Privacy Policy

Laissez Therapy | midnightsupport.co.uk

Last updated: June 2026 | ICO Registration: ZC171810

1. Who We Are

Laissez Therapy is a private therapy practice operated by Martin Yearley, a Cognitive Behavioural Therapist accredited with the British Association for Behavioural and Cognitive Psychotherapies (BABCP). Martin Yearley is the data controller for all personal data processed in connection with this practice.

2. What Personal Data We Collect

We collect and process the following categories of personal data:

2a. Identity and Contact Information

Full name
Date of birth
Email address and telephone number
Emergency contact details (name and phone number)

2b. Clinical and Health Information (Special Category Data)

This is sensitive personal data under UK GDPR Article 9 and is processed only with your explicit consent:

Presenting difficulties, symptoms, and mental health history
Completed clinical questionnaires (e.g. PHQ-9, GAD-7)
Session notes, case formulations, treatment plans
CBT worksheets and homework completed during treatment
Risk assessments and safeguarding records where applicable
Relevant medical history and current medications
GP details (where provided)

2c. Audio Recordings (where consent is given)

With your explicit consent, some sessions may be audio recorded. Audio recordings are useful for clinical reflection and supervision purposes. Audio recordings are never shared without your written consent. You may withdraw consent to being recorded at any time, including mid-session, without affecting your treatment.

2d. Administrative Data

Appointment summary and session dates
Payment records (amount paid; we do not store card details)
Correspondence and messages received

2e. Paper Records

A significant portion of clinical work is conducted on paper. This includes session notes, worksheets, questionnaires and other data. Paper records are stored securely in a locked filing cabinet and are subject to the same retention, access, and destruction policies as digital records.

2f. Digital Portal Data (where applicable)

If you access our secure client portal, we collect login credentials (encrypted), questionnaire responses submitted via the portal, and documents shared between practitioner and patient.

3. Our Lawful Basis for Processing

We rely on the following lawful bases under UK GDPR:

For general personal data (Article 6):

Contractual necessity — processing your name, contact details and appointment records is necessary to provide the service you have contracted with us.
Legitimate interests — retaining records after discharge to manage complaints, respond to legal claims, or provide continuity of care if you re-enter treatment.
Legal obligation — we are required by law to retain and disclose certain information (e.g. safeguarding duties, court orders).

For special category health data (Article 9):

Explicit consent — you will be asked to give clear, informed, written consent before we process any mental health or clinical information. You may withdraw this consent at any time.
Substantial public interest (Schedule 1, DPA 2018) — in safeguarding situations or where there is a serious risk to life, we may process data without consent where legally required.
Health care provision (Article 9(2)(h)) — processing is necessary for the provision of health care and treatment by a health professional.

4. How We Use Your Data

We use your personal data for the following purposes:

Providing assessment, therapy, and clinical care
Completing clinical questionnaires to measure progress and inform treatment
Scheduling and managing appointments
Sending appointment reminders and relevant communications
Clinical supervision — session content may be discussed in anonymised or pseudonymised form with a BABCP-accredited supervisor as required by our professional standards
Maintaining accurate clinical records as required by our professional body (BABCP)
Responding to your enquiries and correspondence
Fulfilling safeguarding obligations where there is a serious risk to your life or the life of another

We will never use your data for marketing, research (without separate explicit consent), or any purpose not listed above.

5. Who We Share Your Data With

We treat your data with strict confidentiality. We do not sell, rent, or share your personal data with third parties for commercial purposes. We may share information only in the following limited circumstances:

Clinical Supervision

As required by BABCP accreditation standards, clinical work is discussed in regular supervision. Your data will be presented in anonymised or pseudonymised form wherever possible. Our supervisor is bound by the same confidentiality obligations.

Your GP (with consent)

With your written consent, we may write to your GP to inform them you are receiving therapy, or to coordinate care. We will not contact your GP without your consent except in a safeguarding emergency.

Safeguarding and Legal Obligations

In exceptional circumstances, we may disclose information without consent where there is a serious and imminent risk to life (yours or another person's), or where we are required to do so by law (e.g. a court order, or statutory safeguarding duty). We will inform you of any such disclosure wherever it is safe and lawful to do so.

Technology Providers

We use third-party technology services to operate our practice. These act as data processors under UK GDPR and are bound by data processing agreements:

Wix.com — website hosting (public-facing website only; no clinical data stored here)
Softr — Client portal provider used to share documents and questionnaires securely; EU-hosted data only
Calendly.com — appointment scheduling only; no clinical data shared

We do not use any US-based cloud storage for clinical records without appropriate Standard Contractual Clauses or equivalent safeguards in place.

