collect and use personal information about: - The child or young person receiving therapy - Parents or carers with parental responsibility

​

3. Information I Collect

3.1 About the Child or Young Person

This may include: - Name, date of birth, and contact details - Information about emotional wellbeing and mental health - Therapy notes and session records - Relevant medical, educational, or family information - Information shared during therapy sessions.

This information is classed as special category data under data protection law and is given extra protection.

3.2 About Parents or Carers

This may include: - Name and contact details - Relationship to the child or young person - Payment and billing information - Information relevant to the child’s care or safeguarding

​

4. Why I Use This Information

I use personal information to: - Provide therapeutic services safely and effectively - Communicate about appointments and therapy arrangements - Meet legal, ethical, and safeguarding obligations - Maintain accurate clinical records - Manage payments and administration

​

5. Lawful Basis for Processing

Under UK GDPR, I must have a lawful basis to use personal information.

5.1 General personal data (Article 6)

I rely on: - Contract: to provide therapy services - Legal obligation: safeguarding and record-keeping duties - Legitimate interests: managing my practice appropriately

5.2 Special category data (Article 9)

I rely on: - Article 9(2)(h): provision of health or social care - Article 9(2)(a): explicit consent, where required

​

6. Consent and Gillick Competence

• For younger children, consent is usually provided by a parent or carer with parental responsibility.

• For older children and young people, I will consider whether they are able to give informed consent themselves (Gillick competence).

• Wherever possible, I involve both the child or young person and their parent or carer in decisions about information sharing.

Consent can be withdrawn, but this may affect my ability to provide therapy safely.

​

7. Confidentiality and Information Sharing

Therapy is confidential. This means that what is discussed in sessions is not normally shared with parents, carers, or others.

However, confidentiality may be broken if: - I am concerned about serious harm to the child, young person, or someone else - There are safeguarding concerns - Disclosure is required by law or a court order

Where possible, I will discuss any need to share information before doing so.

​

8. Who Information May Be Shared With

Information may be shared, when lawful and necessary, with: - Parents or carers (as appropriate) - GPs or other healthcare professionals - Schools or local authority services - Safeguarding agencies - Professional advisors (e.g. supervisors, where anonymised)

Only relevant information will be shared, and only when necessary.

​

9. How Information Is Stored and Protected

• Records are stored securely, either electronically or in locked storage.

• Access is limited to me only.

• Emails and digital records are protected by passwords and security measures.

I take reasonable steps to keep personal information safe, but no system is completely risk-free.

​

10. How Long Information Is Kept

• Records relating to children and young people are usually kept until the child reaches the age of 25.

• In some cases, records may be kept longer if required by law or professional guidance.

​

11. Rights of Children, Young People, and Parents

Under data protection law, individuals have rights including: - The right to be informed - The right to access personal information - The right to request correction of inaccurate information - The right to request deletion of information (where applicable) - The right to restrict or object to processing

These rights are not absolute and must be balanced with safeguarding duties and the child’s best interests.

​

12. Making a Complaint

If you have concerns about how personal information is handled, please contact me in the first instance.

You also have the right to complain to the Information Commissioner’s Office (ICO): www.ico.org.uk

​

13. Changes to This Notice

This notice may be updated from time to time. The most recent version will be provided when therapy begins or made available on request.