6. How Long We Keep Your Data

Clinical records (including session notes, questionnaires, worksheets, and audio recordings) are retained for 7 years from the date of the final session, in line with BABCP guidance and standard UK healthcare practice. Audio recordings of sessions are retained for a maximum of 12 months from the date of recording, unless we agree a shorter period or you withdraw consent. They are deleted securely at the end of this period. Paper records are retained for the same periods as digital records and are destroyed securely (shredded) at the end of the retention period. After the retention period, all records (digital and paper) are securely and permanently deleted or destroyed. You may request early deletion of your data (see Section 8), though we may need to retain certain records for legal or professional reasons even where we agree to your request.

7. How We Keep Your Data Secure

We take data security seriously and have the following measures in place:

Digital security:

All devices used for clinical work are password-protected and encrypted
Client portal communications are encrypted in transit (HTTPS/TLS)
Patient data stored in our portal is encrypted at rest
Patient portal accounts are protected by individual login credentials
Clinical data is stored on servers located within the UK or European Economic Area (EEA) only
Email containing clinical information is avoided where possible; the secure portal is used instead
Devices are protected by up-to-date antivirus and firewall software

Physical security:

Paper records are stored in a locked filing cabinet in a secure location
Paper records are not left unattended in accessible areas
Audio recordings are stored in an encrypted, password-protected folder

In the event of a data breach:

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours, as required by UK GDPR Article 33. Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay.

8. Your Rights

Under UK GDPR, you have the following rights regarding your personal data. To exercise any of these rights, please contact us at martinyearley@outlook.com. We will respond within one calendar month.

Right of access (Article 15): You may request a copy of all personal data we hold about you (a Subject Access Request).
Right to rectification (Article 16): You may ask us to correct any inaccurate or incomplete data we hold.
Right to erasure (Article 17): You may request deletion of your personal data where we no longer have a lawful basis to hold it. Note that we may need to retain certain records for legal or professional reasons.
Right to restrict processing (Article 18): You may ask us to pause processing your data in certain circumstances.
Right to data portability (Article 20): Where data was provided by you and processed by automated means, you may request it in a portable format.
Right to object (Article 21): You may object to processing carried out on the basis of legitimate interests.
Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
Right not to be subject to automated decision-making (Article 22): We do not use automated decision-making or profiling in our practice.

9. Cookies and the Website

Our public website (www.midnightsupport.co.uk) is built on Wix.com, which sets cookies for essential site functionality and anonymised analytics. We do not have access to third-party advertising cookies and do not use cookies for marketing purposes. Our secure client portal (portal.midnightsupport.co.uk, where applicable) uses only essential session cookies necessary for login security. No analytics or tracking cookies are used within the portal. No cookies from the public website carry over into the patient portal. You can manage cookie preferences through your browser settings. Blocking essential cookies may impact website functionality.

10. International Data Transfers

We aim to store all clinical and personal data within the UK or European Economic Area (EEA). Where any technology provider stores data outside the UK/EEA, we ensure that appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or Standard Contractual Clauses (SCCs), or that the destination country has been deemed adequate by the UK Government. If you have questions about where specific data is stored, please contact us and we will provide details of the specific safeguards in place.

11. Confidentiality and Its Limits

Everything you share within therapy is treated as strictly confidential. However, confidentiality has limits. We may need to share information (without your consent if necessary) in the following circumstances:

Where there is serious and imminent risk to your life or the life of another person
Where we have a statutory duty to report (e.g. child protection concerns, terrorism)
Where we are ordered to disclose information by a court of law

In all other circumstances, your confidentiality will be maintained. Where possible, we will discuss any proposed breach of confidentiality with you before taking action.

Clinical supervision: As required by BABCP standards, case material may be discussed with a clinical supervisor. Supervision is a professional and ethical requirement that ultimately protects you as a client. Your supervisor is bound by equivalent confidentiality obligations.

12. How to Make a Complaint

If you have any concerns about how we handle your personal data, please contact us in the first instance:

Email: martinyearley@outlook.com

We take all data complaints seriously and will respond within one calendar month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent data protection authority, at any time:

Website: ico.org.uk
Telephone: 0303 123 1113
Post: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practice, technology, or legal obligations. The current version will always be published at www.midnightsupport.co.uk/privacy with the date of last update clearly shown. Where changes are material, we will notify active clients by email before the changes take effect.

This policy was last reviewed June 2026.